Intel BRICK

XSpring Capital Public Company Limited is a company that operates in the business of investing in va...

Die Unternehmensgruppe Susanne Cerdá bietet nicht nur Dienstleistungen im Bereich Unternehmensgründu...

A major medical data breach.

Founded in 1961 and headquartered in New York City, New York, Lowenstein Sandler is a national law fir…

Specialized business management software designed for sign, graphics, and print providers

Fortrex is the premier provider of food safety solutions in North America, offering comprehensive sanitation services, chemical products and intervention solutions for food processing facilities. Our team of skilled food sanitors, microbiologists, technical experts and engineers are committed to keeping USDA, FDA, and CFIA processing facilities clean, safe, and audit-ready

Morrison Foerster is a leading international law firm with a presence in the United States, Asia, and …

Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Provides Laboratory Services.

Country: Grenada.Spain | Website: aisj.co.il | Revenue: $11.1 Million | Industry: Primary and Secondary Education | Employees: 50-100 | Properties: 218 GB (257,960 Files, 28,378 Folders)

Founded in 1998, PQE Group provides technology solutions and compliance consulting services to the Life Sciences industry. The company is headquartered in Reggello, Florence. Note : The Full Data volume is coming as duplicati (dindex.zip.aes), Our Team with our Affiliates will try to enum the PassPhrase From the Target Network and Crack it with a Custom Pass lists and custom tools, We Also Gonna S

Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Noelker and Hull NHA-FULL � US ARCHITECTURE FIRM (est. 1971) - HEALTHCARE / SENIOR-LIVING DESIGN - COMPLETE INTERNAL FILE-SERVER - FRESH TO 2026No credentials in this lot (excluded by decision). Focus: identity and familypackages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail.SUBJECT - Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPClegacy (Freder

Hauhinco is a German manufacturer of high-pressure water hydraulics. The company produces plunger pumps, valves, and pump stations for mining and industry. It also develops rail-bound shunting systems for automated material handling.

Marbre Design is a French company specializing in the processing of natural stone, marble, granite, and composite materials. The enterprise custom-manufactures kitchen countertops, bathroom fixtures, fireplace surrounds, and interior architectural elements. Its core operations focus on precision cutting, slab polishing, and the on-site installation of finished products.

Trulife is an internationally recognized company with over 60 years of experience in the develo pment and manufacture of specialized healthcare and consumer products. Their extensive product range includes breastcare solutions, orthotics, lower limb prosthetics, walking aids, and press ure care products. We will upload 68gb of corporate data soon. Detailed employee information (passport scans, D

RCS is a full-service engineering firm specializing in Construction Materials Testing, Construc tion Engineering and Inspection (CEI), and QA/QC services, founded in 2013. With over 60 years of combined FDOT experience, RCS provides high-quality professional services to clients in road way and bridge construction projects throughout Central Florida. We will upload 28gb of corporate data soon. De

[fashion] EWM Group — the parent group behind Bonmarché, Edinburgh Woollen Mill, and Peacocks, three of the UK's best-known value fashion chains. The exposed material includes: 503,878 loyalty programme member records — full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 2000–2026. ~21,000 employee records — salary, National In

CHAT Insurance offers a comprehensive range of insurance products including commercial, home, a uto, and travel insurance. Established in 2015, the company has expanded to 10 offices and serv es over 20,000 policyholders across Ontario. We will upload 112gb of corporate data soon. Employee information (passports, DLs, birth certs and other personal docs), projects (client personal information an

Femern Link Contractors (FLC) is an international joint venture responsible for designing and building the Fehmarnbelt tunnel between Denmark and Germany. Its work includes the immersed tunnel, tunnel portals and ramps, and the factory that produces the tunnel elements. During the attack, we bypassed EDR and infiltrated infrastructure. Since September 17, 2026, we have had full access to all confi

