Aggregator

A vulnerability has been found in taosdata TDengine up to 3.4.1.14 and classified as problematic. The impacted element is the function mndProcessKillSsMigrateReq of the component Shared-Storage Migration. This manipulation causes improper authentication. This vulnerability is registered as CVE-2026-62348. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as very critical, was found in taosdata TDengine up to 3.4.1.14. The affected element is an unknown function of the component UDF Management. The manipulation results in permission issues. This vulnerability is cataloged as CVE-2026-62355. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in taosdata TDengine 3.4.1.5/3.4.1.6/3.4.1.14. Impacted is the function transDecompressMsg of the file source/libs/transport/src/transComm.c of the component Transport. The manipulation of the argument comp leads to out-of-bounds read. This vulnerability is listed as CVE-2026-62351. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as critical was found in cap-js cap-js and cds-dbs 2.2.2/2.2.2/2.10.1. This issue affects some unknown processing of the component Database Service. Executing a manipulation can lead to sql injection. This vulnerability is tracked as CVE-2026-46421. The attack can be launched remotely. No exploit exists.

A vulnerability classified as critical has been found in taosdata TDengine up to 3.4.1.14. This vulnerability affects the function eval. Performing a manipulation results in unrestricted upload. This vulnerability is identified as CVE-2026-62350. The attack can be initiated remotely. There is not any exploit available.

A vulnerability described as critical has been identified in taosdata TDengine up to 3.4.1.13. This affects the function tGetToken of the file source/libs/parser/src/parTokenizer.c of the component SQL Parser. Such manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-62353. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as problematic has been reported in AWS jsii up to 1.130.x. Affected by this issue is some unknown functionality of the component npm package loading. This manipulation of the argument Source causes os command injection. The identification of this vulnerability is CVE-2026-15895. The attack can only be executed locally. There is no exploit available.

A vulnerability labeled as very critical has been found in taosdata TDengine up to 3.4.1.6. Affected by this vulnerability is the function trimString of the file source/libs/parser/src/parUtil.c of the component Parser. The manipulation results in out-of-bounds write. This vulnerability was named CVE-2026-62349. The attack may be performed from remote. There is no available exploit.

Стартап из США создаёт автономный рой, который ищет насекомых по звуку крыльев и атакует в воздухе.

Submit #844299 / VDB-379368

Submit #835656 / VDB-379367

US and allies warn of Russian APT groups targeting routers and network devices to compromise critical infrastructure worldwide. The US and allied governments warn that Russian state-sponsored APT groups are scanning and exploiting poorly secured network devices, especially routers, to access critical infrastructure. Groups linked to FSB Center 16, including Berserk Bear, Energetic Bear, Ghost […]

Researchers said the vulnerabilities, which attackers are chaining together, were first exploited three weeks before the vendor disclosed and patched the defects.

The post SonicWall customers under threat as attackers exploit 2 zero-days appeared first on CyberScoop.

These CIS Benchmarks and CIS Build Kits have been updated or recently released and include a full changelog that references all changes.

Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things (IoT) botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model (LLM), albeit with not so successful results. "While the AI complied with their request to generate botnet code, it included a safety disclaimer that the developer failed

Destiny Stealer activity is rising across Europe and the US, putting corporate accounts, remote access, email data, and sensitive business information at risk. A single infected endpoint can expose passwords, session cookies, VPN details, Outlook data, cryptocurrency wallets, Wi-Fi profiles, and desktop screenshots.  For security leaders, the biggest concern is delayed visibility. some samples had […]

The post Hackers Expanding Destiny Stealer Across the US and Europe. Is Your Organization Ready to Defend?  appeared first on Cyber Security News.

A Russian-speaking threat actor known as "bandcampro" used Google's open-source Gemini CLI AI tool as a hacking agent and to operate a small-scale botnet. [...]