Welcome to the ThreatPerspective Security Information Center Vulnerability Info https://nvd.nist.gov Nist NVD https://cvedetails.com CVE Details https://cve.mitre.org Mitre https://www.cisa.gov/uscert/ US CERT https://www.cert.org OG CERT https://public.cyber.mil DISA https://www.nsa.gov/Press-Room/Cybersecurity-Advisories-Guidance/ NSA Exploit Info https://www.exploit-db.com Exploit DB https://www.packetstormsecurity.org Packet Storm Active Groups https://www.thc.org THC Commercial Groups https://www.rapid7.com Rapid7 https://www.secunia.com Secunia https://www.securiteam.com Securiteam https://www.trustwave.com/Company/SpiderLabs/ SpiderLabs https://www.idefense.com Idefense https://www.coresecurity.com Core Defunct Groups ? https://www.shmoo.com The Shmoo Group https://www.cultdeadcow.com CDC https://www.attrition.org Attrition https://www.w00w00.org w00w00 https://packetstormsecurity.com/groups/ADM ADM https://packetstormsecurity.com/groups/teso TESO Security Organizations https://www.owasp.org OWASP https://www.isc2.org ISC2 https://www.isecom.org ISECOM https://www.sans.org SANS https://www.infragard.org Infragard Methodologies https://www.isecom.org/ ISECOM https://www.osstmm.org OSSTMM Free Tools https://www.openvas.org/ OpenVAS https://www.portswigger.net/proxy/ Burp Proxy https://www.insecure.org Nmap https://www.metasploit.org Metasploit https://www.nessus.org Nessus https://github.com/SecureAuthCorp/impacket Impacket https://github.com/OWASP/Amass Amass https://github.com/EmpireProject/Empire Empire https://w3af.org w3af https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project ZAP https://sqlmap.org SQLMap https://www.cirt.net Nikto https://docs.microsoft.com/en-us/sysinternals/ Sysinternals https://www.coresecurity.com/grid/index-open-source-tools Core Tools https://github.com/SpiderLabs SpiderLabs Tools https://thc.org/ THC Tools https://beefproject.com/ BeEF https://wpscan.org WP Scan https://https://www.ettercap-project.org/ Ettercap https://sqlninja.sourceforge.net SQL Ninja https://www.wireshark.org/ Wireshark https://sectools.org/ Sectools.org Virtualization Tools https://www.vmware.com/ VMWare Server https://www.virtualbox.org/wiki/Downloads Virtual Box https://www.proxmox.com/ Proxmox https://bochs.sourceforge.net/ Bochs https://pearpc.sourceforge.net/ PearPC https://www.microsoft.com/en-us/download/details.aspx?id=3702 MS Virtual PC https://docs.microsoft.com/en-us/windows/wsl/install-win10 Microsoft WSL Reverse Engineering https://www.gnu.org/software/binutils/ binutils https://www.gnu.org/software/gdb/ GDB https://www.gnu.org/software/ddd/ DDD https://www.ollydbg.de/ Ollydbg https://tools.kali.org/reverse-engineering/edb-debugger EDB-Debugger https://www.coresecurity.com/grid/index-open-source-tools CORE https://tools.kali.org/reverse-engineering/jad Jad https://tools.kali.org/reverse-engineering/javasnoop Javasnoop https://tools.kali.org/forensics/binwalk Binwalk Defaced Websites https://www.zone-h.org/component/option,com_attacks/Itemid,43/ Zone H Technical Conferences https://www.defcon.org DefCon https://www.owasp.org/index.php/Category:OWASP_AppSec_Conference AppSec https://www.blackhat.com Blackhat https://www.cansecwest.com CanSecWest https://toorcon.com Toorcon https://www.shmoocon.org/ ShmooCon https://hope.net/ H.O.P.E. https://www.ccc.de/ CCC https://conference.hackinthebox.org/ HiTB https://www.derbycon.com DerbyCon https://www.securitybsides.com Security BSides https://www.rsaconference.com RSA https://infosecsouthwest.com ISSW Groups and Meetups https://www.owasp.org/index.php/OWASP_Chapter OWASP https://www.2600.com/meetings/mtg.html 2600 Distros https://www.kali.org Kali https://www.knopper.net/knoppix/index-en.html Knoppix Wireless Tools https://www.kismetwireless.net Kismet https://www.aircrack-ng.org/ Aircrack-ng https://csrc.nist.gov/publications/nistpubs/800-48/NIST_SP-48.pdf Wireless SP https://theta44.org/karma/index.html Karma https://tools.kali.org/wireless-attacks/reaver Reaver Checklists https://csrc.nist.gov NIST CSRC https://nvd.nist.gov/cvss.cfm?version=2 CVSS https://checklists.nist.gov NIST Checklists https://www.cisecurity.org CIS https://www.iad.gov/iad/library/ia-guidance/index.cfm IAD https://docs.oracle.com/database/121/DBSEG/title.htm Oracle https://www.petefinnigan.com/orasec.htm PF's Checklists https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-baselines Microsoft OS Hardening https://bastille-linux.sourceforge.net Bastille Linux https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines Microsoft Professional Security Programs https://www.pcisecuritystandards.org/ PCI https://www.isc2.org ISC2 https://www.eccouncil.org/ EC Council https://www.sans.org/ SANS Password Crackers https://www.openwall.com/john/ John the Ripper https://hashcat.net/hashcat/ Hashcat https://en.wikipedia.org/wiki/RainbowCrack RainbowCrack https://rainbowtables.shmoo.com/ Rainbow Tables https://www.l0phtcrack.com L0phtcrack https://en.wikipedia.org/wiki/Cain_and_Abel_(software) Cain and Abel Default Passwords https://cirt.net/passwords Cirt https://www.petefinnigan.com/default/default_password_list.htm Oracle https://defaultpassword.com/ def pass https://www.uktsupport.co.uk/reference/biosp.htm Bios Passwords OSI https://www.shodanhq.com SHODAN https://www.archive.org/ Way Back Machine https://www.domaintools.com DomainTools Compliance Resources https://www.hhs.gov/hipaa/ HIPAA https://www.congress.gov/bill/107th-congress/house-bill/3763 SOX https://www.congress.gov/bill/106th-congress/senate-bill/900 FMA (GLBA) https://csrc.nist.gov/ FISMA https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf NIST 800-53 https://www.iso.org/standard/75652.html ISO 27002:2022 https://www.fedramp.gov FedRAMP https://www.sans.org/resources/policies/ SANS Policies Email Lists https://seclists.org/fulldisclosure/ Full Disclosure https://seclists.org/dailydave/ Daily Dave https://seclists.org Security Lists Defense / IDS https://www.snort.org