[automotive] The exposed material includes: Passport/visa/student-admission dossiers Tesla Model Y/Opal tooling, CAD and DFM tree Employee contract and HR folders <redacted> MEB/BMW NCAR metrology and plant-layout trees PLC/SPS/robot backups and cross-reference DBs TISAX/IATF audit and corrective-action records Restricted management meeting/WLAN record <redacted> Browser profile SQLit

telecommunications services · Malaysia | [PENDING EXPOSURE: · settlement window open]

wagyu.xyz runs two rigged systems, both proven by the evidence: 1. Rigged coinflip. The site advertises "48% win chance, 4% house edge" (coinflip-public-claim.txt, coinflip-public-terms.json), but server settings aimed for a 4.00% expected edge and the distribution of outcomes is measurably shifted against players: of 2,852 provably-fair-verified flips, 1,417 fell in the 0-48000 band ve

Echo Global Logistics is a Chicago-based, technology-enabled third-party logistics provider offering freight brokerage and integrated supply chain services, including truckload, LTL, warehousing, and cross-border shipping across North America. We hold Echo Global Logistics data: 2.06M claims rows, 153,727 freight loads, 261,440 quotes ($705M buy volume), 136,273 tenderings, 59,607 tracking record

Ryder is a Fortune 500 transportation and supply chain management company providing fleet management, dedicated transportation, and logistics solutions. What we hold: 18.75M rows, 328 CSVs, consumer names, phones, emails, driver/associate PII, cleartext API keys, LMS credentials, FTP/telematics configs from RyderView, RLM, EFT. Our demand is only $20M in BTC... i swear. Samples can be found be

Hi, join our telegram channel for fun.. i guess https://t.me/whitearmorxd

Machelen (Belgium) Machelen (Belgium) - municipal and social welfare (OCMW) file servers1.3 million files, ~2.9 TB. Working copy + backup copy (lawer2/lawer3). Language: Dutch, partly French.Contents:Social welfare and migration service client files: passports, ID cards, residence permits, sick notes.WZC nursing home: medical files, staff HR dossiers, workplace accidents.Civil status records (birt

Сompany from the Republic of San Marino, associated with the production and sale of fashion clothing and accessories. Archived personal and corporate data of employees and customers. [Sector: Manufacturing, Finance]

Belgium

United States

United States

We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Fe

United States

United States

United States

United States

Wagyu.xyz is a cross-chain swap platform that allows users to exchange cryptocurrencies for native Monero (XMR) without requiring identity verification (KYC) . It routes orders through Hyperliquid's order book for execution . We hold 38,628 orders and 10,139 IPs from wagyu.xyz: wallets, sessions, fingerprints, countries, $907M XMR-heavy volume. Our demand is only $5,000,000... hehe Samples

Oil and Gas

Hospitals and Health Care Stolen data: 1 GB.

Hospitals and Health Care Stolen data: 10 GB.

Medical Practices Stolen data: 100 GB.

Museums, Historical Sites, and Zoos Stolen data: 115 GB.

Medical Practices Stolen data: 121 GB.

Medical Practices Stolen data: 22GB.

Government Administration Stolen data: 151 GB.

Hospitals and Health Care Stolen data: 67 GB.

Government Administration Stolen data: 155 GB.

Hospitals and Health Care Stolen data: 26 GB.

[architecture] GreenbergFarrow — a respected ESOP-owned architecture firm headquartered in Atlanta, Georgia with offices in Charlotte, Dallas, Los Angeles, New York, Myrtle Beach, and international operations in Mexico, Colombia, India, and Canada. The dataset spans three major divisions: Client Libraries (152 client folders, A–F): Proprietary architectural designs, prototypes, and specification

Bristol City Council is the local authority for Bristol, England. It provides public services for residents, businesses, and visitors, including council tax and benefits, housing, schools, social care, waste and recycling, transport, planning, parks, and libraries

N/A

N/A

retail and facility services · United Arab Emirates | [PENDING EXPOSURE: · The complete payroll ledger, employee records and identity document archive of a UAE services group are held.]

