Vulnerabilities & fixes · Archive

Vulnerabilities & fixes

Dates are publishers’ publication dates, source update dates, or CISA catalog-added dates. First collected records when SecSIG first saw the entry.

• Initial access through embedded devices: a vulnerability in lwIP ↗ (opens in a new tab)

  ByteRay Blog · Published 2026-09-30 · First collected 2026-10-24

• Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances ↗ (opens in a new tab)

  Threat Intelligence · Published 2026-09-29 · First collected 2026-10-24

• louis-rs Security Audit ↗ (opens in a new tab)

  Blog on Shielder · Published 2026-09-29 · First collected 2026-10-24

• The New Rules of Patching: When a Fix Becomes a Blueprint for Attackers ↗ (opens in a new tab)

  From the Frog's mouth - JFrog Blog · Published 2026-09-28 · First collected 2026-10-24

• Actively Exploited NetScaler Vulnerabilities ↗ (opens in a new tab)

  Sygnia · Published 2026-09-28 · First collected 2026-10-24

• macOS: Shellcoding on Apples (ARM64) ↗ (opens in a new tab)

  Zeyad Azima · Published 2026-09-26 · First collected 2026-10-24

• Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol ↗ (opens in a new tab)

  Risky Bulletin · Published 2026-09-25 · First collected 2026-10-24

• Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4) ↗ (opens in a new tab)

  Datadog Security Labs · Published 2026-09-24 · First collected 2026-10-24

• Google's PageBreak Project – Real-World Findings ↗ (opens in a new tab)

  Security Engineering Blog · Published 2026-09-24 · First collected 2026-10-24

• Rückblick auf die heise devSec in Marburg ↗ (opens in a new tab)

  Insinuator.net - Bold Statements · Published 2026-09-24 · First collected 2026-10-24

• Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation ↗ (opens in a new tab)

  The GreyNoise Blog · Published 2026-09-21 · First collected 2026-10-24

• From Bug to Schema: Exploring Error-Based SQL Injection on an Authenticating Portal ↗ (opens in a new tab)

  InfoSec Write-ups - Medium · Published 2026-09-17 · First collected 2026-10-24

• Oracle Critical Security Patch Update Advisory - September 2026 ↗ (opens in a new tab)

  Oracle security alerts · Published 2026-09-15 · First collected 2026-10-24

• Athena spotlight: Black Duck on the importance of flagging zero-days at scale ↗ (opens in a new tab)

  Chainguard: Unchained · Published 2026-09-14 · First collected 2026-10-24

• WeWorm is calling. It's time to answer. ↗ (opens in a new tab)

  Calif · Published 2026-09-11 · First collected 2026-10-24

• Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days ↗ (opens in a new tab)

  Proofpoint Threat Insight · Published 2026-09-09 · First collected 2026-10-24

• Security Alert: Alert Regarding Vulnerabilities in Adobe Acrobat and Reader (APSB26-141) ↗ (opens in a new tab)

  JPCERT news · Published 2026-09-09 · First collected 2026-10-24

• Microsoft patchetirsdag september 2026 ↗ (opens in a new tab)

  NSM NCSC news · Published 2026-09-08 · First collected 2026-10-24

• Hunting Vulnerabilities Using Frontier Models ↗ (opens in a new tab)

  Okta Security RSS Feed · Published 2026-09-08 · First collected 2026-10-24

• Learning AD by Building a C2: Exploiting RBCD with emp3r0r ↗ (opens in a new tab)

  jm33_ng · Published 2026-09-07 · First collected 2026-10-24

• Recorded Future Announces Automated Signature Creation, Accelerating Vulnerability Prioritization ↗ (opens in a new tab)

  Recorded Future – Main Feed · Published 2026-09-04 · First collected 2026-10-24

• Check Your Motor Oil Before Turbocharging: CVE-2026-7899, When V8's Optimization Engine Builds Up Carbon ↗ (opens in a new tab)

  Nebula Security · Published 2026-08-27 · First collected 2026-10-24

• A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console ↗ (opens in a new tab)

  Bishopfox · Published 2026-08-26 · First collected 2026-10-24

• Your Coding Assistant Is Shipping Security Vulnerabilities ↗ (opens in a new tab)

  Salt Security Blog · Published 2026-08-26 · First collected 2026-10-24

• Ruby Marshal Kick-off Gadgets - elttam ↗ (opens in a new tab)

  elttam · Published 2026-08-26 · First collected 2026-10-24

• CVE-2026-72898: Critical Metabase Unauthenticated SQL Injection Vulnerability ↗ (opens in a new tab)

  OffSec RSS Feed · Published 2026-08-25 · First collected 2026-10-24

• CVE-2026-65400: macOS Screen Sharing Authentication Bypass Under Active Exploitation ↗ (opens in a new tab)

  Resecurity · Published 2026-08-25 · First collected 2026-10-24

• ZDI-CAN-29528 - Net-SNMP Vulnerability (Upcoming) ↗ (opens in a new tab)

  Vulnerability Research & Exploit Development on TecSecurity Research · Published 2026-08-25 · First collected 2026-10-24

• Part 1/6 | Systemic Risks in the Managed PostgreSQL Industry: Extension Risks Are Real! Exploiting PostGis Memory Corruption Bug at NeonDB, SupaBase and Many More ↗ (opens in a new tab)

  Mehmet Ince @mdisec – Vulnerability Researcher | Building security products | Security Advisor | Amateur Muay Thai fighter · Published 2026-08-14 · First collected 2026-10-24

• ARM64 stack internals and obfuscation on Apple Silicon ↗ (opens in a new tab)

  MDSec · Published 2026-08-14 · First collected 2026-10-24