Snort Helpful Sites https://pentestmonkey.net Pentest Monkey https://www.offensive-security.com Offensive Security Institutional Stuff https://www.phrack.org Phrack https://www.2600.com 2600 Welcome to the Security Information Center This is a portal site created by ThreatPerspective to enable our clients and other interested parties to learn more about Information Security. The boxes on the left correlate to free information and tools that realate to Information Security. The boxes on the right are various Information Security related news feeds. CISA Cybersecurity Advisories https://www.cisa.gov/ A Tale of Two SOCs: Insights From Two Red Team Assessments https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a <h2><strong>Advisory at a Glance</strong></h2> Defending Against an Active Threat to Siemens S7 Series PLCs https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a <h2><strong>Executive summary</strong></h2> #StopRansomware: Gunra Ransomware https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-222a <h2><strong>Advisory at a Glance</strong></h2> Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a <div class="c-page-title__buttons"><a class="c-button" href="https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF">Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite</a></div> Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a <p>Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors</p> Defending Against China-Nexus Covert Networks of Compromised Devices https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-113a <div class="SCXW131754345 BCX8"> Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a <h2><strong>Advisory at a Glance</strong></h2> Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-343a <h2><strong>Summary</strong></h2> CISA Shares Lessons Learned from an Incident Response Engagement https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-266a <h2><strong>Advisory at a Glance</strong></h2> Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a <h2><strong>Executive summary</strong></h2> CISA Analysis Reports https://www.cisa.gov/ FIRESTARTER Backdoor https://www.cisa.gov/news-events/analysis-reports/ar26-113a <h2><strong>Malware Analysis Report at a Glance</strong></h2> BRICKSTORM Backdoor https://www.cisa.gov/news-events/analysis-reports/ar25-338a <h2><strong>Malware Analysis at a Glance</strong></h2> Malicious Listener for Ivanti Endpoint Mobile Management Systems https://www.cisa.gov/news-events/analysis-reports/ar25-261a <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> MAR-251132.c1.v1 Exploitation of SharePoint Vulnerabilities https://www.cisa.gov/news-events/analysis-reports/ar25-218a <h3>Notification</h3> MAR-25993211-r1.v2 Ivanti Connect Secure (RESURGE) https://www.cisa.gov/news-events/analysis-reports/ar25-087a <h3>Notification</h3> MAR-10448362-1.v1 Volt Typhoon https://www.cisa.gov/news-events/analysis-reports/ar24-038a <h3>Notification</h3> MAR-10478915-1.v1 Citrix Bleed https://www.cisa.gov/news-events/analysis-reports/ar23-325a <p>&nbsp;&nbsp;</p> MAR-10454006.r5.v1 SUBMARINE, SKIPJACK, SEASPRAY, WHIRLPOOL, and SALTWATER Backdoors https://www.cisa.gov/news-events/analysis-reports/ar23-250a-0 <p>&nbsp;&nbsp;</p> MAR-10430311-1.v1 Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475 https://www.cisa.gov/news-events/analysis-reports/ar23-250a <p>&nbsp;&nbsp;</p> Infamous Chisel Malware Analysis Report https://www.cisa.gov/news-events/analysis-reports/ar23-243a <h4>Infamous Chisel–A collection of components associated with Sandworm designed to enable remote access and exfiltrate information from Android phones.</h4> Bulletins https://www.cisa.gov/ Vulnerability Summary for the Week of August 17, 2026 https://www.cisa.gov/news-events/bulletins/sb26-236 <div id="high_v"> Vulnerability Summary for the Week of August 10, 2026 https://www.cisa.gov/news-events/bulletins/sb26-229 <div id="high_v"> Vulnerability Summary for the Week of August 3, 2026 https://www.cisa.gov/news-events/bulletins/sb26-222 <div id="high_v"> Vulnerability Summary for the Week of July 27, 2026 https://www.cisa.gov/news-events/bulletins/sb26-215 <div id="high_v"> Vulnerability Summary for the Week of July 20, 2026 https://www.cisa.gov/news-events/bulletins/sb26-208 <div id="high_v"> Vulnerability Summary for the Week of July 13, 2026 https://www.cisa.gov/news-events/bulletins/sb26-201 <div id="high_v"> Vulnerability Summary for the Week of July 6, 2026 https://www.cisa.gov/news-events/bulletins/sb26-194 <div id="high_v"> Vulnerability Summary for the Week of June 29, 2026 https://www.cisa.gov/news-events/bulletins/sb26-187 <div id="high_v"> Vulnerability Summary for the Week of June 22, 2026 https://www.cisa.gov/news-events/bulletins/sb26-180 <div id="high_v"> Vulnerability Summary for the Week of June 15, 2026 https://www.cisa.gov/news-events/bulletins/sb26-173 <div id="high_v"> CERT Advisories https://seclists.org/#cert The <a href="http://www.cert.org/">Computer Emergency Response Team</a> has been responding to security incidents and sharing vulnerability information since the Morris Worm hit in 1986. This archive combines their technical security alerts, tips, and current activity lists. Apple Releases Security Updates for Multiple Products https://seclists.org/cert/2023/3 <p>Posted by CISA on Mar 28</p>Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow<br> Apple...<br> CISA Releases Six Industrial Control Systems Advisories https://seclists.org/cert/2023/2 <p>Posted by CISA on Mar 23</p>Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow<br> 08:00 AM EDT...<br> CISA Releases Eight Industrial Control Systems Advisories https://seclists.org/cert/2023/1 <p>Posted by CISA on Mar 21</p>Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow<br> 03/21/2023 08:00 AM...<br> CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management https://seclists.org/cert/2023/0 <p>Posted by CISA on Mar 21</p>Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow<br> CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management [...