[AI generated] N/A

[AI generated] N/A I don't have reliable, verifiable information about a company called "Burris & MacOmber." I'm not able to confirm its existence, industry, operations, or location, and providing fabricated details would be inaccurate and potentially misleading for threat intelligence purposes. If you have additional context or source material about this entity, I'd

[AI generated] N/A

[AI generated] N/A I don't have verified, reliable information about a company specifically named "Point Robotics" to confidently describe its operations, industry focus, or country of headquarters. Providing details without solid confirmation could result in inaccurate threat intelligence. If you have additional context—such as a sector, location, or related aliases—I can try agai

[AI generated] Natuzzi S.p.A. is an Italian manufacturer and distributor of furniture, specializing in leather and fabric upholstered sofas, chairs, and home furnishings. Founded in 1959 and headquartered in Santeramo in Colle, Italy, the company operates in the home furniture and interior design industry. Natuzzi designs, produces, and markets its products globally, selling through its own brande

[AI generated] N/A

[AI generated] MediSolution was a Canadian software company based in Montreal, Quebec, specializing in enterprise resource planning and management software solutions for the public sector, including healthcare, local government, and education institutions. It provided financial management, human resources, and payroll software systems. The company operated in the enterprise software and informatio

[AI generated] N/A I don't have reliable information about a company called "SleepEx LabRetriever." This does not correspond to any organization I can verify, and the name's unusual construction suggests it may be fictional, a test query, or a misspelling. I'd rather report this than fabricate details about its industry, operations, or country.

Antah Healthcare Group (AHCG) is one of Malaysia's leading integrated healthcare distribution and commercial partners, specializing in the nationwide marketing, sales, clinical regulatory support, and supply chain logistics of pharmaceuticals, medical equipment, and consumable products to hospitals and clinics.We successfully infiltrated AHCG's network and exfiltrated over 500 GB of high

Once the timer reaches zero, all exfiltrated data will be published in full.

Verification for Gamblinglore.com

Verification for Gamblinglore.com

Country: c | Status: Sale

Country: zz | Status: Public

Provider and developer of smart logistics solutions and autonomous driving systems intended to serve the vehicle industry. The company develops intelligent vehicle software and hardware system for the commercial vehicle industry, committing to making transportation and logistics more intelligent and safer.

[AI generated] Morrison Cohen LLP is a United States law firm headquartered in New York City. It provides legal services across practice areas including corporate law, litigation, bankruptcy and restructuring, real estate, intellectual property, and white-collar defense. The firm serves corporate clients, financial institutions, and individuals. It operates within the legal services industry, prim

Alain Afflelou is a leading European franchisor of optical and hearing aid products, founded in France in 1972. The company operates a robust network of over 1,500 stores across 20 countries, driven by aggressive marketing innovations like its famous "Tchin-Tchin" multi-pair offer. Key Figures • Network Revenue: €1.13 billion (TTC) for the fiscal year ending July 2025 • Corporate Reven

36,000 Machines Compromised, both AD forests (Main Campus + Hospital Sector(with appointments, patient information + research)) With GPOs, Two Oracle databases, every student + employee PII (including SSNs), research information, entire Entra Tenant, Oracle HR + Payroll + Banner Student Records, Internal Emails, Cerner EHR rosters. This is your entire network and infrastructure compromised, the en

MISC Group Incorporated in 1968, MISC Group is a world leading provider of international energy-related maritime solutions and services.29,841 files , 28.4 GBComplete command workstations: Master, Chief Officer and Bridge user folders - 16,918 files / 15.5 GB, including PST mail archives;Crew personal data (PDPA breach): IMO FAL Form 5 crew lists for ~30 seafarers with passport numbers (Malaysia/P

smart grid engineering firm · Spain | Live electrical telemetry sampled from the plant control network, with voltage, current and energy readings recorded on 23 October 2026; Complete inventory of 49 network devices including substation switches, remote terminal units, power meters and server management controllers, with locations and firmware details; Full maps of the internal control network seg

Gamdom is an unregulated crypto casino and sportsbook founded in 2016. It recently suffered a hot-wallet breach, with founder Felix Romer reporting over $3 million in losses, though on-chain analysts estimate the damage closer to $4.2 million. We hold Gamdom's full user database, 15,420,003 accounts with 146 columns, with Gamdom's total combined profit value exceeding $1 billion. The w

Plaintiff litigation law firm - Our 214 GB extraction includes executed agreements, final settlement participation agreements, court-signed stipulations regarding net worth, privileged internal memos, detailed litigation strategies, rough trial transcripts, comprehensive staff FAQs and much more.

N/A

N/A

Safe Data Storage Ltd is an active UK-based SME IT services company founded in 2004, headquartered in Orpington, Kent, and run by David Cleaver and others; it offers managed backup and disaster recovery on its own dual-site ISO 27001 UK private-cloud infrastructure (including SAFE Backup/Backup Plus, cloud-to-cloud backup for Microsoft 365 and similar workloads, Veeam-powered DR, Arcserve image ba

N/A

CVE-2026-66090 sev=high pkg=

CVE-2026-66088 sev=critical pkg=

CVE-2026-113387 sev=high pkg=

CVE-2026-21157 sev=high pkg=

CVE-2026-118579 sev=high pkg=

CVE-2026-93851 sev=high pkg=

CVE-2026-118804 sev=high pkg=

CVE-2026-118755 sev=high pkg=

CVE-2026-118803 sev=high pkg=

CVE-2026-118753 sev=high pkg=

CVE-2026-118752 sev=high pkg=

CVE-2026-118690 sev=critical pkg=

CVE-2026-118694 sev=high pkg=

CVE-2026-118689 sev=high pkg=

CVE-2026-118692 sev=high pkg=

CVE-2026-118682 sev=high pkg=

CVE-2026-116641 sev=high pkg=

CVE-2026-116576 sev=high pkg=systeminformation

CVE-2026-6647 sev=high pkg=

CVE-2026-76418 sev=high pkg=

CVE-2026-78674 sev=high pkg=

CVE-2026-13451 sev=high pkg=

CVE-2026-109411 sev=high pkg=

CVE-2026-117574 sev=critical pkg=

CVE-2025-14260 sev=high pkg=

CVE-2026-118688 sev=high pkg=

CVE-2026-118684 sev=high pkg=

CVE-2026-118686 sev=high pkg=

CVE-2026-118687 sev=high pkg=

CVE-2026-43499 exploit on vivo's MT6896 device V2238A.

GhostKey - CVE-2026-98260 一键提权工具（Shizuku + NDK Native）

CVE-2026-82090 · CVSS 9.2 CRITICAL · 0-click stored XSS in Mozilla Pocket — all versions (v0 → v8.33.0.0) · 18-year forever-day · no patch · MITRE published

PHP2Shell

An educational laboratory for studying a PXE network-boot vulnerability in EDK II / OVMF. It builds a pinned EDK II revision, boots a UEFI virtual machine in QEMU, and includes Python proof-of-concept

CVE-2026-111497 RCE PoC for one pinned Docker Official Image for WordPress

Security research case study: CVE-2026-41036 authenticated command injection in Quantum Networks QN-I-470.

Research notes on CVE-2026-101767 — unauthenticated vulnerability in Oracle Application Object Library (E-Business Suite)

Hunt for CVE-2026-18963 exploitation traces (Keycloak unauthenticated account takeover) in the Keycloak database

CVE-2026-XXXXX: SQL Injection Vulnerability in OpenEMR <8.5.0

Exploit for CVE-2026-63286: Offline decryptor for AXIS Camera Station (ACS) credentials

Linux 4.19 aarch64 PoC for CVE-2026-31431 (Copy Fail) - AF_ALG/authencesn page-cache write

CVE-2025-38502 Linux LPE. BPF cgroup local storage OOB via tail calls. Affected kernels: 5.9–5.15.191, 5.16–6.1.150, 6.2–6.6.104, 6.7–6.12.45, 6.13–6.16.0; fixed in 5.15.192, 6.1.151, 6.6.105, 6.12.46

CVE-2025-5548

CVE-2025-10035 is a critical vulnerability in Fortra GoAnywhere MFT that may allow attackers to execute commands remotely on a vulnerable server.

