🚨 CVE-2026-50152
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6
🎖@cveNotify
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds sensitive secrets including OSD LUKS disk-encryption passphrases and, on cephadm-managed clusters, the SSH private key that cephadm uses to reach every host in the cluster. Because that key grants root on every node under the default cephadm configuration, a low-privileged read-only account can escalate to full cluster and host compromise. This issue is fixed in versions 20.2.4 and 19.2.6
🎖@cveNotify
GitHub
Merge PR #2 from ceph-ghsa-rg9p-5xcp-wm8h into tentacle · ceph/ceph@d971bb2
Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
🚨 CVE-2026-61783
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. The mask_sensitive_config() decorator applies masking only when _has_update_permissions() returns false, but that gate treats a user as able to update the config whenever a manager:update_config or cluster:update_config rule exists, without ever checking whether the rule's effect is allow or deny. Because a deny rule is stored as a real entry, a read-only account that is hardened by explicitly denying config edits is counted as having update permission, which turns masking off. A single authenticated GET request to the configuration endpoint with raw=true then returns the verbatim ossec.conf XML with cluster.key in clear, whereas an otherwise identical account without the deny rule sees the value masked. This issue is fixed in version 4.14.7.
🎖@cveNotify
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is disabled by any update-config RBAC rule, including an explicit deny. The mask_sensitive_config() decorator applies masking only when _has_update_permissions() returns false, but that gate treats a user as able to update the config whenever a manager:update_config or cluster:update_config rule exists, without ever checking whether the rule's effect is allow or deny. Because a deny rule is stored as a real entry, a read-only account that is hardened by explicitly denying config edits is counted as having update permission, which turns masking off. A single authenticated GET request to the configuration endpoint with raw=true then returns the verbatim ossec.conf XML with cluster.key in clear, whereas an otherwise identical account without the deny rule sees the value masked. This issue is fixed in version 4.14.7.
🎖@cveNotify
GitHub
fix(rbac): check effect value in _has_update_permissions · wazuh/wazuh@939f2e5
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads. - fix(rbac): check effect value in _has_update_permissions · wazuh/wazuh@939f2e5
🚨 CVE-2026-67560
Bendix EC80 Brake ECU
is vulnerable to a stack-based buffer overflow, which may allow an
attacker to crash the ECU. A crafted payload can then be used to
remotely execute arbitrary code or inject arbitrary CAN bus traffic.
This could cause the loss of the ABS function, steering assist,
speedometer, and shifting.
🎖@cveNotify
Bendix EC80 Brake ECU
is vulnerable to a stack-based buffer overflow, which may allow an
attacker to crash the ECU. A crafted payload can then be used to
remotely execute arbitrary code or inject arbitrary CAN bus traffic.
This could cause the loss of the ABS function, steering assist,
speedometer, and shifting.
🎖@cveNotify
🚨 CVE-2026-68967
Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker
to deliver a payload that could establish an arbitrary write primitive,
which could crash the ECU.
🎖@cveNotify
Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker
to deliver a payload that could establish an arbitrary write primitive,
which could crash the ECU.
🎖@cveNotify
🚨 CVE-2026-69658
MQTT credentials and control traffic are transmitted in cleartext,
exposing sensitive information to network-level attackers. This may
enable unauthorized device impersonation and disruption of messaging
functions.
🎖@cveNotify
MQTT credentials and control traffic are transmitted in cleartext,
exposing sensitive information to network-level attackers. This may
enable unauthorized device impersonation and disruption of messaging
functions.
🎖@cveNotify
🚨 CVE-2026-71187
The Ebyte device relies on client side authentication logic that can be
reproduced by unauthenticated users. An attacker may generate valid
authentication requests and bypass authentication to obtain
administrative access to the device.
🎖@cveNotify
The Ebyte device relies on client side authentication logic that can be
reproduced by unauthenticated users. An attacker may generate valid
authentication requests and bypass authentication to obtain
administrative access to the device.
🎖@cveNotify
🚨 CVE-2026-73125
Ebyte device web management interface does not consistently enforce
authentication before granting access to administrative functionality.
An unauthenticated remote attacker could access sensitive configuration
information, modify device settings, or disrupt availability.
🎖@cveNotify
Ebyte device web management interface does not consistently enforce
authentication before granting access to administrative functionality.
