#cyber-security — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #cyber-security, aggregated by home.social.
-
🚨 A newly identified APT dubbed #ArmoredLikho is targeting government agencies and energy organizations with #BusySnake Stealer, a Python-based infostealer delivered through AI-generated loaders and spear-phishing campaigns.
The malware steals credentials, Telegram sessions, cryptocurrency wallets, and more, while built-in reverse SSH tunneling gives attackers long-term remote access.
Listen/Read: https://hackread.com/armored-likho-government-energy-busysnake-stealer/
#CyberSecurity #InfoSec #APT #Malware #Phishing #CyberEspionage
-
🚨 A newly identified APT dubbed #ArmoredLikho is targeting government agencies and energy organizations with #BusySnake Stealer, a Python-based infostealer delivered through AI-generated loaders and spear-phishing campaigns.
The malware steals credentials, Telegram sessions, cryptocurrency wallets, and more, while built-in reverse SSH tunneling gives attackers long-term remote access.
Listen/Read: https://hackread.com/armored-likho-government-energy-busysnake-stealer/
#CyberSecurity #InfoSec #APT #Malware #Phishing #CyberEspionage
-
🖲️ #Cybersecurity #Ciberseguridad #Ciberseguranca #Security #Seguridad #Seguranca #News #Noticia #Noticias #Tecnologia #Technology
⚫ State IDs for AI Agents: Will Estonia Set a Precedent?
🔗 https://www.darkreading.com/cybersecurity-operations/state-ids-ai-agents-estoniaThe world's digital testing ground plans to help people use AI agents for government purposes.
-
🖲️ #Cybersecurity #Ciberseguridad #Ciberseguranca #Security #Seguridad #Seguranca #News #Noticia #Noticias #Tecnologia #Technology
⚫ State IDs for AI Agents: Will Estonia Set a Precedent?
🔗 https://www.darkreading.com/cybersecurity-operations/state-ids-ai-agents-estoniaThe world's digital testing ground plans to help people use AI agents for government purposes.
-
Accenture Confirms Security Breach After Hacker Claims 35 GB of Data Was Stolen
Accenture confirmed a data breach in July 2026 after a threat actor named "888" claimed to have stolen 35 GB of internal source code and other technical data from the company. The company stated the incident was isolated and remediated, with no impact on its global operations or service delivery.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/accenture-confirms-security-breach-after-hacker-claims-35-gb-of-data-was-stolen-r-t-b-2-4/gD2P6Ple2L -
Accenture Confirms Security Breach After Hacker Claims 35 GB of Data Was Stolen
Accenture confirmed a data breach in July 2026 after a threat actor named "888" claimed to have stolen 35 GB of internal source code and other technical data from the company. The company stated the incident was isolated and remediated, with no impact on its global operations or service delivery.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/accenture-confirms-security-breach-after-hacker-claims-35-gb-of-data-was-stolen-r-t-b-2-4/gD2P6Ple2L -
🚨 EUVD-2026-42234
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: check-peer-dependencies, check-peer-dependencies, check-peer-dependencies (+2 more)
🏢 Vendor: christopherthielen
📅 Updated: 2026-07-08📝 A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils....
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42234
-
🚨 EUVD-2026-42236
📊 Score: 7.1/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42236
-
🚨 EUVD-2026-42234
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: check-peer-dependencies, check-peer-dependencies, check-peer-dependencies (+2 more)
🏢 Vendor: christopherthielen
📅 Updated: 2026-07-08📝 A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils....
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42234
-
🚨 EUVD-2026-42236
📊 Score: 7.1/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42236
-
🚨 EUVD-2026-42235
📊 Score: 9.1/10 (CVSS v3.1)
📦 Product: dgraph
🏢 Vendor: dgraph-io
📅 Updated: 2026-07-08📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42235
-
🚨 EUVD-2026-42235
📊 Score: 9.1/10 (CVSS v3.1)
📦 Product: dgraph
🏢 Vendor: dgraph-io
📅 Updated: 2026-07-08📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alpha exposes the RPCs used for external snapshot import on the public gRPC port `:9080` without authentication or authorization. As a result, an unauthenticated network ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42235
-
🚨 EUVD-2026-42238
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: Flask-MonitoringDashboard, Flask-MonitoringDashboard, Flask-MonitoringDashboard
🏢 Vendor: flask-dashboard
📅 Updated: 2026-07-08📝 A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-si...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42238
-
🚨 EUVD-2026-42237
📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: dgraph
🏢 Vendor: dgraph-io
📅 Updated: 2026-07-08📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `check...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42237
-
🚨 EUVD-2026-42237
📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: dgraph
🏢 Vendor: dgraph-io
📅 Updated: 2026-07-08📝 Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `check...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42237
-
🚨 EUVD-2026-42238
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: Flask-MonitoringDashboard, Flask-MonitoringDashboard, Flask-MonitoringDashboard
🏢 Vendor: flask-dashboard
📅 Updated: 2026-07-08📝 A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-si...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42238
-
🚨 EUVD-2026-42239
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: MISP
🏢 Vendor: MISP
📅 Updated: 2026-07-08📝 An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the misp_standard forma...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42239
-
🚨 EUVD-2026-42239
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: MISP
🏢 Vendor: MISP
📅 Updated: 2026-07-08📝 An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the misp_standard forma...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42239
-
🚨 EUVD-2026-42240
📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42240
-
🚨 EUVD-2026-42241
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: MISP
🏢 Vendor: MISP
📅 Updated: 2026-07-08📝 MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules(). As a result, an authenticated user from an organisation that was n...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42241
-
🚨 EUVD-2026-42240
📊 Score: 8.8/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42240
-
🚨 EUVD-2026-42241
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: MISP
🏢 Vendor: MISP
📅 Updated: 2026-07-08📝 MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules(). As a result, an authenticated user from an organisation that was n...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42241
-
🚨 EUVD-2026-42242
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Omnissa Workspace ONE® Tunnel for Windows
🏢 Vendor: Omnissa
📅 Updated: 2026-07-08📝 Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42242
-
🚨 EUVD-2026-42242
📊 Score: 7.8/10 (CVSS v3.1)
📦 Product: Omnissa Workspace ONE® Tunnel for Windows
🏢 Vendor: Omnissa
📅 Updated: 2026-07-08📝 Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42242
-
🚨 EUVD-2026-42243
📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42243
-
🚨 EUVD-2026-42243
📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42243
-
🚨 EUVD-2026-42233
📊 Score: 9.2/10 (CVSS v3.1)
📦 Product: Blocksy Companion, Blocksy Companion
🏢 Vendor: Creative Themes
📅 Updated: 2026-07-08📝 Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attac...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42233
-
🚨 EUVD-2026-42244
📊 Score: 2.7/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42244
-
🚨 EUVD-2026-42244
📊 Score: 2.7/10 (CVSS v3.1)
📦 Product: PowerProtect Data Domain, PowerProtect Data Domain, PowerProtect Data Domain (+1 more)
🏢 Vendor: Dell
📅 Updated: 2026-07-08📝 Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versi...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42244
-
🚨 EUVD-2026-42233
📊 Score: 9.2/10 (CVSS v3.1)
📦 Product: Blocksy Companion, Blocksy Companion
🏢 Vendor: Creative Themes
📅 Updated: 2026-07-08📝 Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attac...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42233
-
🚨 EUVD-2026-42245
📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: Tanium Server, Tanium Server, Tanium Server
🏢 Vendor: Tanium
📅 Updated: 2026-07-08📝 Tanium addressed a denial of service vulnerability in Tanium Server.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42245
-
🚨 EUVD-2026-42245
📊 Score: 7.5/10 (CVSS v3.1)
📦 Product: Tanium Server, Tanium Server, Tanium Server
🏢 Vendor: Tanium
📅 Updated: 2026-07-08📝 Tanium addressed a denial of service vulnerability in Tanium Server.
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42245
-
🚨 EUVD-2026-42246
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the app_versions tab...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42246
-
🚨 EUVD-2026-42246
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions update enforcement that allows app-scoped API keys to downgrade encrypted bundles to non-encrypted state. Attackers with app-scoped all API keys can directly update the app_versions tab...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42246
-
🚨 EUVD-2026-42247
📊 Score: 7.1/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_p...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42247
-
🚨 EUVD-2026-42247
📊 Score: 7.1/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_p...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42247
-
🚨 EUVD-2026-42248
📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Cap-go
📅 Updated: 2026-07-08📝 Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID w...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42248
-
🚨 EUVD-2026-42249
📊 Score: 7.2/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in tw...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42249
-
🚨 EUVD-2026-42248
📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Cap-go
📅 Updated: 2026-07-08📝 Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID w...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42248
-
🚨 EUVD-2026-42249
📊 Score: 7.2/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in tw...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42249
-
🚨 EUVD-2026-42250
📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controll...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42250
-
🚨 EUVD-2026-42250
📊 Score: 8.7/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controll...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42250
-
🚨 EUVD-2026-42251
📊 Score: 4.9/10 (CVSS v3.1)
📦 Product: Flowise
🏢 Vendor: Flowise
📅 Updated: 2026-07-08📝 Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42251
-
🚨 EUVD-2026-42251
📊 Score: 4.9/10 (CVSS v3.1)
📦 Product: Flowise
🏢 Vendor: Flowise
📅 Updated: 2026-07-08📝 Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary ...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42251
-
🚨 EUVD-2026-42252
📊 Score: 4.8/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. Attackers can craft payloads in the organization name field to redirect users to untrusted websites, enab...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42252
-
🚨 EUVD-2026-42253
📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Cap-go
📅 Updated: 2026-07-08📝 Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated atta...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42253
-
🚨 EUVD-2026-42253
📊 Score: 6.9/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Cap-go
📅 Updated: 2026-07-08📝 Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST RPC function public.get_total_metrics(org_id), which is callable by the anon role using only the public sb_publishable_* key. An unauthenticated atta...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42253
-
🚨 EUVD-2026-42252
📊 Score: 4.8/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint that allows attackers to inject malicious HTML content. Attackers can craft payloads in the organization name field to redirect users to untrusted websites, enab...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42252
-
🚨 EUVD-2026-42254
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history rec...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42254
-
🚨 EUVD-2026-42254
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_history.owner_org when transferring applications between organizations. Attackers can exploit this omission to retain unauthorized access to deployment history rec...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42254
-
🚨 EUVD-2026-42255
📊 Score: 8.3/10 (CVSS v3.1)
📦 Product: FreeRDP
🏢 Vendor: FreeRDP
📅 Updated: 2026-07-08📝 FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_C...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42255
-
🚨 EUVD-2026-42255
📊 Score: 8.3/10 (CVSS v3.1)
📦 Product: FreeRDP
🏢 Vendor: FreeRDP
📅 Updated: 2026-07-08📝 FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_C...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42255
-
🚨 EUVD-2026-42256
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location information and other embedded meta...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42256
-
🚨 EUVD-2026-42256
📊 Score: 5.3/10 (CVSS v3.1)
📦 Product: capgo
🏢 Vendor: Capgo
📅 Updated: 2026-07-08📝 Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endpoint, exposing sensitive geolocation data. Attackers can upload images containing EXIF metadata to extract geographic location information and other embedded meta...
🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42256