Next.js Middleware Bypass CVE-2025-29927 Mitigation work (Ansible Role)

Proof-of-concept exploit for CVE-2025-27740 Subject Key Identifier injection in Active Directory Certificate Services

PoC e exploits para CVE-2026-14440 (Universal SSL CAA Bypass), CVE-2026-3125 (OpenNext SSRF), CVE-2025-0651 (WARP Windows Privesc) | By Gh0st-Bx1

PoC and exploit for CVE-2025-24813 - Apache Tomcat Partial PUT RCE (CVSS 9.8)

An enhanced proof-of-concept exploit for CVE-2025-52691 (SmarterMail Arbitrary File Upload RCE) with APT-level features like stealth obfuscation, persistence, exfiltration, and interactive mode. For e

CVE‑2025‑55182 Detection

CVE-2025-26326 - vulnerabilidade critica em add-ons de conexao remota do NVDA (recuperado)

Posted by disclosure via Fulldisclosure on Oct 28 0day Rubbish Research Team is publicly disclosing a vulnerability in NETGEAR RAX120 (Nighthawk AX12) firmware V1.2.5.18, the WiFi 6 consumer router from NETGEAR (United States), built on the Qualcomm IPQ8074 platform. The administrative web plane of this firmware generation is a lighttpd server fronting the vendor's DNI-f

Posted by disclosure via Fulldisclosure on Oct 28 0day Rubbish Research Team is publicly disclosing a vulnerability in the Raritan PX3 PDU G4, firmware version 4.3.14, the intelligent rack power distribution unit from Raritan, a Legrand company (United States). A low-privilege authenticated session converts one diagnostics request into operating-system command execution in th

Posted by disclosure via Fulldisclosure on Oct 28 0day Rubbish Research Team is publicly disclosing a vulnerability in NUUO Crystal Server 3.19.0.85, the video management and NVR server software from NUUO Inc. of Taipei (Taiwan), distributed as the Crystal virtual-machine appliance: an Ubuntu-based OVA whose web tier is a lighttpd server fronting a PHP application, with .php

Posted by disclosure via Fulldisclosure on Oct 28 0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa MAR-2000 series industrial 4G/LTE cellular router, firmware image FWR_MAR2000_V1.0_Build_15010909, from Moxa Inc. (Taiwan). An authenticated administrator converts one saved monitoring-condition field into recurring, product-scheduled arbitrary comma

Posted by disclosure via Fulldisclosure on Oct 28 0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa MAR-2000 series industrial 4G/LTE cellular router, firmware image FWR_MAR2000_V1.0_Build_15010909, from Moxa Inc. (Taiwan). An authenticated administrator converts one stored VPN address field into arbitrary command execution as the identity of the p

Posted by disclosure via Fulldisclosure on Oct 28 0day Rubbish Research Team is publicly disclosing a vulnerability in the Moxa MAR-2000 series industrial 4G/LTE cellular router, firmware image FWR_MAR2000_V1.0_Build_15010909, from Moxa Inc. (Taiwan). An authenticated administrator converts one stored configuration field into arbitrary command execution as the identity of the

Posted by fulldisclosure on Oct 28 Am 21.10.26 um 07:23 schrieb jose: that is the CVE for the OOM RCE vulnerability in fpm and mod_php. Sure you got the right on? Best regards, Marius

Posted by Daniel Owens via Fulldisclosure on Oct 28 On 29 August 2026, we released "Commas of D00m" -- an old proof of concept that demonstrates unconstrained resource consumption in many JSON parsers. As recently discussed (in "Continued Apache Struts2 JSON Plugin Insecure Deserialisation"), the Apache Struts2 JSON Plugin's S2-072 and prior code changes f

Posted by Daniel Owens via Fulldisclosure on Oct 28 Summary Thus far we have written extensively about the rampant number of insecure JavaScript Object Notation (JSON) deserialisers available today, like in "Struts2 and Related Framework Array/Collection DoS" (26 October 2025) and "JSON Deserialiser Unconstrained Resource Consumption Quick Overview" (07 Marc

Posted by Apple Product Security via Fulldisclosure on Oct 27 APPLE-SA-10-26-2026-5 macOS Tahoe 26.7.2 macOS Tahoe 26.7.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/149522 . Apple maintains a Security Releases page at <a rel="

Posted by Apple Product Security via Fulldisclosure on Oct 27 APPLE-SA-10-26-2026-10 Safari 27.2 Safari 27.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/149527 . Apple maintains a Security Releases page at <a rel="nofollow" hre

Posted by Apple Product Security via Fulldisclosure on Oct 27 APPLE-SA-10-26-2026-9 visionOS 27.2 visionOS 27.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/149526 . Apple maintains a Security Releases page at <a rel="nofollow"

