CVE-2026-95510: GNU Inetutils flaw
A notice published on September 25, 2026 reports possible service disruption involving an uninitialized sigaction structure; the possibility of code execution remains unclear.
Read articleKnowledge you can apply
Cyber
Security for teams connecting data, documents and agents to AI.
CVE-2026-100310: GNU libextractor flaw
A notice published on September 25, 2026 reports that GNU libextractor versions before 1.16 may allow local privilege escalation through untrusted plugin search paths.
Read articleCVE-2026-91206: XSS in Apache Roller 6.1.5
A September 25, 2026 advisory reports a moderate reflected XSS issue in Apache Roller 6.1.5’s optional LDAP comment authenticator.
Read articleCVE-2026-91204: XSS risk in Apache Roller
A bulletin describes a moderate flaw in Apache Roller 6.1.5: comments can store javascript: links that may run scripts in visitors’ browsers.
Read articleApache Roller 6.1.5: stored XSS in comment moderation
A security bulletin published on September 25, 2026, reports a stored XSS flaw in Apache Roller 6.1.5, triggered when a moderator or administrator views the comment moderation page.
Read articleTelecom extortion leads to 70-month sentence
A report published on September 25, 2026 says a U.S. soldier received a 70-month prison sentence for intrusions, theft of call and message metadata, and extortion targeting telecom companies.
Read articleApache Roller 6.1.5: Trackback-stored XSS alert
A notice published on September 25, 2026 describes stored XSS in Apache Roller 6.1.5. The risk depends on published entries accepting comments and Trackbacks; the stated severity is moderate, with a CVSS 3.1 score of 6.1.
Read articleCVE-2026-82387: Stored XSS in Apache Roller
A notice published on September 25, 2026 reports stored XSS in Apache Roller 6.1.5: users permitted to upload media may store active content because the system trusts the content type supplied with the upload.
Read articleCVE-2026-82386: Apache Roller OPML import flaw
A notice published on September 25, 2026 reports a vulnerability in Apache Roller 6.1.5: an administrator could exploit OPML import to read files accessible to the process and reach internal network addresses.
Read articleApache Roller 6.1.5: flaw may expose classpath files
A notice published on September 25, 2026 says a weblog administrator can use an include directive in a Velocity template to read classpath files, including configurations containing secrets.
Read articleApache Roller 6.1.5: critical deserialization alert
A notice published on September 25, 2026 reports unauthenticated deserialization in Apache Roller 6.1.5's XML-RPC endpoint and rates the flaw critical, with a CVSS 3.1 score of 9.8.
Read articleCVE-2026-82383: Apache Roller 6.1.5 flaw
A notice published on September 25, 2026 describes an anonymous configuration action that can persistently change the homepage weblog selection in Apache Roller 6.1.5.
Read articleCVE-2026-82382: XSS in Apache Roller
A bulletin published on September 25, 2026 reports reflected XSS in Apache Roller 6.1.5, involving a manipulated directory parameter.
Read articleCVE-2026-82381: Stored XSS in Apache Roller
An advisory published on September 25, 2026 describes stored XSS in Apache Roller 6.1.5, rated important with a CVSS 3.1 score of 5.4 (medium).
Read articleCVE-2026-82380: CSRF flaw in Apache Roller
An alert published on September 25, 2026, reports that Apache Roller 6.1.5 accepts requests without the required salt token, enabling actions on behalf of logged-in users.
Read articleApache Roller: WSSE header can be replayed
A September 25, 2026 security notice says a captured valid WSSE digest header can be replayed to gain the victim’s AtomPub authority in Apache Roller 6.1.5.
Read articleKiteworks advises pause after threat alert
On September 25, 2026, Kiteworks said it had received intelligence from federal authorities about a possible attack targeting some systems used by customers and advised them to stop using the platform.
Read articleLabcorp to change security practices after settlement
A September 25, 2026 news item says Labcorp will overhaul data security practices and pay a $2.3 million fine. The measures cover supplier incident response, data sharing limits, and risk management.
Read articleInput Leap through 3.0.3: flaw allows escalation to SYSTEM
NotCVE-2026-0015 reports that an unauthenticated critical function in the input-leapd daemon may let a low-privilege local Windows user run commands as NT AUTHORITY\SYSTEM.
Read articleNote on XSS in ansi2html 1.9.4
A September 25, 2026 post points to an oss-sec discussion about an XSS vulnerability in ansi2html 1.9.4 and mentions a related Hacker News discussion.
Read articleRota Nacional
Bring privacy into your workflow.
30 days, no card, with a starting quota. After that, Pix credit from R$ 10,00.