opsecsafe — cyber intelligence

2026-05-21

2026-05-21 13:16Z

HIGH

CVE-2026-43495 — Linux: A modem sending port_count=65535 in a 12-byte buffer triggers a slab-out-of-bounds read of up

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-43495

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler t7xx_port_enum_msg_handler() uses the modem-supplied port_count field as a loop bound over port_msg->data[] without checking that the message buffer contains sufficient data. A modem sending port_count=65535 in a 12-byte buffer triggers a slab-out-of-bounds read of up to 262140 bytes. Add a sizeof(*port_msg) check bef CVSSv3.1 8.8 (HIGH)

TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 13:00Z

HIGH

Q1 2026 Threat Landscape Report: Zero-clicks, geopolitical tensions, and some wins for law enforcement

Rapid7 Research·rapid7.comCVE-2026-20182in the wild

Rapid7's Q1 2026 Threat Landscape Report reveals that vulnerability exploitation (38% of initial access) has surpassed social engineering, with over 50% of exploited vulnerabilities being zero-click network-facing flaws requiring no authentication. Geopolitical tensions drove coordinated state-sponsored campaigns targeting infrastructure and persistent access, while law enforcement disrupted major ransomware marketplaces (RAMP, LeakBase), pushing threat actors toward decentralized operations and pure extortion tactics focused on data theft over encryption.

SRFApplicationTACTA0001TACTA0002SRFNetworkTACTA0006TACTA0007TACTA0010VNDCisco

Edit Score

2026-05-21

2026-05-21 10:16Z

HIGH

CVE-2026-45253 — PT_SC_REMOTE: As a result, a user with the ability to debug a process may trigger

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-45253

ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to debug a process may trigger arbitrary code execution in the kernel, even if the target process has no special privileges. The missing validation allows an unprivileged local user to escalate privileges, potentially gaining full control of the affected system. CVSSv3.1 8.4 (HIGH)

CWECWE 787VNDPt Sc RemoteTYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 10:16Z

HIGH

CVE-2026-39461 — libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-39461

libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024). An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, ma CVSSv3.1 8.8 (HIGH)

CWECWE 121TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 09:16Z

HIGH

CVE-2026-9157 — Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9157

Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion. This issue affects Web Fax: from 3.0 before 3.1. CVSSv3.1 8.4 (HIGH)

CWECWE 434CWECWE 20TYPVulnerability

8.4

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 09:16Z

CRIT

CVE-2026-5433 — Honeywell: Control Network Module (CNM) contains command injection vulnerability in the web interface.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-5433

Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remote Code Execution (RCE). CVSSv3.1 9.1 (CRITICAL)

VNDHoneywellTYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 09:16Z

HIGH

CVE-2026-4858 — Mattermost: versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-4858

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL.. Mattermost Advisory ID: MMSA-2026-00640 CVSSv3.1 8.0 (HIGH)

CWECWE 22VNDMattermostTYPVulnerability

8.0

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 08:16Z

HIGH

CVE-2026-44051 — Netatalk: In Netatalk 3.0.2 through 4.4.2, arbitrary file read via attacker-controlled symlink creation.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44051

In Netatalk 3.0.2 through 4.4.2, arbitrary file read via attacker-controlled symlink creation. Fixed in 4.4.3. CVSSv3.1 8.1 (HIGH)

CWECWE 59VNDNetatalkTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 08:16Z

CRIT

CVE-2026-44050 — Netatalk: In Netatalk 2.0.0 through 4.4.2, heap buffer overflow in cnid daemon comm_rcv().

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44050

In Netatalk 2.0.0 through 4.4.2, heap buffer overflow in cnid daemon comm_rcv(). Fixed in 4.4.3. CVSSv3.1 9.9 (CRITICAL)

CWECWE 122VNDNetatalkTYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2026-05-21

2026-05-21 08:16Z

HIGH

CVE-2026-44048 — Netatalk: In Netatalk 2.0.4 through 4.4.2, stack buffer overflow via ucs-2 type confusion in convert_charset().