<br> Alerts https://www.cisa.gov/ CISA Adds Three Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/08/27/cisa-adds-three-known-exploited-vulnerabilities-catalog <p>CISA has added three new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds Six Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog <p>CISA has added six new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/08/25/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/08/24/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://edit.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/08/21/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds Two Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog <p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds Four Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog <p>CISA has added four new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds One Known Exploited Vulnerability to Catalog  https://www.cisa.gov/news-events/alerts/2026/08/17/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds Three Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog <p>CISA has added three new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/08/07/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/08/05/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds Three Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/08/04/cisa-adds-three-known-exploited-vulnerabilities-catalog <p>CISA has added three new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/08/03/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs <p>CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible. Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations.&nbsp;</p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/07/29/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds Two Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/07/27/cisa-adds-two-known-exploited-vulnerabilities-catalog <p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds Two Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog <p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> CISA Adds Four Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/07/21/cisa-adds-four-known-exploited-vulnerabilities-catalog <p>CISA has added four new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds Three Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/07/16/cisa-adds-three-known-exploited-vulnerabilities-catalog <p>CISA has added three new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds Two Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog <p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds Four Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-adds-four-known-exploited-vulnerabilities-catalog <p>CISA has added four new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Urges SharePoint Hardening After New Exploitations https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations <p><strong>Update August 26, 2026:</strong></p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/07/13/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://edit.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds Two Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/07/10/cisa-adds-two-known-exploited-vulnerabilities-catalog <p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds Three Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-three-known-exploited-vulnerabilities-catalog <p>CISA has added three new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/07/07/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/07/01/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2026/06/29/cisa-adds-one-known-exploited-vulnerability-catalog <p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> CISA Adds Two Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog <p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation. &nbsp;</p> Daily Dave https://seclists.org/#dailydave This technical discussion list covers vulnerability research, exploit development, and security events/gossip. It was started by <a href="http://www.immunitysec.com/">ImmunitySec</a> founder Dave Aitel and many security luminaries participate. Many posts simply advertise Immunity products, but you can't really fault Dave for being self-promotional on a list named DailyDave. OpenAI Codex Security https://seclists.org/dailydave/2026/q1/2 <p>Posted by Dave Aitel via Dailydave on Mar 07</p><a rel="nofollow" href="https://openai.com/index/codex-security-now-in-research-preview/">https://openai.com/index/codex-security-now-in-research-preview/</a><br> 1. Say what...<br> RE//verse, DistrictCon, an Anole Friend https://seclists.org/dailydave/2026/q1/1 <p>Posted by Dave Aitel via Dailydave on Feb 02</p>Last month was DistrictCon, a great conference that I did not attend<br> Today it is...<br> feeling the air https://seclists.org/dailydave/2026/q1/0 <p>Posted by Dave Aitel via Dailydave on Jan 05</p>For reasons I still don’t fully understand, Miami Beach has enormous<br> them somewhere overhead, wings spread wide, fingers splayed, feeling the...<br> Re: Defense ? https://seclists.org/dailydave/2025/q4/6 <p>Posted by Dean Pierce via Dailydave on Nov 16</p>I like the idea of having a software supply chain that people can pay into<br> with is a software ecosystem where anyone can build what they need...<br> Re: Defense ? https://seclists.org/dailydave/2025/q4/5 <p>Posted by Chris Anley via Dailydave on Nov 16</p>(gingerly raises head above parapet)<br> of 1 per 15 minutes (calendar year 2024), means that patching an enterprise before an...<br> Re: Defense ? https://seclists.org/dailydave/2025/q4/4 <p>Posted by Alfonso De Gregorio via Dailydave on Nov 16</p>Imbalances in the skills and workforce are real. The gap remains hard<br> regardless: those imbalances are a byproduct of the...