VulnerabilitySANS @RISK
@RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked
NEOSEC enrichment — no mirror of the original source
Providing a reliable, weekly summary of newly discovered attack vectors, vulnerabilities with active exploits, and explanations of how recent attacks worked
Source: SANS @RISK. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Linked advisories
- CVE-2025-10263AMD ARM und EPYC Prozessoren: Mehrere Schwachstellen
- CVE-2025-10263ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel]
- CVE-2026-10520Ivanti Sentry — Ivanti Sentry OS Command Injection Vulnerability
- CVE-2026-11645Google Chrome / Microsoft Edge: Mehrere Schwachstellen
- CVE-2026-11645Google Chromium V8 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
- CVE-2026-11645Debian chromium: security update
- CVE-2026-11645Chromium: CVE-2026-11645 Out of bounds memory access in V8
- CVE-2026-12027Google Chrome / Microsoft Edge: Mehrere Schwachstellen
- CVE-2026-12027Debian chromium: security update
- CVE-2026-12027Google Chrome: Ausführung mit unnötigen Rechten
- CVE-2026-20253Splunk Enterprise: Mehrere Schwachstellen
- CVE-2026-20253Splunk Enterprise — Splunk Enterprise Missing Authentication for Critical Function Vulnerability
- CVE-2026-20262Cisco Catalyst SD-WAN Manager: Pfadüberschreitung (Path Traversal)
- CVE-2026-20262Cisco SD-WAN Manager: Schwachstelle ermöglicht Manipulation von Dateien
- CVE-2026-20262Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
- CVE-2026-25089Fortinet FortiSandbox: Schwachstelle ermöglicht Befehlsausführung
- CVE-2026-25089Fortinet FortiSandbox — Fortinet FortiSandbox OS Command Injection Vulnerability
- CVE-2026-26142Microsoft Nuance PowerScribe 360 4.0: Deserialisierung nicht vertrauenswürdiger Daten
- CVE-2026-26142Nuance PowerScribe Remote Code Execution Vulnerability
- CVE-2026-26240QNAP Systems File Station 5: Stack-basierter Pufferüberlauf
- CVE-2026-26240QNAP NAS: Mehrere Schwachstellen
- CVE-2026-26241QNAP Systems File Station 5: Stack-basierter Pufferüberlauf
- CVE-2026-30120Remotion: Remote Code Execution (RCE)
- CVE-2026-30121Remotion: Sicherheitslücke
- CVE-2026-34182OpenSSL: Mehrere Schwachstellen
- CVE-2026-34182Debian openssl: security update
- CVE-2026-34182OpenSSL: unzureichende Prüfung von Integritätswerten
- CVE-2026-34182OpenSSL vulnerabilities
- CVE-2026-34182OpenSSL vulnerabilities
- CVE-2026-34182CMS AuthEnvelopedData Processing May Accept Forged Messages
- CVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
- CVE-2026-42904Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-42904Windows TCP/IP Elevation of Privilege Vulnerability
- CVE-2026-44170bitnami mysql-client: Betriebssystem-Befehlsinjektion
- CVE-2026-44170MariaDB: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
- CVE-2026-44172bitnami mysql-client: SQL-Injection
- CVE-2026-44172MariaDB: mysql_real_escape_string() incorrectly handled big5
- CVE-2026-44172MariaDB: mysql_real_escape_string() incorrectly handled big5
- CVE-2026-44172MariaDB: mysql_real_escape_string() incorrectly handled big5
- CVE-2026-44631Apache HTTP Server: Mehrere Schwachstellen
- CVE-2026-44631Apache HTTP Server: Buffer Underflow
- CVE-2026-44631Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow
- CVE-2026-44815Microsoft Windows: Stack-basierter Pufferüberlauf
- CVE-2026-44815DHCP Client Service Remote Code Execution Vulnerability
- CVE-2026-44990Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html`
- CVE-2026-44990npm sanitize-html: Cross-Site-Scripting (XSS)
- CVE-2026-45602Microsoft Windows: Annahme nicht vertrauenswürdiger Zusatzdaten
- CVE-2026-45602Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability
- CVE-2026-45657Microsoft Windows: Use-After-Free
- CVE-2026-45657Windows Kernel Remote Code Execution Vulnerability
- CVE-2026-46316Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service
- CVE-2026-46316Linux Kernel: Sicherheitslücke
- CVE-2026-46614Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger
- CVE-2026-46614go github.com/fission/fission: unzureichende Zugriffskontrolle
- CVE-2026-46716Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron
- CVE-2026-46716go github.com/nezhahq/nezha: Betriebssystem-Befehlsinjektion
- CVE-2026-47131vm2: Mehrere Schwachstellen
- CVE-2026-47131Patriksimek Vm2: unkontrollierte dynamische Code-Ressourcen
- CVE-2026-47137Patriksimek Vm2: unkontrollierte dynamische Code-Ressourcen
- CVE-2026-47140Patriksimek Vm2: Versagen eines Schutzmechanismus
- CVE-2026-47208Patriksimek Vm2: unkontrollierte dynamische Code-Ressourcen
- CVE-2026-47281Microsoft Visual Studio Code: fehlende Authentifizierung für kritische Funktion
- CVE-2026-47281Visual Studio Code Elevation of Privilege Vulnerability
- CVE-2026-47281Microsoft DeveloperTools: Mehrere Schwachstellen
- CVE-2026-47291Microsoft Windows: Heap-basierter Pufferüberlauf
- CVE-2026-47291HTTP.sys Remote Code Execution Vulnerability
- CVE-2026-47643Microsoft Azure Stack Edge: externe Kontrolle von Dateinamen oder -pfaden
- CVE-2026-47643Microsoft Azure Stack Edge: externe Kontrolle von Dateinamen oder -pfaden
- CVE-2026-47643Azure Stack Edge Remote Code Execution Vulnerability
- CVE-2026-48713i18next i18next-fs-backend: Prototype Pollution
- CVE-2026-48714i18next i18next-http-middleware: Prototype Pollution
- CVE-2026-49261MariaDB: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
- CVE-2026-49261bitnami mysql-client: Betriebssystem-Befehlsinjektion
- CVE-2026-49261MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`
- CVE-2026-49261MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`
- CVE-2026-49261MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`
- CVE-2026-53471Migration-planner: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
- CVE-2026-54420LiteSpeed cPanel Plugin — LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability
- CVE-2026-9698Debian libdbi-perl: security update
- CVE-2026-9698HMBRAND DBI: Schreiben außerhalb des zugewiesenen Speichers (Out-of-bounds Write)
- CVE-2026-9698DBI versions before 1.648 for Perl saved errors in a limited-sized buffer
Affected vendors and products
- Adobe Adobe Campaign Classic
- Adobe Adobe Experience Manager 6.5
- Adobe Adobe Experience Manager 6.5 Lts
- Adobe Adobe Campaign Classic
- Adobe Adobe ColdFusion
- Adobe Coldfusion 2023
- Adobe Coldfusion 2025
- Adobe Adobe Experience Manager
- AMD Prozessor
- Apache Software Foundation Apache CXF
- Apache Software Foundation Apache Cxf
- Apostrophe Apostrophe
More on @RISK®
Other news entries
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33VulnerabilitySANS @RISK
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32VulnerabilitySANS @RISK
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31VulnerabilitySANS @RISK
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 30VulnerabilitySANS @RISK
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 29VulnerabilitySANS @RISK
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28VulnerabilitySANS @RISK
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 27VulnerabilitySANS @RISK
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 26VulnerabilitySANS @RISK
ID