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44048

In Netatalk 2.0.4 through 4.4.2, stack buffer overflow via ucs-2 type confusion in convert_charset(). Fixed in 4.4.3. CVSSv3.1 8.8 (HIGH)

CWECWE 121VNDNetatalkTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 08:16Z

HIGH

CVE-2026-44047 — Netatalk: In Netatalk 3.1.0 through 4.4.2, sql injection in mysql cnid backend.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-44047

In Netatalk 3.1.0 through 4.4.2, sql injection in mysql cnid backend. Fixed in 4.4.3. CVSSv3.1 8.8 (HIGH)

CWECWE 89VNDNetatalkTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 05:16Z

CRIT

CVE-2026-6279 — Avada: The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-6279

The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Conditional_Render_Helper::get_value()` passing attacker-controlled values from a base64-decoded JSON blob directly to `call_user_func()` without any allowlist validation. This is exploitable by unauthenticated attackers through the `fus CVSSv3.1 9.8 (CRITICAL)

CWECWE 74VNDAvadaTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 02:16Z

CRIT

CVE-2026-48172 — Litespeedtech Litespeed_cpanel_plugin: LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-48172

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /var/cpanel/logs /usr/local/cpanel/logs/ 2>/dev/null in Bash. If you get no output, you have not been hit with exploitation of the vulnerability. If there is output, we recommend you examine the IP addresses in the list, determine if they are valid IP addresses, CVSSv3.1 9.8 (CRITICAL)

CWECWE 266VNDLitespeedtechVNDLitespeedTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 00:16Z

HIGH

CVE-2026-40165 — Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-40165

authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass through SAML NameID XML Comment Injection. Due to how authentik extracted the NameID value from a SAML assertion, it was possible for an attacker to trick authentik into only seeing a part of the NameID value, potentially allowing an attacker to gain access to other accounts. This issue could be exploited on an authen CVSSv3.1 8.7 (HIGH)

CWECWE 287CWECWE 436CWECWE 91TYPVulnerability

8.7

CVSS v3.1

Edit Score

2026-05-21

2026-05-21 00:00Z

HIGH

One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign

Trend Micro Research·trendmicro.com

Trend Micro disclosed a 5-year influence and fraud campaign run by a solo Russian-speaking threat actor (bandcampro) targeting QAnon/MAGA communities via Telegram. Starting September 2025, the actor weaponized a jailbroken Google Gemini LLM to automate content generation, credential theft via a fake crypto wallet (GoToResolve RAT), WordPress admin brute-forcing, and a QFS-themed chatbot for pump-and-dump cryptocurrency fraud. The campaign compromised 29 WordPress accounts, infiltrated at least one company, and emptied victim crypto wallets, while demonstrating how frontier-AI guardrails can be bypassed through jailbreaking and non-English prompting.

TACTA0001TACTA0002TACTA0006TACTA0007SRFIdentitySRFWebTACTA0003SRFAi

Edit Score

2026-05-20

2026-05-20 22:16Z

CRIT

CVE-2026-47372 — Crypt: Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-47372

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography. CVSSv3.1 9.1 (CRITICAL)

CWECWE 338VNDCryptTYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-05-20

2026-05-20 21:16Z

CRIT

CVE-2026-8631 — Hp Linux_imaging_and_printing: This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-8631

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an integer overflow in the hpcups processing path when handling crafted print data. CVSSv3.1 9.8 (CRITICAL)

CWECWE 122CWECWE 190VNDHpTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-20

2026-05-20 21:07Z

CRIT

Investigating unauthorized access to GitHub’s internal repositories

GitHub Security·github.blogin the wild

GitHub disclosed a May 18, 2026 compromise of an employee device via a poisoned third-party VS Code extension, resulting in exfiltration of approximately 3,800 internal repositories. The attacker gained access to GitHub-internal data including customer support excerpts, but no evidence of direct impact to customer repositories or external systems. GitHub rotated critical secrets and is conducting ongoing investigation with a full report to follow.

