#cve — Public Fediverse posts

🛡️ secdb-cli 0.7.0 is out.

It's the open source command-line client for ZEN SecDB: CVE lookup, SSVC, and auditing of packages, SBOMs, dependency manifests, Linux hosts and Docker images.

What's new:

- secdb search: full-text search across CVEs, CWEs, security advisories, NASL plugins and ExploitDB entries. Filter by record type and by date, combine terms with OR, exclude them, search exact phrases. CVEs in the CISA KEV catalog are marked, and every result links to its record.

- --jq: filter the JSON output of any command with a jq expression, without installing jq. Handy in CI images and on Windows.

- Safer terminal output: control characters coming from third-party feed data are stripped before they reach your terminal.

Examples:
secdb search fortinet kev:true --since 30d
secdb search '"remote code execution"' --type cve
secdb audit sbom --file bom.json --fail-on high --jq '.[].advisories[].id'

💾 Binaries for Linux, macOS and Windows:
https://github.com/giterlizzi/secdb-cli/releases/tag/v0.7.0

#InfoSec #VulnerabilityManagement #OpenSource #Golang #CVE #NTTDATA #ZENSecDB

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 111 CVEs across 27 images:
• 🔴 Critical: 1
• 🟠 High: 47
• 🟡 Medium: 55
• 🔵 Low: 8

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

GCVE BCP-02 v1.9: Making Coordinated Vulnerability Disclosure Open, Accessible, and Practical for Everyone

The GCVE initiative has published version 1.9 of GCVE BCP-02 . Practical Guide to Vulnerability Handling and Disclosure, introducing significant improvements to help software vendors, manufacturers, open-source maintainers, and security researchers establish effective Coordinated Vulnerability Disclosure (CVD) processes.

Coordinated Vulnerability Disclosure should not be a privilege reserved for large organizations with dedicated security teams, expensive compliance frameworks, or specialized legal departments. Every software developer and manufacturer, regardless of size or resources, should be able to receive, assess, remediate, and disclose security vulnerabilities responsibly. This is one of the fundamental principles behind GCVE BCP-02.

The updated document is freely available, openly developed, and distributed under the Creative Commons Attribution 4.0 (CC BY 4.0) license. Organizations can reuse, adapt, and integrate its recommendations into their own vulnerability-handling processes.

#cra #cve #gcve #vulnerability #cvd #vulnerabilityManagement

🔗 https://gcve.eu/2026/10/16/gcve-bcp-02-v1.9-making-coordinated-vulnerability-disclosure-open-accessible-and-practical-for-everyone/

Security Tip: Don't ignore transitive dependencies. 🛡️ Most apps rely on dozens of direct dependencies, which pull in hundreds of transitive ones. These hidden libraries are a prime target for supply chain attacks. Use tools like 'npm list' or 'mvn dependency:tree' to visualize your stack and ensure your scanners are looking deep enough. Stay ahead of emerging vulnerabilities at https://cvedatabase.com #CVE #CyberSecurity #InfoSec #AppSec #SoftwareDevelopment

CVE-2026-94169 (CRITICAL, CVSS 10) affects Theme-one The Grid <2.8.2. Improper code generation enables code injection — patch immediately to reduce exposure. Full advisory: https://radar.offseq.com/threat/cve-2026-94169-improper-control-of-generation-of-code-code-injection-in-theme-one-the-grid-bc4b07c2fb8ec549 #OffSeq #CVE #WordPress #infosec

BeyondTrust doing their darnedest not to explicitly say that there's an exploited zero-day vulnerability in their Remote Support product. CVE-2026-102769 (CVSS4: 9.3 critical) authentication bypass > remote attacker can perform file operations

A suspected China-nexus espionage actor exploited a zero-day vulnerability.

https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
https://www.beyondtrust.com/blog/entry/bt26-05
https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/

#beyondtrust #china #zeroday #espionage #CVE #eitw #mandiant #ArmoryCastle #UNC5221

