Aggregator

CISA Admin Leaked AWS GovCloud Keys on Github

Krebs on Security
4 weeks 1 day ago
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.
BrianKrebs

Grafana confirms GitHub token breach cybercrime group claims the attack

Security Affairs
4 weeks 1 day ago
Grafana confirmed a GitHub token breach that exposed source code, but said no customer data or systems were affected. Grafana Labs confirmed a security incident after the extortion group Coinbase Cartel listed it on a leak site and claimed data theft on May 15. The breach was triggered by a compromised token that gave attackers […]
Pierluigi Paganini

CVE-2026-42822 | Microsoft Azure Local/Azure Resource Manager improper authentication

VulDB Recent Entries
4 weeks 1 day ago
A vulnerability categorized as critical has been discovered in Microsoft Azure Local and Azure Resource Manager. This affects an unknown part. Executing a manipulation can lead to improper authentication. This vulnerability appears as CVE-2026-42822. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.
vuldb.com

CVE-2023-24215 | NOVUS AirGate 4G Firmware 1.1.16 POST Request /uci/get/ access control

VulDB Recent Entries
4 weeks 1 day ago
A vulnerability was found in NOVUS AirGate 4G Firmware 1.1.16. It has been rated as critical. Affected by this issue is some unknown functionality of the file /uci/get/ of the component POST Request Handler. Performing a manipulation results in improper access controls. This vulnerability is reported as CVE-2023-24215. The attack is possible to be carried out remotely. No exploit exists.
vuldb.com

CVE-2026-45230 | DumbWareio DumbAssets up to 1.0.11 /api/delete-file path traversal (EUVD-2026-30790)

VulDB Recent Entries
4 weeks 1 day ago
A vulnerability was found in DumbWareio DumbAssets up to 1.0.11. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/delete-file. Such manipulation leads to path traversal. This vulnerability is documented as CVE-2026-45230. The attack can be executed remotely. There is not any exploit available. Applying a patch is advised to resolve this issue.
vuldb.com

CVE-2026-8843 | MongoDB Server up to 7.0.31/8.0.20/8.2.5 2dsphere_bucket Index assertion

VulDB Recent Entries
4 weeks 1 day ago
A vulnerability was found in MongoDB Server up to 7.0.31/8.0.20/8.2.5. It has been classified as problematic. Affected is an unknown function of the component 2dsphere_bucket Index Handler. This manipulation causes reachable assertion. This vulnerability is registered as CVE-2026-8843. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.
vuldb.com

CVE-2026-32849 | NetBSD Compression cryptodev.c cryptodev_op dst_len integer overflow

VulDB Recent Entries
4 weeks 1 day ago
A vulnerability was found in NetBSD and classified as problematic. This impacts the function cryptodev_op of the file sys/opencrypto/cryptodev.c of the component Compression Handler. The manipulation of the argument dst_len results in integer overflow. This vulnerability is cataloged as CVE-2026-32849. The attack must be initiated from a local position. There is no exploit available. It is best practice to apply a patch to resolve this issue.
vuldb.com

Managed ad