<br> Re: Defense ? https://seclists.org/dailydave/2025/q4/3 <p>Posted by Conan Dooley via Dailydave on Nov 16</p>Reduce complexity, duplication, and scope in your infrastructure. Your<br> say, just...<br> Re: Defense ? https://seclists.org/dailydave/2025/q4/2 <p>Posted by etojake--- via Dailydave on Nov 16</p>The content of this message was lost. It was probably cross-posted to<br> multiple lists and previously handled on another list.<br> Defense ? https://seclists.org/dailydave/2025/q4/1 <p>Posted by Dave Aitel via Dailydave on Nov 15</p>How would one actually move the actual bar in defense? A big part of me<br> Like...<br> Offensive AI Con https://seclists.org/dailydave/2025/q4/0 <p>Posted by Dave Aitel via Dailydave on Oct 08</p>So I just got back from &quot;Offensive AI Conference&quot; in San Diego and it was a<br> FOMO, but also, when a conference is &quot;invite only&quot; then you...<br> BreachExchange https://seclists.org/#dataloss BreachExchange focuses on all things data breach. Topics include actual data breaches, cyber insurance, risk management, metrics and more. This archive includes its predecessor, the Data Loss news and discussion lists. Educause Security Discussion https://seclists.org/#educause Securing networks and computers in an academic environment. Full Disclosure https://seclists.org/#fulldisclosure A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue. FD - Half-click unauthenticated remote code execution on Horde Groupware IMP (from a stored XSS) https://seclists.org/fulldisclosure/2026/Aug/115 <p>Posted by Evan Tang on Aug 26</p><a rel="nofollow" href="https://blog.evan.lat/posts/CVE-2026-65053/">https://blog.evan.lat/posts/CVE-2026-65053/</a><br> $data_name =...<br> [NotCVE-2026-0013] CHIRP Kenwood ITM Driver Eval Injection Allows Arbitrary Code Execution via Crafted Radio File https://seclists.org/fulldisclosure/2026/Aug/114 <p>Posted by advisories on Aug 26</p>----------------------------------------------------------------------------<br> Python code with the...<br> [NotCVE-2026-0012] EmpManageX Hardcoded Administrative Credentials in Login API Allow Full Access to Employee Records https://seclists.org/fulldisclosure/2026/Aug/113 <p>Posted by advisories on Aug 26</p>----------------------------------------------------------------------------<br> constants in app.py,...<br> [NotCVE-2026-0011] Nmap 7.99 and Earlier nselib/packet.lua Zero-Length TCP Option Infinite Loop Allows Remote Denial of Service https://seclists.org/fulldisclosure/2026/Aug/112 <p>Posted by advisories on Aug 26</p>----------------------------------------------------------------------------<br> and terminate it by...<br> [NotCVE-2026-0010] Barrier 2.4.0 for Windows Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM https://seclists.org/fulldisclosure/2026/Aug/111 <p>Posted by advisories on Aug 26</p>----------------------------------------------------------------------------<br> command line together...<br> [NotCVE-2026-0009] NitroShare Desktop 0.3.4 Path Traversal Allows LAN-Adjacent Arbitrary File Write https://seclists.org/fulldisclosure/2026/Aug/110 <p>Posted by advisories on Aug 26</p>----------------------------------------------------------------------------<br> authentication in...<br> Escargot v4.3.0-214-gfaee4437 Unauthenticated Remote Debugger Allows Arbitrary JavaScript Evaluation and Local File Disclosure https://seclists.org/fulldisclosure/2026/Aug/109 <p>Posted by Ron E on Aug 26</p>An unauthenticated remote debugger vulnerability exists in Escargot<br> debugger session and...<br> Escargot v4.3.0-214-gfaee4437 OS Command Injection in Crash Handler via Unsanitized Executable Path https://seclists.org/fulldisclosure/2026/Aug/108 <p>Posted by Ron E on Aug 26</p>An OS command injection vulnerability exists in the Escargot<br> metacharacters and...<br> Escargot v4.3.0-214-gfaee4437 Debugger WebSocket Off-by-One Stack Buffer Overflow https://seclists.org/fulldisclosure/2026/Aug/107 <p>Posted by Ron E on Aug 26</p>Escargot contains a remotely triggerable one-byte stack-based out-of-bounds<br> remains for the...<br> UltraJSON v5.13.0-6-g733f9e1 Length-Boundary Violation Causes Out-of-Bounds Read During Incomplete JSON Parsing https://seclists.org/fulldisclosure/2026/Aug/106 <p>Posted by Ron E on Aug 26</p>UltraJSON contains an out-of-bounds read in its native C JSON decoder when<br> The decoder establishes cbBuffer as the logical boundary of...<br> Realtek edimax 52fc10d19 In-Band Ioctl Response Length Confusion Causes Heap Buffer Overflow https://seclists.org/fulldisclosure/2026/Aug/105 <p>Posted by Ron E on Aug 26</p>The Realtek in-band ioctl bridge contains a heap-buffer overflow when<br> For SIOCGIWSCAN, the destination is a caller-provided...<br> WatsonWebserver v7.1.0 HTTP/1 Chunked Request Processing Bypasses MaxRequestBodySize https://seclists.org/fulldisclosure/2026/Aug/104 <p>Posted by Ron E on Aug 26</p>WatsonWebserver contains an HTTP/1 request body size-limit bypass when<br> without enforcing the same...<br> Chronicle Wire v2026.8 Arbitrary Class Instantiation During YAML Deserialization via Externally Controlled YAML Type Tags https://seclists.org/fulldisclosure/2026/Aug/103 <p>Posted by Ron E on Aug 26</p>Chronicle Wire permits YAML type tags supplied within serialized input to<br> When the default...<br> Chronicle Wire v2026.8 Insecure Reflection Allows Unvalidated Method Invocation https://seclists.org/fulldisclosure/2026/Aug/102 <p>Posted by Ron E on Aug 26</p>Chronicle Wire&apos;s MethodReader implements message dispatch by dynamically<br> are then...<br> Chronicle Wire v2026.8 FileMarshallableOut Append Operations Follow Symbolic Links and Allow File Write Redirection https://seclists.org/fulldisclosure/2026/Aug/83 <p>Posted by Ron E on Aug 26</p>Chronicle Wire&apos;s FileMarshallableOut follows symbolic links when writing<br> resolves the link and Chronicle Wire...<br> Funsec https://seclists.org/#funsec While most security lists ban off-topic discussion, Funsec is a haven for free community discussion and enjoyment of the lighter, more humorous side of the security community Info Security News https://seclists.org/#isn Carries news items (generally from mainstream sources) that relate to security. Metasploit https://seclists.org/#metasploit Development discussion for <a href="http://metasploit.com/">Metasploit</a>, the premier open source remote exploitation tool Microsoft Sec Notification https://seclists.org/#microsoft Beware that MS often uses these security bulletins as marketing propaganda to downplay serious vulnerabilities in their products&mdash;note how most have a prominent and often-misleading "mitigating factors" section. Nmap Development https://seclists.org/#nmap-dev Unmoderated technical development forum for debating ideas, patches, and suggestions regarding proposed changes to <a href="https://nmap.org">Nmap</A> and related projects. <a href="https://nmap.org/mailman/listinfo/dev">Subscribe to nmap-dev here</a>. Re:New OS fingerprint: China Unicom ONT/ONU (Realtek/Boa) https://seclists.org/nmap-dev/2026/q3/5 <p>Posted by gbfdhenr (Liang Xiangan) on Aug 01</p>Hi Nmap developers,<br> 1. **HTTP (port...<br> Re:Correction: Huawei router misidentified as Netgear switch (fingerprint included) https://seclists.org/nmap-dev/2026/q3/4 <p>Posted by gbfdhenr (Liang Xiangan) on Aug 01</p>Hi developers,<br> Subject: CN=Master.ws7100-10, O=Huawei Technologies...<br> Re:Correction: Huawei router misidentified as Netgear switch (fingerprint included) https://seclists.org/nmap-dev/2026/q3/3 <p>Posted by gbfdhenr (Liang Xiangan) on Aug 01</p>Hi Nmap developers,<br> **2. Port...<br> Re:Correction: Huawei router misidentified as Netgear switch (fingerprint included) https://seclists.org/nmap-dev/2026/q3/2 <p>Posted by gbfdhenr (Liang Xiangan) on Aug 01</p>PATCH] New NSE script: huawei-ax3-info.nse<br> -...<br> Re:Correction: Huawei router misidentified as Netgear switch (fingerprint included) https://seclists.org/nmap-dev/2026/q3/1 <p>Posted by gbfdhenr (Liang Xiangan) on Jul 31</p>Supplemental device metadata for my previous submission (Message-ID: &lt;335797c9.5fe8.19fb73084b0.Coremail.gbfdhenr () <br> Note: Both WAN and LAN MACs share the same OUI. Please use this to reclassify the...<br> Correction: Huawei router misidentified as Netgear switch (fingerprint included) https://seclists.org/nmap-dev/2026/q3/0 <p>Posted by gbfdhenr (Liang Xiangan) on Jul 31</p>Hi Nmap team,<br> Nmap 7.99 reports it as: &quot;Netgear GS108Tv3, GS110Tv3, or GS308T switch (Linux 3.18.24)&quot;...<br> Re: NSE submission: detect & enumerate AI infrastructure (MCP servers + LLM inference APIs) https://seclists.org/nmap-dev/2026/q2/8 <p>Posted by Arturo 'Buanzo' Busleiman on Jun 30</p>Hi, nice work! This may also be useful, I mentioned it to Fyodor privately<br> Cheers!<br> NSE submission: detect & enumerate AI infrastructure (MCP servers + LLM inference APIs) https://seclists.org/nmap-dev/2026/q2/7 <p>Posted by Ben Williams via dev on Jun 20</p>Hi,<br> enumeration with schema-based risk...<br> [PATCH] nselib/bitcoin: add address classification helpers (refs #2857, PR #3371) https://seclists.org/nmap-dev/2026/q2/6 <p>Posted by Melo via dev on May 25</p>PR #3371 adds three functions to nselib/bitcoin.lua:<br> Issue:...<br> [NSE] matter-identify: identify Matter smart-home devices via mDNS https://seclists.org/nmap-dev/2026/q2/5 <p>Posted by Balázs Zoltán on May 11</p> Hi,<br> TXT records are decoded into VID,...<br> Re: https://seclists.org/nmap-dev/2026/q2/4 <p>Posted by Rahmat Ramadhan on May 01</p>gaa<br> juanjoserodriguezmontoya35 () gmail com&gt; menulis:<br> [PATCH 0/5] ALPN-based HTTP/2 service detection improvements https://seclists.org/nmap-dev/2026/q2/3 <p>Posted by Urval Kheni on Apr 14</p>Hi,<br> 1. Fix OpenSSL provider...<br> Bug Report: ssl-enum-ciphers fails (EOF) on CloudFront/ECDSA targets supporting TLS 1.2 https://seclists.org/nmap-dev/2026/q2/2 <p>Posted by Jack Seredyniecki via dev on Apr 14</p>Hello nmap dev team,<br> NSE: [ssl-enum-ciphers...<br> [PATCH] Support Linux capabilities for non-root raw packet scanning https://seclists.org/nmap-dev/2026/q2/1 <p>Posted by Ali Norouzi via dev on Apr 14</p>Hi everyone,<br> Ali<br> Fix for issue #3326 https://seclists.org/nmap-dev/2026/q2/0 <p>Posted by advait deshmukh on Apr 14</p>Issue link &lt;<a rel="nofollow" href="https://github.com/nmap/nmap/issues/3326">https://github.com/nmap/nmap/issues/3326</a>&gt;<br> Since the user has explicitly specified -6 in the command, it...<br> Nmap Announce https://seclists.org/#nmap-announce Moderated list for the most important new releases and announcements regarding the <a href="https://nmap.org">Nmap Security Scanner</a> and related projects. We recommend that all Nmap users <a href="https://nmap.org/mailman/listinfo/announce">subscribe to stay informed</a>. Npcap Version 1.82 Released with VLAN Tagging and More https://seclists.org/nmap-announce/2025/0 <p>Posted by Gordon Fyodor Lyon on Apr 28</p>Dear Nmap Community,<br> useful for Wireshark users. You can also now send...<br> Nmap 7.95 released: OS and service detection signatures galore! https://seclists.org/nmap-announce/2024/0 <p>Posted by Gordon Fyodor Lyon on May 05</p>Dear Nmap Community,<br> Additions include iOS 15...<br> OpenVAS http://seclists.org/#openvas Development and announcements regarding <a href="http://www.openvas.com/">OpenVAS</a>, a free network security scanner which forked from Nessus. This is a combination of the English openvas-announce, openvas-devel, openvas-discuss, and openvas-plugins lists. Re: Help with openvas setup http://seclists.org/openvas/2013/q3/107 <p>Posted by Florent THOMAS on Aug 23</p>+1 I agree, it&apos;s precious.<br> Regards<br> Re: Help with openvas setup http://seclists.org/openvas/2013/q3/106 <p>Posted by Hariharan Madhavan on Aug 23</p>The best way to get openvas running is by adding the atomic corp repository and installing using yum... There is no <br> Am running Backtrack R3 which...