Posted by Apple Product Security via Fulldisclosure on Oct 27 APPLE-SA-10-26-2026-8 watchOS 27.2 watchOS 27.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/149525 . Apple maintains a Security Releases page at <a rel="nofollow" hr

Posted by Apple Product Security via Fulldisclosure on Oct 27 APPLE-SA-10-26-2026-7 tvOS 27.2 tvOS 27.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/149524 . Apple maintains a Security Releases page at <a rel="nofollow" href="ht

Posted by Apple Product Security via Fulldisclosure on Oct 27 APPLE-SA-10-26-2026-6 macOS Sequoia 15.8.2 macOS Sequoia 15.8.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/149523 . Apple maintains a Security Releases page at <a r

Posted by Andrew Stitcher on Oct 28 Severity: low Affected versions: - Apache Qpid Proton C through 0.40.0 Description: A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RFC9525 standard - the fix only accepts certificates that comply to this standard.

Posted by Andrew Stitcher on Oct 28 Severity: important Affected versions: - Apache Qpid Proton C through 0.40.0 Description: When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on h

Posted by Andrew Stitcher on Oct 28 Severity: important Affected versions: - Apache Qpid Proton C through 0.40.0 Description: A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to versio

Posted by Andrew Stitcher on Oct 28 Severity: important Affected versions: - Apache Qpid Proton C through 0.40.0 Description: When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially tru

Posted by Robert Rothenberg on Oct 28 CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary CVE-2026-116265 MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 con

Posted by Robert Rothenberg on Oct 28 CVE-2026-116131 HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts CVE-2026-116132 HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk CVE-2026-11613

Posted by Alan Coopersmith on Oct 28 https://github.com/eclipse-vertx/vert.x/security/advisories/GHSA-ch7p-g5pm-3gqx advises: https://research.jfrog.com/post/byte-debt

Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 0.11.0.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 through 4.3.1 Description: When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocates a buffer o

Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 3.2.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 through 4.3.1 Description: An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or an environment variable from the br

Posted by Manikumar on Oct 28 Severity: moderate Affected versions: - Apache Kafka 2.4.0 before 4.2.2 - Apache Kafka 4.3.0 before 4.3.2 Description: Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration P

Posted by Manikumar on Oct 28 Severity: low Affected versions: - Apache Kafka 2.4.0 before 4.2.2 - Apache Kafka 4.3.0 before 4.3.2 Description: Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. W

Posted by Manikumar on Oct 28 Severity: low Affected versions: - Apache Kafka 1.1.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 through 4.3.1 Description: Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed

Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 0.10.0.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 through 4.3.1 Description: Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, wit

Posted by Manikumar on Oct 28 Severity: important Affected versions: - Apache Kafka 2.4.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 through 4.3.1 Description: Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField obje

Posted by Manikumar on Oct 28 Severity: moderate Affected versions: - Apache Kafka 3.7.0 through 4.1.2 - Apache Kafka 4.2.0 through 4.2.1 - Apache Kafka 4.3.0 Description: The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (default 1 MB) before decomp

risco de exploração alto ou subiu no dia

risco de exploração alto ou subiu no dia

risco de exploração alto ou subiu no dia

risco de exploração alto ou subiu no dia

risco de exploração alto ou subiu no dia

risco de exploração alto ou subiu no dia

risco de exploração alto ou subiu no dia

risco de exploração alto ou subiu no dia

risco de exploração alto ou subiu no dia

Ação: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for eval

Ação: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for eval

Ação: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for eval

Ação: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for eval

Ação: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for eval

Ação: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for eval

Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42 .

Summary Project Zero compared two automated tools used by Google to find vulnerabilities in Chrome’s JavaScript engine, V8, on a regular basis. Fuzzilli is a generative JavaScript engine fuzzer and BigSleep is an LLM-based bug finding system. In the past six months, BigSleep found more vulnerabilities than Fuzzilli (45 versus 37) with a 25% overlap in the specific bugs reported. Since this compari

Here's the lowdown on CVE-2026-109618 and CVE-2026-109619, as well as what website owners and IT teams should do to stay safe – all in a little more than two minutes