Parse Server versions >=8.0.2 <8.6.91 and >=9.0.0 <9.10.1-alpha.10 have an improper authentication vulnerability in their code-based authentication adapters. These adapters do not verify the client's authorization code with the external provider during login when authentication data is supplied with username and password. This allows a low-privileged authenticated user to link an arbitrary, unverified external provider identity to their account, potentially spoofing trusted identities. Additionally, attackers can pre-hijack accounts by claiming a provider ID before the legitimate user links it. Versions 8.6.91 and 9.10.1-alpha.10 fix this by verifying credentials on login and rejecting already linked provider IDs. Disabling affected adapters is a recommended workaround.
CVE-2026-88775 is a memory overflow vulnerability in Citrix NetScaler ADC and Gateway products. It affects versions prior to 14.1-73.37 and 13.1-64.23, including FIPS and NDcPP variants. The flaw can cause unpredictable or erroneous behavior, including denial of service. The vulnerability has a high severity rating with a CVSS score of 8.8. No known exploits are reported in the wild. The vendor has not provided explicit patch links or advisories in the provided data.
CVE-2026-88773 is a critical vulnerability in Citrix NetScaler ADC and Gateway involving inconsistent interpretation of HTTP requests, known as HTTP Request/Response smuggling. This flaw affects multiple versions of the ADC and Gateway products prior to specific fixed releases. The vulnerability has a high CVSS 4.0 score of 9.3, indicating a severe risk. No known exploits are reported in the wild. The issue can lead to significant impact due to the nature of HTTP request smuggling attacks.
CVE-2026-88774 is a high-severity vulnerability in Citrix NetScaler ADC and Gateway products. It allows a feature policy bypass due to improper use of HTTP URL based expressions. The issue affects multiple versions prior to 14.1-73.37 and 13.1-64.23, including FIPS and NDcPP variants. The vulnerability has a CVSS 4.0 score of 7.0, indicating a network attack vector with low complexity but partial impact on confidentiality and integrity. No known exploits are reported in the wild. No vendor advisory or patch information is provided in the input data.
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service
Citrix has confirmed that two critical NetScaler remote code execution vulnerabilities, tracked as CVE-2026-88771 and CVE-2026-88772, are being exploited in attacks and that it has released security updates to fix the flaws. [...]
Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.
This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.
This content is an Ask Me Anything (AMA) session hosted by experienced Chief Information Security Officers (CISOs) aimed at helping cybersecurity professionals advance their careers. It focuses on career growth, leadership, and team building within the cybersecurity field. There is no indication of any security threat, vulnerability, or exploit associated with this content.
Wireshark version 4.6.9 was released on September 27, 2026, addressing 19 security vulnerabilities and fixing 16 bugs. The release aims to improve the security and stability of the widely used network protocol analyzer.
This writeup describes a vulnerability chain starting from leaked account credentials leading to remote code execution (RCE) on a web server. The attacker discovered exposed functions without rate limiting that allowed enumeration of valid accounts and credential leakage. Using the leaked credentials, the attacker gained account access and found a file upload feature that accepted .shtml files. Leveraging Server-Side Includes (SSI) support, the attacker executed server-side commands and bypassed firewall restrictions to achieve RCE. The vulnerabilities were responsibly disclosed and patched.
KitchenOwl versions up to 0.7.10 have an authorization bypass vulnerability where the application does not verify that category IDs belong to the authenticated user's household. This allows authenticated users to enumerate and access category details such as names, budgets, and colors from other households, breaking household data isolation.
CVE-2026-101032 is a high-severity OS command injection vulnerability in the denisidoro navi tool. Versions up to and including 2.24.0 improperly neutralize special shell characters in cheatsheet variable values, allowing attackers to inject arbitrary shell commands via crafted file names in suggestion command directories. This can lead to execution of commands with the privileges of the victim user.
CVE-2026-100866 is a medium severity vulnerability in onefetch up to version 2.28.1 where repository information fields are written to the terminal without sanitizing control characters. This allows attackers to inject terminal escape sequences via project manifest version and name fields, potentially manipulating terminal output or triggering emulator-specific behaviors.
CVE-2026-100748 is a Cross-Site Request Forgery (CSRF) vulnerability in the Event Gallery extension for Joomla by svenbluege.de. It affects versions 1.0.0 through 6.0.0 and allows unauthorized commands to be transmitted from a trusted user. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9. No official patch or vendor advisory is currently available.
CVE-2026-100747 is a medium severity Cross-Site Request Forgery (CSRF) vulnerability in the Event Gallery extension for Joomla by svenbluege.de. It affects versions 1.0.0 through 6.0.0. The vulnerability occurs due to the lack of a CSRF token check in the image upload functionality, allowing an attacker to upload files to an event and potentially overwrite existing files with the same name.
CVE-2026-97164 is a high-severity vulnerability in the Event Gallery extension for Joomla by svenbluege.de. Versions from 1.0.0 through 6.0.0 are affected. The flaw allows an authenticated user to perform arbitrary recursive deletion of directories writable by the web server via the 'images' parameter in the 'cache.process' task. This improper limitation of pathname to restricted directories (CWE-22) can lead to significant data loss or service disruption.
CVE-2026-100749 is a Cross-Site Request Forgery (CSRF) vulnerability in the backend cleanup actions of the Event Gallery extension for Joomla by svenbluege.de. This issue affects versions from 1.0.0 up to 6.0.0. The vulnerability allows unauthorized requests to trigger deletion of orphaned file entries and shopping carts older than 30 days. The CVSS 4.0 base score is 5.1, indicating a medium severity level.
A medium severity vulnerability (CVE-2026-97165) affects the Event Gallery extension for Joomla by svenbluege.de. Versions 1.0.0 through 6.0.0 are impacted by an open redirect issue where a base64-decoded 'return' parameter is used without validation, allowing redirection to untrusted sites. This vulnerability is categorized as CWE-601 (Open Redirect) and also involves reflected cross-site scripting (CWE-79).
CyberCodex v3.2 is an open-source, zero-dependency command-line interface (CLI) tool that aggregates 22 free threat intelligence, infostealer telemetry, and OSINT feeds. It enables security teams to perform domain and credential exposure checks, infrastructure and DNS telemetry, and offline cyber warfare correlation with detection rule generation. The tool integrates data from sources such as HaveIBeenPwned, Hudson Rock, Shodan InternetDB, RIPE BGP, EPSS, and CISA KEV, providing a unified interface without requiring API keys or external dependencies.
CVE-2026-100741 is a critical eval injection vulnerability in Progressive Robot Ltd's hMailServer versions 6.0.0 through 6.3.3 on Windows. It allows a remote unauthenticated attacker to execute arbitrary JScript code with service account privileges via crafted passwords or certain message fields when event scripting is enabled with JScript and specific event handlers are defined. The vulnerability does not affect VBScript event scripts or Linux builds. Exploitation requires non-default configurations enabling JScript event scripting and relevant handlers.