An unauthenticated remote attacker could access sensitive configuration
information, modify device settings, or disrupt availability.
🎖@cveNotify
🚨 CVE-2026-73809
A cleartext transmission of sensitive information vulnerability exists
in certain Ebyte gateway products. The web management interface does not
adequately protect sensitive communications using transport-layer
encryption. An attacker with access to network traffic could intercept
authentication or session-related information transmitted between a user
and the affected device. Successful exploitation could result in
disclosure of sensitive information and unauthorized access to device
management functionality.
🎖@cveNotify
A cleartext transmission of sensitive information vulnerability exists
in certain Ebyte gateway products. The web management interface does not
adequately protect sensitive communications using transport-layer
encryption. An attacker with access to network traffic could intercept
authentication or session-related information transmitted between a user
and the affected device. Successful exploitation could result in
disclosure of sensitive information and unauthorized access to device
management functionality.
🎖@cveNotify
🚨 CVE-2026-73839
Administrative credentials may be exposed in plaintext within the Ebyte
device's management interface, increasing the risk of credential
compromise through visual or remote observation. This undermines the
confidentiality of device access.
🎖@cveNotify
Administrative credentials may be exposed in plaintext within the Ebyte
device's management interface, increasing the risk of credential
compromise through visual or remote observation. This undermines the
confidentiality of device access.
🎖@cveNotify
🚨 CVE-2026-75548
The affected Ebyte device web management interface does not restrict the
interface from being rendered within an external frame. An
unauthenticated remote attacker could use a crafted webpage to mislead
an authenticated administrator into initiating unintended configuration
changes or disruptive actions.
🎖@cveNotify
The affected Ebyte device web management interface does not restrict the
interface from being rendered within an external frame. An
unauthenticated remote attacker could use a crafted webpage to mislead
an authenticated administrator into initiating unintended configuration
changes or disruptive actions.
🎖@cveNotify
🚨 CVE-2026-75813
Certain configuration endpoints may lack proper server-side
authorization checks, allowing unauthorized users to access or modify
sensitive device settings. This could result in full compromise of
device functionality.
🎖@cveNotify
Certain configuration endpoints may lack proper server-side
authorization checks, allowing unauthorized users to access or modify
sensitive device settings. This could result in full compromise of
device functionality.
🎖@cveNotify
🚨 CVE-2026-75814
The Ebyte device does not adequately verify the origin or authenticity of
requests submitted to the web management interface. An unauthenticated
remote attacker could persuade an authenticated administrator to visit a
crafted page, causing unauthorized configuration changes or a
disruption of device availability.
🎖@cveNotify
The Ebyte device does not adequately verify the origin or authenticity of
requests submitted to the web management interface. An unauthenticated
remote attacker could persuade an authenticated administrator to visit a
crafted page, causing unauthorized configuration changes or a
disruption of device availability.
🎖@cveNotify
🚨 CVE-2026-76179
An improper protection of authentication tokens vulnerability exists in
certain Ebyte gateway products. Authentication tokens used by the web
management interface are insufficiently protected during client-side
session handling, which may allow an attacker with access to exposed
session information to obtain and reuse a valid token. Successful
exploitation could allow an attacker to impersonate an authenticated
user and gain unauthorized access to device management functionality.
🎖@cveNotify
An improper protection of authentication tokens vulnerability exists in
certain Ebyte gateway products. Authentication tokens used by the web
management interface are insufficiently protected during client-side
session handling, which may allow an attacker with access to exposed
session information to obtain and reuse a valid token. Successful
exploitation could allow an attacker to impersonate an authenticated
user and gain unauthorized access to device management functionality.
🎖@cveNotify
🚨 CVE-2026-76940
The affected Ebyte device does not restrict repeated authentication
attempts through rate limiting or account lockout mechanisms. This could
allow an attacker to perform automated authentication attacks against
deployments that rely on password based authentication.
🎖@cveNotify
The affected Ebyte device does not restrict repeated authentication
attempts through rate limiting or account lockout mechanisms. This could
allow an attacker to perform automated authentication attacks against
deployments that rely on password based authentication.
🎖@cveNotify
🚨 CVE-2026-76943
Xiiaozet LK100Wt contains an authentication weakness within an
administrative service that may allow an attacker to bypass intended
access controls and obtain command execution capabilities. Successful
exploitation could allow unauthorized interaction with privileged
functionality and may lead to complete device compromise.
