Aggregator

Infrawatch обнаружила рынок, где мобильные сети становятся товаром для тех, кто хочет скрыть следы.

A vulnerability was found in GreenCMS up to 2.3 and classified as critical. Affected is the function themeadd of the file /index.php?m=admin&c=custom&a=themeadd. The manipulation results in unrestricted upload. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is reported as CVE-2026-7044. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability has been found in GreenCMS up to 2.3 and classified as critical. This impacts the function pluginAddLocal of the file /index.php?m=admin&c=custom&a=pluginadd. The manipulation leads to unrestricted upload. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is documented as CVE-2026-7043. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability, which was classified as critical, was found in 666ghj MiroFish up to 0.1.2. This affects the function create_app of the file backend/app/__init__.py of the component REST API Endpoint. Executing a manipulation can lead to missing authentication. This vulnerability is registered as CVE-2026-7042. It is possible to launch the attack remotely. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Submit #798530 / VDB-359623

Submit #798529 / VDB-359622

'Firestarter' Backdoor Can Survive Reboots, Upgrades and Standard Fixes
The Cybersecurity and Infrastructure Security Agency issued an emergency directive warning a newly-discovered Cisco backdoor can survive routine remediation processes, forcing agencies to investigate edge devices that anchor federal firewall and VPN security.

HHS OCR Breach Investigators Again Find All-Too-Common Risk Analysis Failures
Faulty or non-existent security risk analyses cost a medical imaging provider, a women's healthcare group, a health plan and a third-party insurance administrator a collective $1.7 million in fines after federal regulators concluded they didn't do enough to prevent ransomware attacks.

Acquisition Adds Advisory, GRC and Vulnerability Services to ImagineX's MDR Core
TekStream acquired ImagineX’s cyber division to integrate advisory, vulnerability management and GRC with its MDR services, aiming to help CISOs defend against faster, AI-driven attacks by unifying proactive and reactive security into a single operational model.

A vulnerability, which was classified as problematic, has been found in 666ghj MiroFish up to 0.1.2. The impacted element is an unknown function of the file /console of the component Werkzeug Debugger PIN Handler. Performing a manipulation of the argument SECRET results in information disclosure. This vulnerability is cataloged as CVE-2026-7041. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to use restrictive firewalling. The project was informed of the problem early through an issue report but has not responded yet.

今日暂未更新资讯~
更多最新文章，请访问SecWiki

Submit #798583 / VDB-359621

A vulnerability classified as critical was found in tufantunc ssh-mcp up to 1.5.0. The affected element is the function shell.write of the file src/index.ts. Such manipulation of the argument Description leads to command injection. This vulnerability is listed as CVE-2026-7039. The attack must be carried out locally. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Submit #798526 / VDB-359620

Submit #798528 / VDB-359619

A vulnerability classified as problematic has been found in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler. This manipulation causes insufficiently protected credentials. This vulnerability is tracked as CVE-2026-7038. The attack is restricted to local execution. Moreover, an exploit is present. The project was informed of the problem early through an issue report but has not responded yet.