opsecsafe — cyber intelligence

2026-02-26

2026-02-26 18:23Z

HIGH

CVE-2026-23750 — Golioth: Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-23750

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fragment, then appends subsequent fragments using memcpy() without verifying that sufficient capacity remains. An adjacent BLE client can send unauthenticated fragments whose combined size exceeds the allocated buffer, causing a heap ov CVSSv3.1 8.1 (HIGH) · EPSS 5th percentile

CWECWE 122VNDGoliothTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-02-26

2026-02-26 16:23Z

HIGH

CVE-2025-71057 — Link: Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-71057

Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user. CVSSv3.1 8.2 (HIGH) · EPSS 4th percentile

CWECWE 345CWECWE 287CWECWE 384VNDLinkTYPVulnerability

8.2

CVSS v3.1

Edit Score

2026-02-26

2026-02-26 14:00Z

HIGH

Introducing CloudFox GCP: Attack Path Identification for Google Cloud

Bishop Fox Labs·bishopfox.com

Bishop Fox released CloudFox GCP, an offensive security enumeration tool for Google Cloud Platform that maps IAM permissions, identifies service account risks, detects storage misconfigurations, and surfaces privilege escalation and lateral movement paths across GCP organization hierarchies. The tool includes 64 modules organized across identity, storage, compute, networking, and attack path analysis categories, with planned integration to FoxMapper for advanced privilege escalation graph analysis.

TACTA0006TACTA0007SRFCloudVNDBishop FoxVNDGoogle CloudTYPResearchTYPToolSTGDiscovery

Edit Score

2026-02-26

2026-02-26 08:00Z

HIGH

A Deep Dive into the GetProcessHandleFromHwnd API

Project Zero·googleprojectzero.blogspot.comCVE-2023-41772

Project Zero researcher provides a comprehensive historical analysis of the GetProcessHandleFromHwnd Windows API across Vista through Windows 11 24H2, documenting how it evolved from a hook-based implementation to a kernel function and the security implications of each version. The post details a critical vulnerability (CVE-2023-41772) in Windows 10 and pre-24H2 Windows 11 that allowed bypassing protected process isolation via UIPI checks, and demonstrates a practical attack chain to hijack Protected TCB processes like WerFaultSecure.exe. Microsoft's fixes in 24H2 introduce feature flags to enforce UIPI permanently and restrict the API to UI Access-enabled callers, though workarounds exist for systems with UIPI disabled.

SRFOsTACTA0004TACTA0005VNDMicrosoftTYPResearchTYPWriteupSTGDefense EvasionSTGPrivesc

Edit Score

2026-02-26

2026-02-26 01:16Z

HIGH

CVE-2026-27830 — JDBC: c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27830

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDat CVSSv3.1 8.0 (HIGH)

CWECWE 94CWECWE 502VNDJdbcTYPVulnerability

8.0

CVSS v3.1

Edit Score

2026-02-26

2026-02-26 01:16Z

HIGH

ShimBad the Sailor, Part 3

Hexacorn·hexacorn.com

Hexacorn documents Windows 11 shim database enhancements including newly tracked process names (SdbMergeTestEntry_Added_Exe_Item.exe variants) and plugin directory structures (%windir%\apppatch\AcPluginDlls\) with test DLLs present across multiple architectures. The research identifies potential persistence and code injection vectors through underdocumented shim plugin mechanisms in apphelp.dll, pcasvc.dll, and appraiser.dll.

SRFOsTACTA0005TACTA0003VNDMicrosoftTYPResearchSTGDefense EvasionSTGPersistenceTECT1547.009

Edit Score

2026-02-26

2026-02-26 00:00Z

CRIT

Cisco SD-WAN vulnerabilities (CVE-2026-20127, CVE-2022-20775) in active exploitation

Sophos X-Ops·news.sophos.comCVE-2026-20127 CVE-2022-20775in the wild0day

Cisco SD-WAN vulnerabilities CVE-2026-20127 and CVE-2022-20775 are under active exploitation targeting federal networks, with CISA issuing an emergency directive. CVE-2026-20127 permits unauthenticated remote attackers to bypass authentication and gain admin access; CVE-2022-20775 enables authenticated local privilege escalation. Sophos has released IPS signatures for detection.

TACTA0004TACTA0001SRFNetwork ApplianceVNDCiscoTYPVulnerabilityTYPThreat IntelSTGPrivescSTGInitial Access

Edit Score

2026-02-25

2026-02-25 23:16Z

CRIT

CVE-2026-27577 — N8n N8n: is an open source workflow automation platform.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27577

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse crafted expressions in workflow parameters to trigger unintended system command execution on the host running n8n. The issues have been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. CVSSv3.1 9.9 (CRITICAL) · EPSS 95th percentile

CWECWE 94VNDN8nTYPVulnerability

9.9

CVSS v3.1

100

Edit Score

2026-02-25

2026-02-25 23:00Z

HIGH

Intego X9: Why your macOS antivirus should not trust PIDs

Quarkslab·blog.quarkslab.com

Quarkslab published a detailed reverse-engineering analysis of Intego X9 antivirus on macOS, demonstrating a PID-reuse race condition that bypasses XPC authentication checks. The vulnerability exploits the NTGCodeSigningVerifier class's reliance on process identifiers rather than audit tokens, allowing unprivileged code to impersonate trusted Intego processes and escalate privileges. The research includes static analysis via Ghidra, dynamic debugging with Frida, and proof-of-concept exploitation techniques.

SRFApplicationSRFOsTACTA0004TACTA0005VNDIntegoTYPResearchTYPWriteupTYPVulnerability

Edit Score

2026-02-25

2026-02-25 22:16Z

CRIT

CVE-2026-27148 — Storybook Storybook: Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27148

Storybook is a frontend workshop for building user interface components and pages in isolation. Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the Storybook dev server; production builds are not impacted. Exploitation requires a developer to visit a malicious website while their local Storybook dev server is ru CVSSv3.1 9.6 (CRITICAL)

CWECWE 74CWECWE 79CWECWE 346VNDStorybookTYPVulnerability

9.6

CVSS v3.1

Edit Score

2026-02-25

2026-02-25 21:16Z

HIGH

CVE-2026-26965 — Freerdp Freerdp: A malicious RDP server can exploit this to perform a heap out-of-bounds write with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-26965

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, in the RLE planar decode path, `planar_decompress_plane_rle()` writes into `pDstData` at `((nYDst+y) * nDstStep) + (4*nXDst) + nChannel` without verifying that `(nYDst+nSrcHeight)` fits in the destination height or that `(nXDst+nSrcWidth)` fits in the destination stride. When `TempFormat != DstFormat`, `pDstData` becomes `planar->pTempData` (sized for the desktop), while `nYDst` is only CVSSv3.1 8.8 (HIGH)

CWECWE 787VNDFreerdpTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-02-25

2026-02-25 21:16Z

HIGH

CVE-2026-26955 — Freerdp Freerdp: Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-26955

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCodec surface command with an out-of-bounds destination rectangle. The `gdi_SurfaceCommand_ClearCodec()` handler does not call `is_within_surface()` to validate the command rectangle against the destination surface dimensions, allowing a CVSSv3.1 8.8 (HIGH)

CWECWE 787CWECWE 805VNDFreerdpTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-02-25

2026-02-25 20:06Z

CRIT

Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))

watchTowr Labs·labs.watchtowr.comCVE-2025-40552 CVE-2025-40553 CVE-2025-40554 CVE-2024-28986 CVE-2024-28988 CVE-2025-26399in the wild0day

watchTowr Labs disclosed three new pre-authentication vulnerabilities in SolarWinds Web Help Desk (CVE-2025-40552, CVE-2025-40553, CVE-2025-40554) that chain together to achieve unauthenticated RCE on fully patched instances. The vulnerabilities exploit deserialization flaws in the legacy Java WebObjects framework and bypass existing security patches through encoding tricks and parser differential analysis. This represents the fourth major deserialization RCE chain in the product since 2024, with prior patches (CVE-2024-28986, CVE-2024-28988, CVE-2025-26399) all bypassed through similar mechanisms.

SRFApplicationTACTA0001TACTA0002SRFWebVNDSolarwindsTYPWriteupTYPExploitTYPVulnerability

Edit Score

2026-02-25

2026-02-25 17:25Z

CRIT

CVE-2026-27727 — Mchange Mchange_commons_java: mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27727

mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked within a running application. If an attacker can provoke an application to read a maliciously crafted `jaxax.naming.Reference` or serialized object, they can provoke the download and execution of malicious code. Implementations of this functi CVSSv3.1 9.8 (CRITICAL)

CWECWE 502CWECWE 74VNDMchangeTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-02-25

2026-02-25 17:25Z

CRIT

CVE-2026-20127 — Cisco Catalyst_sd-wan_manager: A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-20127in the wild

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system. This vulnerability exists because the peering authentication mechanism in an affected system is not working properly. An CVSSv3.1 10.0 (CRITICAL) · EPSS 99th percentile

CWECWE 287VNDCiscoTYPVulnerabilitySTAitw exploited

10.0

CVSS v3.1

100

Edit Score

2026-02-25

2026-02-25 17:00Z

HIGH

Nemesis 2.2

SpecterOps·specterops.io

SpecterOps released Nemesis 2.2, a major update to their file enrichment and triage platform with significant new capabilities for processing large forensic containers (disk images), LLM-powered agents for automated triage and analysis, and comprehensive DPAPI decryption support for Chromium-based browsers. The release emphasizes both offensive and defensive use cases, with 10-30x performance improvements in text file processing and new functionality for extracting credentials, analyzing .NET assemblies, and handling modern browser encryption schemes including Chrome's v3 app-bound encryption.

SRFApplicationSRFOsTACTA0006TACTA0007VNDSpecteropsTYPResearchTYPToolSTGCred Access

Edit Score

2026-02-25

2026-02-25 13:16Z

CRIT

CVE-2026-2624 — Epati Antikor_next_generation_firewall: Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2624

Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall (NGFW) allows Authentication Bypass. This issue affects Antikor Next Generation Firewall (NGFW): from v.2.0.1298 before v.2.0.1301. CVSSv3.1 9.8 (CRITICAL) · EPSS 86th percentile

CWECWE 306VNDEpatiTYPVulnerability

9.8

CVSS v3.1

100

Edit Score

2026-02-25

2026-02-25 12:00Z

INFO

mquire: Linux memory forensics without external dependencies

Trail of Bits·blog.trailofbits.com

Trail of Bits open-sourced mquire, a Linux memory forensics tool that eliminates the need for external debug symbols by extracting type information from BTF (BPF Type Format) and symbol addresses from Kallsyms directly within memory dumps. The tool provides SQL-based querying of kernel structures including processes, open files, memory mappings, and network connections, supporting kernel 4.18+ with BTF and 6.4+ with Kallsyms.

SRFOsTACTA0007OSLinuxTYPResearchTYPToolSTGDiscoverySTGCollection

Edit Score

2026-02-25

2026-02-25 03:16Z

HIGH

CVE-2026-27608 — Parseplatform Parse_dashboard: In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) does not

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27608

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) does not enforce authorization. Authenticated users scoped to specific apps can access any other app's agent endpoint by changing the app ID in the URL. Read-only users are given the full master key instead of the read-only master key and can supply write permissions in the request body to perform wri CVSSv3.1 8.1 (HIGH) · EPSS 12th percentile

CWECWE 862VNDParseplatformVNDParseTYPVulnerability

8.1

CVSS v3.1

Edit Score

2026-02-25

2026-02-25 03:16Z

CRIT

CVE-2026-27606 — Rollupjs Rollup: Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-27606

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output filenames (e.g., via CLI named inputs, manual chunk aliases, or malicious plugins) and use traversal sequences (`../`) to overwrite files anywhere on the host files CVSSv3.1 9.8 (CRITICAL)

CWECWE 22VNDRollupjsVNDRollupTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-02-24

2026-02-24 16:24Z

HIGH

CVE-2025-63409 — Gcomtw Gcom_epon_1ge_firmware: Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-63409

Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to modify administrator only settings and extract administrator credentials. CVSSv3.1 8.8 (HIGH) · EPSS 21th percentile

CWECWE 284VNDGcomtwTYPVulnerability

8.8

CVSS v3.1

Edit Score

2026-02-24

2026-02-24 14:16Z

CRIT

CVE-2026-2807 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2807

Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148 and Thunderbird 148. CVSSv3.1 9.8 (CRITICAL)

CWECWE 787VNDMozillaTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-02-24

2026-02-24 14:16Z

CRIT

CVE-2026-2806 — Mozilla Firefox: Uninitialized memory in the Graphics: Text component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2806

Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. CVSSv3.1 9.1 (CRITICAL)

CWECWE 908CWECWE 457VNDMozillaVNDUninitializedTYPVulnerability

9.1

CVSS v3.1

Edit Score

2026-02-24

2026-02-24 14:16Z

CRIT

CVE-2026-2805 — Mozilla Firefox: Invalid pointer in the DOM: Core & HTML component.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2805

Invalid pointer in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148. CVSSv3.1 9.8 (CRITICAL)

CWECWE 824VNDMozillaVNDInvalidTYPVulnerability

9.8

CVSS v3.1

Edit Score

2026-02-24

2026-02-24 14:16Z

CRIT

CVE-2026-2800 — Mozilla Firefox: Spoofing issue in the WebAuthn component in Firefox for Android.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2026-2800

Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 148 and Thunderbird 148. CVSSv3.1 9.8 (CRITICAL)

CWECWE 290VNDMozillaVNDSpoofingTYPVulnerability

9.8

CVSS v3.1

Edit Score

Latest intel// live feed

CVE-2026-23750 — Golioth: Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in

CVE-2025-71057 — Link: Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows

Introducing CloudFox GCP: Attack Path Identification for Google Cloud

A Deep Dive into the GetProcessHandleFromHwnd API

CVE-2026-27830 — JDBC: c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized

ShimBad the Sailor, Part 3

Cisco SD-WAN vulnerabilities (CVE-2026-20127, CVE-2022-20775) in active exploitation

CVE-2026-27577 — N8n N8n: is an open source workflow automation platform.

Intego X9: Why your macOS antivirus should not trust PIDs

CVE-2026-27148 — Storybook Storybook: Prior to versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10, the WebSocket functionality in Storybook's dev

CVE-2026-26965 — Freerdp Freerdp: A malicious RDP server can exploit this to perform a heap out-of-bounds write with

CVE-2026-26955 — Freerdp Freerdp: Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow

Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))

CVE-2026-27727 — Mchange Mchange_commons_java: mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of

CVE-2026-20127 — Cisco Catalyst_sd-wan_manager: A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart

Nemesis 2.2

CVE-2026-2624 — Epati Antikor_next_generation_firewall: Missing Authentication for Critical Function vulnerability in ePati Cyber ​​Security Technologies Inc.

mquire: Linux memory forensics without external dependencies

CVE-2026-27608 — Parseplatform Parse_dashboard: In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /apps/:appId/agent`) does not

CVE-2026-27606 — Rollupjs Rollup: Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x

CVE-2025-63409 — Gcomtw Gcom_epon_1ge_firmware: Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated

CVE-2026-2807 — Mozilla Firefox: Some of these bugs showed evidence of memory corruption and we presume that with

CVE-2026-2806 — Mozilla Firefox: Uninitialized memory in the Graphics: Text component.

CVE-2026-2805 — Mozilla Firefox: Invalid pointer in the DOM: Core & HTML component.

CVE-2026-2800 — Mozilla Firefox: Spoofing issue in the WebAuthn component in Firefox for Android.

CVE-2026-2624 — Epati Antikor_next_generation_firewall: Missing Authentication for Critical Function vulnerability in ePati Cyber Security Technologies Inc.