<br> SCAP plugins and OpenVAS http://seclists.org/openvas/2013/q3/105 <p>Posted by Rajesh Bhavsar on Aug 23</p>Hi all,<br> <br> Re: Help with openvas setup http://seclists.org/openvas/2013/q3/104 <p>Posted by Florent THOMAS on Aug 22</p>Hy,<br> Regards<br> Re: Help with openvas setup http://seclists.org/openvas/2013/q3/103 <p>Posted by Samuel Mwai on Aug 22</p>Am running Backtrack R3 which installed fine. Stumbled on this blog, check<br> K () sper<br> Help with openvas setup http://seclists.org/openvas/2013/q3/102 <p>Posted by Russell, Sean on Aug 22</p>Hello all.<br> I run openvasmd --rebuild, then run openvas-check-setup again, but I...<br> Easy startup script for self-compiled OpenVAS http://seclists.org/openvas/2013/q3/101 <p>Posted by Winfried Neessen on Aug 21</p>Hi,<br> each service. Also you can kill one service of OpenVAS, run the startup...<br> OpenVAS Feed Server: Load and Cron http://seclists.org/openvas/2013/q3/100 <p>Posted by Jan-Oliver Wagner on Aug 21</p>Hello OpenVAS users,<br> If your...<br> "Issue" for create schedule http://seclists.org/openvas/2013/q3/99 <p>Posted by Florent THOMAS on Aug 20</p>Hy,<br> regards<br> Re: Create credential failed http://seclists.org/openvas/2013/q3/98 <p>Posted by Florent THOMAS on Aug 20</p>I think I found the problem.<br> regards<br> Get_schedules not show task information http://seclists.org/openvas/2013/q3/97 <p>Posted by Rodrigo Seguel on Aug 19</p>after execute get_schedules command with option details=&quot;1&quot;, the output xml<br> &lt;get_schedules_response status=&quot;200&quot; status_text=&quot;OK&quot;&gt;&lt;schedule...<br> Re: cannot connect to the manager http://seclists.org/openvas/2013/q3/96 <p>Posted by brad on Aug 19</p>I even brought the ports up one at a time like so,<br> There is only one error I can find, but little on...<br> Re: cannot connect to the manager http://seclists.org/openvas/2013/q3/95 <p>Posted by brad on Aug 19</p>Here is the output of my openvasmd --rebuild -v <br> From: Openvas-discuss...<br> Re: Create credential failed http://seclists.org/openvas/2013/q3/94 <p>Posted by Florent THOMAS on Aug 18</p>Thanks for your answer. I&apos;m not sure of the use of this. My french level <br> Thanks for your help<br> Re: Create credential failed http://seclists.org/openvas/2013/q3/93 <p>Posted by Michael Meyer on Aug 18</p>*** Florent THOMAS wrote:<br> Micha<br> Open Source Security https://seclists.org/#oss-sec Discussion of security flaws, concepts, and practices in the Open Source community bubblewrap 0.12.0 fixes writes outside sandbox https://seclists.org/oss-sec/2026/q3/603 <p>Posted by Simon McVittie on Aug 27</p>bubblewrap 0.12.0 fixes a security vulnerability<br> All versions older than 0.12.0 are vulnerable.<br> The GNU C Library security advisory update for 2026-08-27 https://seclists.org/oss-sec/2026/q3/602 <p>Posted by Siddhesh Poyarekar on Aug 27</p>Hello,<br> distributions...<br> Re: Re: Reporter attribution is absent from GitHub's machine-readable vulnerability records, and from the NVD entirely https://seclists.org/oss-sec/2026/q3/601 <p>Posted by Greg KH on Aug 26</p>Ah, I&apos;m talking to a bot<br> greg k-h<br> Re: Re: Reporter attribution is absent from GitHub's machine-readable vulnerability records, and from the NVD entirely https://seclists.org/oss-sec/2026/q3/600 <p>Posted by Syed on Aug 26</p><a rel="nofollow" href="https://www.google.com/url?q=http://cve.org&amp;source=gmail&amp;ust=1787893426670000&amp;sa=E">https://www.google.com/url?q=http://cve.org&amp;source=gmail&amp;ust=1787893426670000&amp;sa=E</a><br> that explains a...<br> Re: Reporter attribution is absent from GitHub's machine-readable vulnerability records, and from the NVD entirely https://seclists.org/oss-sec/2026/q3/599 <p>Posted by Greg KH on Aug 26</p>Yes, cve.org json records are known to have this issue, because almost<br> to what...<br> Re: CVE-2026-41992 gzip 1.14 out-of-bounds memory buffer access https://seclists.org/oss-sec/2026/q3/598 <p>Posted by Jim Meyering on Aug 26</p>I am adding a test to exercise that. Will push it within a day or two.<br> Reporter attribution is absent from GitHub's machine-readable vulnerability records, and from the NVD entirely https://seclists.org/oss-sec/2026/q3/597 <p>Posted by Syed on Aug 26</p>This is a measurement, not a vulnerability report.<br> Measured 26 August 2026, public APIs only:...<br> [vim-security] Integer Overflow in Undo File Entry Size Check in Vim < v9.2.1014 && Vim >= v8.1.0688 https://seclists.org/oss-sec/2026/q3/596 <p>Posted by Christian Brabandt on Aug 26</p>Integer Overflow in Undo File Entry Size Check in Vim &lt; v9.2.1014 &amp;&amp; Vim &gt;= v8.1.0688<br> lines of an undo entry, with...<br> [vim-security] Out-of-bounds Access in libvterm Resize Handling in Vim < 9.2.1013 https://seclists.org/oss-sec/2026/q3/595 <p>Posted by Christian Brabandt on Aug 26</p>Out-of-bounds Access in libvterm Resize Handling in Vim &lt; 9.2.1013<br> which holds the cursor position and the bounds used...<br> graphql-go/graphql <= 0.8.1: quadratic CPU-exhaustion DoS via per-error full-document rescan (GetLocation) https://seclists.org/oss-sec/2026/q3/594 <p>Posted by First name Last name on Aug 26</p>Hello,<br> Product:...<br> Re: Emacs zero-click local command execution via TRAMP https://seclists.org/oss-sec/2026/q3/593 <p>Posted by Sean Whitton on Aug 26</p>Sean Whitton [21/Aug 2:33pm +01] wrote:<br> This has been assigned CVE-2026-79992, with thanks to Marco Benatto.<br> CVE-2026-75020: Apache APISIX: ldap-auth plugin cross-subtree identity impersonation https://seclists.org/oss-sec/2026/q3/592 <p>Posted by Abhishek Choudhary on Aug 26</p>Severity: <br> This issue...<br> CVE-2026-75005: Apache APISIX: Unauthenticated CPU-exhaustion DoS https://seclists.org/oss-sec/2026/q3/591 <p>Posted by Abhishek Choudhary on Aug 26</p>Severity: <br> <a rel="nofollow" href="https://apisix.apache.org">https://apisix.apache.org</a>...<br> CVE-2026-74848: Apache APISIX: Cross-user response poisoning in serverless plugins https://seclists.org/oss-sec/2026/q3/590 <p>Posted by Abhishek Choudhary on Aug 26</p>Severity: <br> Users are recommended to upgrade to version 3.18.0,...<br> CVE-2026-63041: Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers https://seclists.org/oss-sec/2026/q3/589 <p>Posted by Abhishek Choudhary on Aug 25</p>Severity: <br> Users are recommended to...<br> PaulDotCom https://seclists.org/#pauldotcom General discussion of security news, research, vulnerabilities, and the PaulDotCom Security Weekly podcast. Penetration Testing https://seclists.org/#pen-test While this list is intended for "professionals", participants frequenly disclose techniques and strategies that would be useful to anyone with a practical interest in security and network auditing. Exploit-DB.com RSS Feed https://www.exploit-db.com The Exploit Database - Exploits, Shellcode, 0days, Remote Exploits, Local Exploits, Web Apps, Vulnerability Reports, Security Articles, Tutorials and more. [remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE https://www.exploit-db.com/exploits/52658 CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE [remote] PCMan 2.0.7 - Buffer Overflow https://www.exploit-db.com/exploits/52657 PCMan 2.0.7 - Buffer Overflow [dos] NanaZip 6.5 - DoS https://www.exploit-db.com/exploits/52656 NanaZip 6.5 - DoS [webapps] flyto-core 2.26.7 - Arbitrary File Write https://www.exploit-db.com/exploits/52655 flyto-core 2.26.7 - Arbitrary File Write [webapps] Nodemailer 9.0.0 - File Read/ SSRF https://www.exploit-db.com/exploits/52654 Nodemailer 9.0.0 - File Read/ SSRF [webapps] Linuxfabrik monitoring_plugins_6.0.0 - SSRF https://www.exploit-db.com/exploits/52653 Linuxfabrik monitoring_plugins_6.0.0 - SSRF [dos] NanaZip 6.5 - DoS https://www.exploit-db.com/exploits/52652 NanaZip 6.5 - DoS [webapps] flyto_core 2.26.7 - Server-Side Request Forgery https://www.exploit-db.com/exploits/52651 flyto_core 2.26.7 - Server-Side Request Forgery [webapps] Probo 0.222.2 - IDOR https://www.exploit-db.com/exploits/52650 Probo 0.222.2 - IDOR [webapps] webpack_devserver 5.2.5 - CSRF https://www.exploit-db.com/exploits/52649 webpack_devserver 5.2.5 - CSRF [remote] phpSysInfo 3.4.5 - IP Allowlist Bypass https://www.exploit-db.com/exploits/52648 phpSysInfo 3.4.5 - IP Allowlist Bypass [dos] Nmap 7.99 - Extension Header Integer Underflow https://www.exploit-db.com/exploits/52647 Nmap 7.99 - Extension Header Integer Underflow [webapps] Duplicati 2.2.0.3 - JWT Signing Key Leak https://www.exploit-db.com/exploits/52646 Duplicati 2.2.0.3 - JWT Signing Key Leak [webapps] Joomla JCE_2.9.15 - Remote Code Execution https://www.exploit-db.com/exploits/52645 Joomla JCE_2.9.15 - Remote Code Execution [remote] ipTIME A3004T - Remote Code Execution https://www.exploit-db.com/exploits/52644 ipTIME A3004T - Remote Code Execution [remote] D-Link DNS_340L - OS Command Injection https://www.exploit-db.com/exploits/52643 D-Link DNS_340L - OS Command Injection [webapps] WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload https://www.exploit-db.com/exploits/52642 WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload [webapps] Apache Gravitino 1.2.1 - SSRF https://www.exploit-db.com/exploits/52641 Apache Gravitino 1.2.1 - SSRF [webapps] Blocksy Companion 2.1.46 - RCE https://www.exploit-db.com/exploits/52640 Blocksy Companion 2.1.46 - RCE [remote] PraisonAI praisonaiagents 1.6.77 - Remote Code Execution https://www.exploit-db.com/exploits/52639 PraisonAI praisonaiagents 1.6.77 - Remote Code Execution [remote] mcp-server-kubernetes 3.8.x - Argument Injection https://www.exploit-db.com/exploits/52638 mcp-server-kubernetes 3.8.x - Argument Injection [dos] LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting https://www.exploit-db.com/exploits/52637 LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting [webapps] Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF https://www.exploit-db.com/exploits/52636 Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF [webapps] Ray 2.56.0 - Directory Traversal & Local File Inclusion https://www.exploit-db.com/exploits/52635 Ray 2.56.0 - Directory Traversal & Local File Inclusion [webapps] OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution https://www.exploit-db.com/exploits/52633 OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution [local] Microsoft Edge 150.0.4078.48 - RCE https://www.exploit-db.com/exploits/52632 Microsoft Edge 150.0.4078.48 - RCE [webapps] CorgetGpsDget 2_3.2 - OS Command Injection https://www.exploit-db.com/exploits/52631 CorgetGpsDget 2_3.2 - OS Command Injection [webapps] Joomla 2.9.99.4 - Unauthenticated Remote Code Execution https://www.exploit-db.com/exploits/52630 Joomla 2.9.99.4 - Unauthenticated Remote Code Execution [webapps] Krayin CRM v2.2.x - Authenticated Remote Code Execution https://www.exploit-db.com/exploits/52629 Krayin CRM v2.2.x - Authenticated Remote Code Execution [webapps] Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure https://www.exploit-db.com/exploits/52628 Atarim WordPress Plugin 4.2.2 - Sensitive Information Exposure [webapps] Langflow 1.9.0 - RCE https://www.exploit-db.com/exploits/52627 Langflow 1.9.0 - RCE [webapps] Joomla Page Builder CK 3.5.10 - Arbitrary File Upload https://www.exploit-db.com/exploits/52626 Joomla Page Builder CK 3.5.10 - Arbitrary File Upload [webapps] MCPJam Inspector - Remote Code Execution https://www.exploit-db.com/exploits/52625 MCPJam Inspector - Remote Code Execution [local] ProtonVPN v4.4.1 - Unquoted Service Path https://www.exploit-db.com/exploits/52624 ProtonVPN v4.4.1 - Unquoted Service Path [webapps] Flowise 3.1.3 - arbitrary code execution https://www.exploit-db.com/exploits/52623 Flowise 3.1.3 - arbitrary code execution [remote] Hydra - Stack Buffer Overflow https://www.exploit-db.com/exploits/52622 Hydra - Stack Buffer Overflow [webapps] Discuz! X5.0 - Authentication Bypass https://www.exploit-db.com/exploits/52621 Discuz! X5.0 - Authentication Bypass [webapps] Tenable Nessus 10.12.1 - SQL Injection https://www.exploit-db.com/exploits/52620 Tenable Nessus 10.12.1 - SQL Injection [webapps] WordPress Bricks Builder Theme - RCE https://www.exploit-db.com/exploits/52619 WordPress Bricks Builder Theme - RCE [remote] iOS Bluetooth PAN Exploit - Ethernet Gateway without Adapter https://www.exploit-db.com/exploits/52618 iOS Bluetooth PAN Exploit - Ethernet Gateway without Adapter [webapps] Joomla Extension 4.1.4 - PHP Object injection https://www.exploit-db.com/exploits/52617 Joomla Extension 4.1.4 - PHP Object injection [webapps] Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass https://www.exploit-db.com/exploits/52616 Pulpy 0.1.1-Beta - Filesystem Sandbox Bypass [local] MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation https://www.exploit-db.com/exploits/52615 MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation [webapps] KeepInMind 0.8.4.2 - Stored XSS https://www.exploit-db.com/exploits/52614 KeepInMind 0.8.4.2 - Stored XSS [webapps] KNX visualisering - Broken Access Control https://www.exploit-db.com/exploits/52613 KNX visualisering - Broken Access Control [local] Windows Defender (MsMpEng.exe) - Race Condition https://www.exploit-db.com/exploits/52612 Windows Defender (MsMpEng.exe) - Race Condition [webapps] WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS) https://www.exploit-db.com/exploits/52611 WordPress Plugin WPZOOM Portfolio 1.4.21 - Reflected Cross-Site Scripting (XSS) [webapps] OpenEMR 7.0.2 - Arbitrary File Read https://www.exploit-db.com/exploits/52610 OpenEMR 7.0.2 - Arbitrary File Read [webapps] WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection https://www.exploit-db.com/exploits/52609 WordPress Contest Gallery 28.1.4 - Unauthenticated Blind SQL Injection [webapps] Drupal Core 10.5.5 - Error-Based SQL Injection https://www.exploit-db.com/exploits/52608 Drupal Core 10.5.5 - Error-Based SQL Injection Secure Coding https://seclists.org/#securecoding The Secure Coding list (SC-L) is an open forum for the discussion on developing secure applications. It is moderated by the authors of <a href="http://www.amazon.com/dp/0596002424?tag=secbks-20">Secure Coding: Principles and Practices</a>. Snort https://seclists.org/#snort Everyone's favorite open source IDS, <a href="http://www.snort.org/">Snort</a>. This archive combines the snort-announce, snort-devel, snort-users, and snort-sigs lists. Snort Subscriber Rules Update 2026-08-27 https://seclists.org/snort/2026/q3/17 <p>Posted by Research via Snort-sigs on Aug 27</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Snort Subscriber Rules Update 2026-08-25 https://seclists.org/snort/2026/q3/16 <p>Posted by Research via Snort-sigs on Aug 25</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Re: Is Snort3 no longer being developed? https://seclists.org/snort/2026/q3/15 <p>Posted by Oleksii Shumeiko -X (oshumeik - SOFTSERVE INC at Cisco) via Snort-devel on Aug 21</p>Hi<br> Alexey<br> Is Snort3 no longer being developed? https://seclists.org/snort/2026/q3/14 <p>Posted by Dheeraj Gupta via Snort-devel on Aug 20</p>Hi,<br> Dheeraj<br> Snort Subscriber Rules Update 2026-08-20 https://seclists.org/snort/2026/q3/13 <p>Posted by Research via Snort-sigs on Aug 20</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Snort Subscriber Rules Update 2026-08-18 https://seclists.org/snort/2026/q3/12 <p>Posted by Research via Snort-sigs on Aug 18</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Snort Subscriber Rules Update 2026-08-13 https://seclists.org/snort/2026/q3/11 <p>Posted by Research via Snort-sigs on Aug 13</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Snort Subscriber Rules Update 2026-08-06 https://seclists.org/snort/2026/q3/10 <p>Posted by Research via Snort-sigs on Aug 06</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Snort Subscriber Rules Update 2026-08-04 https://seclists.org/snort/2026/q3/9 <p>Posted by Research via Snort-sigs on Aug 04</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Snort Subscriber Rules Update 2026-07-30 https://seclists.org/snort/2026/q3/8 <p>Posted by Research via Snort-sigs on Jul 30</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Snort Subscriber Rules Update 2026-07-28 https://seclists.org/snort/2026/q3/7 <p>Posted by Research via Snort-sigs on Jul 28</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Snort Subscriber Rules Update 2026-07-23 https://seclists.org/snort/2026/q3/6 <p>Posted by Research via Snort-sigs on Jul 23</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Snort Subscriber Rules Update 2026-07-21 https://seclists.org/snort/2026/q3/5 <p>Posted by Research via Snort-sigs on Jul 21</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Snort Subscriber Rules Update 2026-07-16 https://seclists.org/snort/2026/q3/4 <p>Posted by Research via Snort-sigs on Jul 16</p>Talos Snort Subscriber Rules Update<br> <a rel="nofollow" href="https://www.snort.org/advisories">https://www.snort.org/advisories</a><br> Snort Subscriber Rules Update 2026-07-14 https://seclists.org/snort/2026/q3/3 <p>Posted by Research via Snort-sigs on Jul 14</p>Talos Snort Subscriber Rules Update<br> Snort 2: GID 1, SIDs 66738 through...<br> VulnWatch https://seclists.org/#vulnwatch A non-discussion, non-patch, all-vulnerability annoucement list supported and run by a community of volunteer moderators distributed around the world. Web App Security https://seclists.org/#webappsec Provides insights on the unique challenges which make web applications notoriously hard to secure, as well as attack methods including SQL injection, cross-site scripting (XSS), cross-site request forgery, and more. Wireshark https://seclists.org/#wireshark Discussion of the free and open source <a href="http://www.wireshark.org/">Wireshark</a> network sniffer. No other sniffer (commercial or otherwise) comes close. This archive combines the Wireshark announcement, users, and developers mailing lists.