CyberSecurity News Feeds Telegram Channel Link

🔴 CVE Digest — 01 Nov 2026
1 critical vulnerability

🔴 CVE-2026-120189 · CVSS 10.0
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 31 Oct 2026
1 critical vulnerability

🔴 CVE-2026-118636 · CVSS 9.8
**UNSUPPORTED WHEN ASSIGNED** 

JavaNativeMessageDecoder in the MINA 3.0 codec module calls...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 31 Oct 2026
2 critical vulnerabilities

🔴 CVE-2026-120209 · CVSS 9.8
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens...
🔴 CVE-2026-120201 · CVSS 9.8
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to...

#CVE #Critical #Vulnerability

📰 BleepingComputer

Northflank security breach leads to abuse of customers' AI API keys

Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys. [...]

#CyberNews #Infosec

📰 BleepingComputer

New Android SMS of Death exploit can remotely crash unpatched phones

A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message. [...]

#CyberNews #Infosec

📰 BleepingComputer

From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era.

[...]

#CyberNews #Infosec

📰 BleepingComputer

Reddit to lock content behind logins to fight scrapers

Reddit announced in a post by co-founder Steve Huffman that the site will gradually become a "logged-in service," offering limited access to visitors without accounts. [...]

#CyberNews #Infosec

📰 BleepingComputer

Chainalysis discloses data breach from "offensive agentic techniques"

Blockchain analytics firm Chainalysis disclosed a data breach after attackers used "offensive agentic techniques" to access internal systems and tools, exposing customer names, email addresses, user IDs, and organizational roles. [...]

#CyberNews #Infosec

🔴 CVE Digest — 31 Oct 2026
2 critical vulnerabilities

🔴 CVE-2026-118235 · CVSS 9.8
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is...
🔴 CVE-2026-103882 · CVSS 9.1
The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 31 Oct 2026
5 critical vulnerabilities

🔴 CVE-2026-116512 · CVSS 9.8
The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker plugin for WordPress...
🔴 CVE-2026-119096 · CVSS 9.8
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and...
🔴 CVE-2026-89270 · CVSS 9.1
The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to...
🔴 CVE-2026-116557 · CVSS 9.1
The WP Booking System - Booking Calendar plugin for WordPress is vulnerable to unauthorized modification of data due to...
🔴 CVE-2026-109220 · CVSS 9.8
The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 31 Oct 2026
2 critical vulnerabilities

🔴 CVE-2026-117656 · CVSS 9.3
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth...
🔴 CVE-2026-63377 · CVSS 9.8
TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 30 Oct 2026
6 critical vulnerabilities

🔴 CVE-2026-62863 · CVSS 9.6
MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing runs in SSE mode using `-l`, its...
🔴 CVE-2026-62853 · CVSS 9.9
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts...
🔴 CVE-2026-62849 · CVSS 9.1
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the...
🔴 CVE-2026-117666 · CVSS 9.1
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary...
🔴 CVE-2026-78403 · CVSS 9.8
Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows...
🔴 CVE-2026-61850 · CVSS 9.3
Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two...

#CVE #Critical #Vulnerability

📰 Dark Reading

Behind the Scenes of How Operation Blackout Went Down

A recent law enforcement operation to dismantle harmful scam centers was a big success. A threat intelligence expert walks us through what happened and why he wants more of the same.

#CyberNews #Infosec

📰 BleepingComputer

Critical Linux kernel flaw allows remote root attacks on MPTCP servers

Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. [...]

#CyberNews #Infosec

🔴 CVE Digest — 30 Oct 2026
7 critical vulnerabilities

🔴 CVE-2026-61620 · CVSS 9.8
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other...
🔴 CVE-2026-116241 · CVSS 9.9
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the...
🔴 CVE-2026-55598 · CVSS 9.1
PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user...
🔴 CVE-2026-90888 · CVSS 9.8
Unauthenticated PHP Object Injection in LeadSnap
🔴 CVE-2026-39738 · CVSS 9.8
Unauthenticated PHP Object Injection in FunnelKit Automations
🔴 CVE-2026-39732 · CVSS 9.3
Unauthenticated SQL Injection in Transliterator
🔴 CVE-2026-119526 · CVSS 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.

This issue affects...

#CVE #Critical #Vulnerability

📰 Dark Reading

Devs Hit by Trojanized Claude Code Extension for Cursor

Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).

#CyberNews #Infosec

🔴 CVE Digest — 30 Oct 2026
3 critical vulnerabilities

🔴 CVE-2026-118697 · CVSS 9.0
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon...
🔴 CVE-2026-61826 · CVSS 10.0
Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in...
🔴 CVE-2026-112816 · CVSS 10.0
Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15,...

#CVE #Critical #Vulnerability

🔴 CVE Digest — 30 Oct 2026
10 critical vulnerabilities

🔴 CVE-2026-93327 · CVSS 9.4
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration...
🔴 CVE-2026-61738 · CVSS 10.0
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to...
🔴 CVE-2026-61737 · CVSS 9.8
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret...
🔴 CVE-2026-61730 · CVSS 9.3
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected...
🔴 CVE-2026-61729 · CVSS 9.4
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to...
🔴 CVE-2026-61728 · CVSS 9.9
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected...
🔴 CVE-2026-119660 · CVSS 9.8
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge...
🔴 CVE-2026-112905 · CVSS 9.0
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to...
🔴 CVE-2026-110799 · CVSS 9.8
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to...
🔴 CVE-2026-119706 · CVSS 9.8
InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows...

#CVE #Critical #Vulnerability

📰 Dark Reading

L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara

I ricercatori non riescono a spiegare del tutto perché le minacce informatiche in Italia siano così diverse rispetto a quelle di qualsiasi altro Paese.

#CyberNews #Infosec

📰 BleepingComputer

Trezor warns of suspected crypto-theft implant in hardware wallet

Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. [...]

#CyberNews #Infosec