TACTA0001TACTA0006TACTA0009SRFSupply ChainVNDGithubTYPThreat IntelSTGInitial AccessSTGCred Access

Edit Score

2026-05-20

2026-05-20 20:16Z

CRIT

CVE-2026-9141 — Taiko: AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9141

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unauthenticated attackers to access internal application pages without any session management or server-side authentication checks. Attackers with network access can directly request internal resources such as index.zhtml, point.zhtml, and log.shtml to gain full administrative read and write access, enabling unauthorized CVSSv3.1 9.8 (CRITICAL)

CWECWE 306VNDTaikoTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-20

2026-05-20 20:16Z

CRIT

CVE-2026-9139 — Taiko: AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9139

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static plaintext credentials in the page source. Unauthenticated attackers with network access can recover administrative credentials directly from the client-side validate() function to obtain full administrative access to the device. CVSSv3.1 9.8 (CRITICAL)

CWECWE 798VNDTaikoTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-05-20

2026-05-20 20:16Z

HIGH

CVE-2026-9126 — Use: after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9126

Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-05-20

2026-05-20 20:16Z

HIGH

CVE-2026-9121 — Out: of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9121

Out of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) CVSSv3.1 8.8 (HIGH)

CWECWE 125TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-05-20

2026-05-20 20:16Z

HIGH

CVE-2026-9120 — Use: after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9120

Use after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-05-20

2026-05-20 20:16Z

HIGH

CVE-2026-9119 — Heap: buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9119

Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH)

CWECWE 122VNDHeapTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-05-20

2026-05-20 20:16Z

HIGH

CVE-2026-9118 — Use: after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-9118

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) CVSSv3.1 8.8 (HIGH)

CWECWE 416TYPVulnerability

8.8

CVSS v3.1

Edit Score

Latest intel// live feed

CVE-2026-43495 — Linux: A modem sending port_count=65535 in a 12-byte buffer triggers a slab-out-of-bounds read of up

Q1 2026 Threat Landscape Report: Zero-clicks, geopolitical tensions, and some wins for law enforcement

CVE-2026-45253 — PT_SC_REMOTE: As a result, a user with the ability to debug a process may trigger

CVE-2026-39461 — libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system

CVE-2026-9157 — Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web

CVE-2026-5433 — Honeywell: Control Network Module (CNM) contains command injection vulnerability in the web interface.

CVE-2026-4858 — Mattermost: versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14

CVE-2026-44051 — Netatalk: In Netatalk 3.0.2 through 4.4.2, arbitrary file read via attacker-controlled symlink creation.

CVE-2026-44050 — Netatalk: In Netatalk 2.0.0 through 4.4.2, heap buffer overflow in cnid daemon comm_rcv().

CVE-2026-44048 — Netatalk: In Netatalk 2.0.4 through 4.4.2, stack buffer overflow via ucs-2 type confusion in convert_charset().

CVE-2026-44047 — Netatalk: In Netatalk 3.1.0 through 4.4.2, sql injection in mysql cnid backend.

CVE-2026-6279 — Avada: The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution

CVE-2026-48172 — Litespeedtech Litespeed_cpanel_plugin: LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited

CVE-2026-40165 — Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass

One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign

CVE-2026-47372 — Crypt: Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.

CVE-2026-8631 — Hp Linux_imaging_and_printing: This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an

Investigating unauthorized access to GitHub’s internal repositories

CVE-2026-9141 — Taiko: AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass

CVE-2026-9139 — Taiko: AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential

CVE-2026-9126 — Use: after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a

CVE-2026-9121 — Out: of bounds read in GPU in Google Chrome on prior to 148.0.7778.179 allowed

CVE-2026-9120 — Use: after free in WebRTC in Google Chrome prior to 148.0.7778.179 allowed a remote

CVE-2026-9119 — Heap: buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a

CVE-2026-9118 — Use: after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed