Mir0Auth is a phishing toolkit targeting Microsoft 365 authentication tokens. It uses a multi-step phishing flow starting with a business email lure and a PDF attachment leading to a DocuSign-themed page. Victims are redirected to a legitimate Microsoft Device Code authentication page, allowing attackers to obtain M365 tokens. The toolkit employs obfuscated network communication using XOR encoding for command-and-control URLs and payloads. Primary activity has been observed against US organizations.
CVE-2026-93994 concerns the Mina SSH server's capability to require multiple authentication schemes, such as two different public keys, rather than just one. This vulnerability has a CVSS score of 8.1, indicating a high impact on confidentiality and integrity with low attack complexity. Multiple specific versions of Mina are affected. There is no explicit vendor patch or fix detailed in the advisory, and no known exploits are reported in the wild.
CVE-2026-76504 is a critical vulnerability in Cisco Catalyst SD-WAN Manager involving improper handling of URI hex encoding in HTTP requests. This flaw allows an unauthenticated remote attacker to gain admin-level privileges on the affected system. The vulnerability has a CVSS score of 9.8 and is known to be exploited in the wild. No specific affected versions or patch information are provided in the available data.
A critical remote code execution vulnerability exists in Greek Universities Network (GUnet) Open eClass Platform version 3.15. The flaw allows an unauthenticated attacker to execute arbitrary code via the chat input field in the course module. The vulnerability has a CVSS score of 9.8, indicating high severity with full confidentiality, integrity, and availability impact. No patch or remediation information is currently provided.
An incorrect authorization vulnerability in the Human Interface Device (HID) component of Google Chrome prior to version 154.0.8037.57 allows a remote attacker who has compromised the renderer process to bypass system access restrictions via a crafted HTML page. This vulnerability has a high severity rating with a CVSS score of 8.1.
An incomplete cleanup vulnerability in the SmartCard component of Google Chrome versions prior to 154.0.8037.57 allows a remote attacker to bypass system access restrictions via a crafted HTML page, leveraging social engineering. The vulnerability has a medium severity rating.
A vulnerability in Google Chrome's MediaStream component prior to version 154.0.8037.57 allows a remote attacker to bypass the web origin policy via a crafted HTML page, potentially leading to unauthorized actions in a privileged context. The issue is classified with medium severity and has a CVSS score of 6.5.
A critical buffer overflow vulnerability exists in ANGLE component of Google Chrome on Android versions prior to 154.0.8037.57. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by tricking a user into visiting a crafted HTML page.
This update for perl-Protocol-HTTP2 fixes the following issue:
- CVE-2026-16028: memory exhaustion leading to denial of service due to closed streams never being removed by
`stream_state` from the connection stream table (bsc#1279629).
A denial of service vulnerability exists in libXpm before version 3.5.19 due to improper handling of XPM images with zero-dimension values, causing an unsigned underflow in the write path. This flaw allows local attackers to cause unbounded CPU usage and memory exhaustion, potentially crashing the affected system. The issue affects multiple Ubuntu releases and has been addressed in updated package versions.
A security update for Chromium addresses multiple vulnerabilities including buffer overflows, use-after-free errors, out-of-bounds writes, missing or incorrect authorization, race conditions, information leaks, improper input validation, and UI misrepresentations across various components such as ANGLE, GPU, ServiceWorker, DevTools, V8, and others. These issues are fixed in Chromium version 154.0.8037.57. The update resolves a wide range of security flaws that could impact the browser's stability and security.
A security update for radare2 version 6.2.2 addresses multiple vulnerabilities including denial of service, command injection, out-of-bounds reads, heap overflows, and integer overflows. The update fixes issues such as validation errors in file parsers, infinite loops, and use-after-free conditions. These vulnerabilities collectively pose critical risks to the integrity and availability of the software. No specific affected versions are provided in the data. The update includes various fixes improving analysis, core functionality, and plugin behavior.
Multiple critical vulnerabilities have been identified in Apache Tomcat versions 10 and 11 and related native libraries, including improper authentication, security constraint bypass on WebSocket endpoints, denial of service via resource exhaustion or malformed requests, HTTP request smuggling, and TLS handshake buffer overreads causing JVM crashes. These issues could allow attackers to bypass authentication, cause denial of service, or manipulate HTTP and WebSocket traffic under certain conditions. The vulnerabilities affect various older Tomcat 6 and 7 versions as well. The overall severity is medium with a CVSS score of 6.5.
A code execution vulnerability (CVE-2026-96442) exists in Emacs versions prior to 31.2. The flaw allows arbitrary code execution when viewing or editing untrusted text files in modes other than Emacs Lisp mode. This issue has been addressed in Emacs 31.2.
An integer overflow vulnerability exists in MPack version 1.1.1 affecting the functions mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc(). This vulnerability has a CVSS score of 6.2, indicating medium severity, and may cause a denial of service due to application crash. No known exploits are reported in the wild. Multiple specific versions including 1.1.1 and several 1.6-x builds are affected. No patch or remediation information is currently provided.
Red Hat has issued a security advisory for multiple vulnerabilities in the Linux kernel packages of Red Hat Enterprise Linux 10. These include out-of-bounds reads, buffer overflows, use-after-free conditions, denial of service, and privilege escalation issues. The update also contains bug fixes and enhancements. A system reboot is required after applying the update. Red Hat recommends prompt installation to mitigate potential risks.
An OS command injection vulnerability exists in the TDDP module of Deco BE11000 devices. An attacker on an adjacent network can exploit this flaw by sending a crafted UDP packet to execute arbitrary commands with root privileges. Successful exploitation can lead to full device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability.
A local privilege escalation vulnerability exists in the admin backend of gvfs due to a race condition in the gvfsd-admin daemon. The daemon improperly changes ownership of newly created private D-Bus sockets by following symbolic links in user-controlled directories. An authenticated local attacker can exploit this TOCTOU race condition to change ownership of arbitrary root-owned files, potentially leading to full root privileges.