CVE Alert: CVE-2026-108437 - Microsoft - Microsoft 365 Apps for Enterprise - https://www.redpacketsecurity.com/cve-alert-cve-2026-108437-microsoft-microsoft-365-apps-for-enterprise/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-108437 #microsoft #microsoft-365-apps-for-enterprise

CVE Alert: CVE-2026-108433 - Microsoft - Microsoft 365 Apps for Enterprise - https://www.redpacketsecurity.com/cve-alert-cve-2026-108433-microsoft-microsoft-365-apps-for-enterprise/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-108433 #microsoft #microsoft-365-apps-for-enterprise

CVE Alert: CVE-2026-108428 - Microsoft - Microsoft 365 Apps for Enterprise - https://www.redpacketsecurity.com/cve-alert-cve-2026-108428-microsoft-microsoft-365-apps-for-enterprise/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-108428 #microsoft #microsoft-365-apps-for-enterprise

CVE Alert: CVE-2026-108430 - Microsoft - Microsoft 365 Apps for Enterprise - https://www.redpacketsecurity.com/cve-alert-cve-2026-108430-microsoft-microsoft-365-apps-for-enterprise/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-108430 #microsoft #microsoft-365-apps-for-enterprise

CVE Alert: CVE-2026-108431 - Microsoft - Microsoft 365 Apps for Enterprise - https://www.redpacketsecurity.com/cve-alert-cve-2026-108431-microsoft-microsoft-365-apps-for-enterprise/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-108431 #microsoft #microsoft-365-apps-for-enterprise

CVE Alert: CVE-2026-108429 - Microsoft - Microsoft 365 Apps for Enterprise - https://www.redpacketsecurity.com/cve-alert-cve-2026-108429-microsoft-microsoft-365-apps-for-enterprise/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-108429 #microsoft #microsoft-365-apps-for-enterprise

CVE Alert: CVE-2026-108432 - Microsoft - Microsoft 365 Apps for Enterprise - https://www.redpacketsecurity.com/cve-alert-cve-2026-108432-microsoft-microsoft-365-apps-for-enterprise/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-108432 #microsoft #microsoft-365-apps-for-enterprise

CVE Alert: CVE-2026-108427 - Microsoft - Microsoft 365 Apps for Enterprise - https://www.redpacketsecurity.com/cve-alert-cve-2026-108427-microsoft-microsoft-365-apps-for-enterprise/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-108427 #microsoft #microsoft-365-apps-for-enterprise

CVE Alert: CVE-2026-108426 - Microsoft - Microsoft 365 Apps for Enterprise - https://www.redpacketsecurity.com/cve-alert-cve-2026-108426-microsoft-microsoft-365-apps-for-enterprise/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-108426 #microsoft #microsoft-365-apps-for-enterprise

🚨🔓 SIGINT // Cybersecurity Watch — 2026-10-16
CISA flags active exploitation of an Ivanti Connect Secure flaw—a prime target for state actors against enterprise VPN gateways. Patch now.
https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
#CVE #Ivanti #InfoSec #CISA

Security Tip: Don't ignore transitive dependencies. 🛡️

When you pull in a library, you're also pulling in its entire dependency tree. Attackers often target these "hidden" packages because they are less frequently audited by developers.

Action: Use tools like npm audit, cargo audit, or pip-audit to visualize and secure your full stack. Stay ahead of threats: https://cvedatabase.com

#CVE #InfoSec #CyberSecurity #SupplyChain

🚨 [CISA-2026:1015] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1015)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-21589 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21589)
- Name: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Atlassian
- Product: Multiple Products
- Notes: https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html?ref=labs.watchtowr.com ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21589

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261015 #cisa20261015 #cve_2026_21589 #cve202621589

Palo Alto alerte sur un 0-day activement exploité dans PAN-OS. Ce qui retient l'attention : ce n'est pas un exploit théorique — il est déjà utilisé dans des attaques réelles. Les équipements périmètre sont une cible de choix : compromis, ils donnent une vue sur tout le réseau. Le patch, c'est maintenant. #infosec #CVE #0day
https://gbhackers.com/palo-alto-pan-os-zero-day/

🔍 Lambda Watchdog detected that CVE-2026-70175 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/760 #AWS #Lambda #Security #CVE #DevOps #SecOps

🔍 Lambda Watchdog detected that CVE-2026-88092 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/759 #AWS #Lambda #Security #CVE #DevOps #SecOps

🔍 Lambda Watchdog detected that CVE-2026-70188 is no longer present in latest AWS Lambda base image scans. https://github.com/aws/aws-lambda-base-images/issues/758 #AWS #Lambda #Security #CVE #DevOps #SecOps

🚨 Lambda Watchdog CVE Report 🚨
Latest AWS Lambda image scan detected 108 CVEs across 27 images:
• 🔴 Critical: 1
• 🟠 High: 47
• 🟡 Medium: 52
• 🔵 Low: 8

Check the full report 👉 https://lambdawatchdog.com/
#AWS #Lambda #CVE #CloudSecurity #Serverless

🟠 New security advisory:

CVE-2026-0322 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-0322-pan-os-management-rce-exploited-in-the-wild

by Yazoul AI

#CVE #SecurityPatching #HackerNews

Security Tip: Shift security left by automating dependency scanning! 🛡️ Integrating tools like Snyk or Trivy into your CI/CD pipeline ensures that vulnerable packages are identified before they are deployed. Don't let a known CVE in a third-party library become your next incident. Stay updated on the latest vulnerabilities and remediation steps at https://cvedatabase.com #CVE #CyberSecurity #InfoSec #AppSec #DevSecOps

🚨 EUVD-2026-101932

📊 Score: n/a
📦 Product: FreeBSD, FreeBSD, FreeBSD
🏢 Vendor: FreeBSD
📅 Updated: 2026-10-15

📝 The xHCI (USB 3) device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block (TRB) fields were loaded without protection against concurrent modification...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101932

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101931

📊 Score: n/a
📦 Product: FreeBSD, FreeBSD, FreeBSD
🏢 Vendor: FreeBSD
📅 Updated: 2026-10-15

📝 The HDA audio device model did not check for zero-length Buffer Descriptor List (BDL) entries when starting a stream. A zero-length entry caused an out-of-bounds read or write during DMA transfer processing. BDL fields were also subject to modificatio...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101931

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101930

📊 Score: n/a
📦 Product: FreeBSD, FreeBSD, FreeBSD
🏢 Vendor: FreeBSD
📅 Updated: 2026-10-15

📝 The framebuffer device model's maximum resolution constants were duplicated between the framebuffer and RFB modules and had gotten out of sync. Additionally, writes to the framebuffer BAR could set arbitrary width and height values without validation, ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101930

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101929

📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: Eclipse Vert.x, Eclipse Vert.x, Eclipse Vert.x (+1 more)
🏢 Vendor: Eclipse Foundation
📅 Updated: 2026-10-15

📝 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the WebSocket implementation does not define a maximum number of bytes allocation when decompressin...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101929

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101928

📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: Eclipse Vert.x, Eclipse Vert.x, Eclipse Vert.x
🏢 Vendor: Eclipse Foundation
📅 Updated: 2026-10-15

📝 In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the HTTP proxy provides a body transformer interceptor that relies on a max buffered bytes limit to ensure a bounded buffer for ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101928

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101927

📊 Score: 8.2/10 (CVSS v3.1)
📦 Product: Eclipse Vert.x, Eclipse Vert.x, Eclipse Vert.x (+1 more)
🏢 Vendor: Eclipse Foundation
📅 Updated: 2026-10-15

📝 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x Redis client RESP parser pre-allocates arrays to a length declared by the server without...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101927

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101926

📊 Score: 4.3/10 (CVSS v3.1)
📦 Product: Blog2Social: Social Media Auto Post & Scheduler
🏢 Vendor: pr-gateway
📅 Updated: 2026-10-15

📝 The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_shi...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101926

#cybersecurity #infosec #euvd #cve #vulnerability

CVE-2026-94501 jshERP auth bypass lets any authenticated user rewrite role mappings and escalate privileges. CVSS 8.8, no patch yet. Restrict access and monitor userBusiness endpoints. https://www.valtersit.com/cve/CVE-2026-94501/ #CVE #infosec #cybersecurity

🚨 EUVD-2026-101849

📊 Score: n/a
📦 Product: eaSYNC Booking
🏢 Vendor: Unknown
📅 Updated: 2026-10-15

📝 The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101849

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101850

📊 Score: n/a
📦 Product: Easy HTTPS Redirection (SSL)
🏢 Vendor: Unknown
📅 Updated: 2026-10-15

📝 The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private and draft po...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101850

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101852

📊 Score: n/a
📦 Product: User Rights Access Manager
🏢 Vendor: Unknown
📅 Updated: 2026-10-15

📝 The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and assigns newly registered accounts a role that was created as a copy of the administrator role, allowing unauthen...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101852

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101851

📊 Score: n/a
📦 Product: Spin Wheel
🏢 Vendor: Unknown
📅 Updated: 2026-10-15

📝 The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consuming a configured prize coupon, allowing unauthenticated users to disclose and drain the stored coupon codes of any campaign, in...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101851

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101854

📊 Score: n/a
📦 Product: Tutor LMS
🏢 Vendor: Unknown
📅 Updated: 2026-10-15

📝 The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101854

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101853

📊 Score: n/a
📦 Product: Document Gallery
🏢 Vendor: Unknown
📅 Updated: 2026-10-15

📝 The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101853

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2025-210223

📊 Score: 9.8/10 (CVSS v3.1)
📦 Product: ThemeREX Addons
🏢 Vendor: ThemeREX Group
📅 Published: 2026-06-17 | Updated: 2026-10-15

📝 Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-210223

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101855

📊 Score: n/a
📦 Product: FreeBSD, FreeBSD, FreeBSD (+1 more)
🏢 Vendor: FreeBSD
📅 Updated: 2026-10-15

📝 When semop(2) blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101855

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101818

📊 Score: 9.8/10 (CVSS v3.1)
📦 Product: Wheels
🏢 Vendor: Wheels
📅 Updated: 2026-10-15

📝 Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup pa...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101818

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101819

📊 Score: 7.1/10 (CVSS v3.1)
📦 Product: DragonFlyBSD
🏢 Vendor: DragonFlyBSD
📅 Updated: 2026-10-15

📝 In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. i...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101819

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101820

📊 Score: 9.5/10 (CVSS v3.1)
📦 Product: Znuny, Znuny
🏢 Vendor: Znuny
📅 Updated: 2026-10-15

📝 In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attac...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101820

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101821

📊 Score: 8.6/10 (CVSS v3.1)
📦 Product: Znuny, Znuny
🏢 Vendor: Znuny
📅 Updated: 2026-10-15

📝 Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands,...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101821

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101856

📊 Score: n/a
📦 Product: FreeBSD
🏢 Vendor: FreeBSD
📅 Updated: 2026-10-15

📝 When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes (used internally to track list traversal position) before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock wa...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101856

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101857

📊 Score: n/a
📦 Product: FreeBSD
🏢 Vendor: FreeBSD
📅 Updated: 2026-10-15

📝 kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101857

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101858

📊 Score: 6.3/10 (CVSS v3.1)
📦 Product: HPE NonStop Kernel, HPE NonStop Kernel
🏢 Vendor: Hewlett Packard Enterprise
📅 Updated: 2026-10-15

📝 A security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped data.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101858

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101859

📊 Score: 8.2/10 (CVSS v3.1)
📦 Product: HPE NonStop SOAP 4.0
🏢 Vendor: Hewlett Packard Enterprise
📅 Updated: 2026-10-15

📝 A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption resulting in a system down.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101859

#cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-101860

📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: Cardinity Payment Gateway for WooCommerce
🏢 Vendor: Unknown
📅 Updated: 2026-10-15

📝 The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing ...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101860

#cybersecurity #infosec #euvd #cve #vulnerability