🎖@cveNotify
Xiiaozet LK100Wt contains an authentication weakness within an
administrative service that may allow an attacker to bypass intended
access controls and obtain command execution capabilities. Successful
exploitation could allow unauthorized interaction with privileged
functionality and may lead to complete device compromise.
🎖@cveNotify
🚨 CVE-2026-76945
The affected Ebyte device relies on client-managed authentication tokens
without sufficient server-side validation. An attacker may replay or
manipulate authentication tokens to gain unauthorized access to
administrative functionality.
🎖@cveNotify
The affected Ebyte device relies on client-managed authentication tokens
without sufficient server-side validation. An attacker may replay or
manipulate authentication tokens to gain unauthorized access to
administrative functionality.
🎖@cveNotify
🚨 CVE-2026-77977
Ebyte gateway product's vendor configuration utility does not require authentication before
allowing certain disruptive administrative actions when default
credentials remain configured. An unauthenticated attacker on the
adjacent network could reboot the device or restore factory settings,
resulting in a loss of configuration and service availability.
🎖@cveNotify
Ebyte gateway product's vendor configuration utility does not require authentication before
allowing certain disruptive administrative actions when default
credentials remain configured. An unauthenticated attacker on the
adjacent network could reboot the device or restore factory settings,
resulting in a loss of configuration and service availability.
🎖@cveNotify
🚨 CVE-2026-78037
Xiiaozet LK100W is vulnerable to OS command injection through its
web-based management interface. An authenticated attacker may be able to
execute arbitrary operating system commands with elevated privileges,
potentially resulting in unauthorized access to sensitive information or
complete device compromise.
🎖@cveNotify
Xiiaozet LK100W is vulnerable to OS command injection through its
web-based management interface. An authenticated attacker may be able to
execute arbitrary operating system commands with elevated privileges,
potentially resulting in unauthorized access to sensitive information or
complete device compromise.
🎖@cveNotify
🚨 CVE-2026-82072
Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
🎖@cveNotify
Chrome Releases
Stable Channel Update for Desktop
The Stable channel has been updated to 151.0.7922.71/.72 for Windows and Mac and 151.0.7922.71 for Linux, which will roll out over the c...
🚨 CVE-2026-38822
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
🎖@cveNotify
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.
🎖@cveNotify
GitHub
Add - Error page to status.client · openNDS/openNDS@294983e
Signed-off-by: Rob White <rob@blue-wave.net>
🚨 CVE-2026-61802
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a masking control, mask_sensitive_config, that redacts sensitive fields such as authd.pass and cluster.key from configuration responses for users who lack update-config permission, and every config-read endpoint carries this decorator except GET /cluster/local/config. That endpoint, backed by read_config_wrapper, is gated only by cluster:read and returns the local node's cluster configuration including the cleartext key, whereas its siblings return the same value masked. As a result, any account with the default readonly or cluster_readonly role, which is explicitly denied update-config precisely so it cannot view secrets, receives the real cluster key. Because the cluster key authenticates and encrypts traffic between cluster nodes, disclosing it to an unprivileged account provides the authentication precondition for the cluster-peer remote code execution chains established by prior advisories. This issue is fixed in version 4.14.
🎖@cveNotify
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a masking control, mask_sensitive_config, that redacts sensitive fields such as authd.pass and cluster.key from configuration responses for users who lack update-config permission, and every config-read endpoint carries this decorator except GET /cluster/local/config. That endpoint, backed by read_config_wrapper, is gated only by cluster:read and returns the local node's cluster configuration including the cleartext key, whereas its siblings return the same value masked. As a result, any account with the default readonly or cluster_readonly role, which is explicitly denied update-config precisely so it cannot view secrets, receives the real cluster key. Because the cluster key authenticates and encrypts traffic between cluster nodes, disclosing it to an unprivileged account provides the authentication precondition for the cluster-peer remote code execution chains established by prior advisories. This issue is fixed in version 4.14.
🎖@cveNotify
GitHub
fix(cluster): mask fields in local config endpoint · wazuh/wazuh@1c55af2
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads. - fix(cluster): mask fields in local config endpoint · wazuh/wazuh@1c55af2