THREAT OPS › Threat News

Threat Intelligence News

11576 reports from 110+ open cyber-threat-intelligence sources — APT activity, malware, vulnerabilities and campaigns, newest first.

[NVD] CVE-2026-80976 (CRITICAL 9.8) — In the Linux kernel, the following vulnerability has been resolved: seg6: reset IP6CB after IPv6 decapsulation decap_and_validate() pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsinvd · 2026-09-11
[NVD] CVE-2026-80975 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: mfd: qnap-mcu: keep the reply buffer alive past a command timeout qnap_mcu_exec() publishes an on-stack buffer to the receive path: unsigned char rx[QNAP_MCU_RX_BUFFER_SIZE]; ... reply->data = rx; reply->lnvd · 2026-09-11
[NVD] CVE-2026-80972 — In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Check card index validity at probe aloop driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates at nvd · 2026-09-11
[NVD] CVE-2026-80971 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: clear the URB pointers on disconnect bcd2000_free_usb_related_resources() frees both URBs and leaves the pointers behind: usb_kill_urb(bcd2k->midi_out_urb); usb_kill_urb(bcd2k->midi_in_urb); nvd · 2026-09-11
[NVD] CVE-2026-80969 — In the Linux kernel, the following vulnerability has been resolved: ALSA: mpu401: Check card index validity at probe mpu401 driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself creates anvd · 2026-09-11
[NVD] CVE-2026-80968 — In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: Check card index validity at probe Although mts64 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as "none" or such value when bound via snvd · 2026-09-11
[NVD] CVE-2026-80967 (HIGH 8.4) — In the Linux kernel, the following vulnerability has been resolved: ALSA: pcxhr: initialize mutexes before requesting threaded IRQ pcxhr_probe() requests pcxhr_threaded_irq() before initializing mgr->lock, even though the threaded handler takes that mutex. Initialize the managnvd · 2026-09-11
[NVD] CVE-2026-80966 — In the Linux kernel, the following vulnerability has been resolved: ALSA: portman2x4: Check card index validity at probe Although portman2x4 driver has a check of the given devptr->id value, it doesn't check for a negative id, which is often given as "none" or such value when bnvd · 2026-09-11
[NVD] CVE-2026-80965 — In the Linux kernel, the following vulnerability has been resolved: ALSA: serial-u16550: Check card index validity at probe serial-u16550 driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itnvd · 2026-09-11
[NVD] CVE-2026-80964 — In the Linux kernel, the following vulnerability has been resolved: ALSA: virmidi: Check card index validity at probe virmidi driver blindly trusts that the given devptr->id value is within the proper card index range at probe. It's OK for the devices the driver itself createsnvd · 2026-09-11
[NVD] CVE-2026-80962 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate geometry fields from on-disk cache_info cache_segs_init() iterates cache_info->n_segs times indexing cache->segments[], which is sized to the cache device geometry, and get_seg_id() takes eanvd · 2026-09-11
[NVD] CVE-2026-80961 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: dm-pcache: validate kset key_num and intra-segment bounds Two more fields decoded from the cache device go unbounded. The kset key_num drives cache_kset_crc() and the replay loop in cache_replay(), the writebacnvd · 2026-09-11
[NVD] CVE-2026-80959 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the persisted tail-position offset cache_pos_decode() takes the persisted key_tail and dirty_tail seg_off from the cache device and addresses within the segment with it. A seg_off at or past thnvd · 2026-09-11
[NVD] CVE-2026-80958 (HIGH 7.1) — In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cache_replay(), the writeback worker and the GC worker bounds its length by PCACHE_SEG_SIZE - seg_off, the raw segment size rnvd · 2026-09-11
[NVD] CVE-2026-80955 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: dm-pcache: fix use-after-free and invalid seg operations in kset_replay() In kset_replay, when key->seg_gen is stale (key->seg_gen < key->cache_pos.cache_seg->gen), cache_key_put(key) is called but then key->canvd · 2026-09-11
[NVD] CVE-2026-80954 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() i3c_device_get_supported_xfer_mode() uses dev->desc to obtain the master controller. However, dev->desc must not be dereferencnvd · 2026-09-11
[NVD] CVE-2026-80953 (HIGH 8.4) — In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the controller's IBI state, transfer queue list and transfer queunvd · 2026-09-11
[NVD] CVE-2026-80952 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix info leak and UAF in device unregister path i3c_master_unregister_i3c_devs() clears i3cdev->dev->desc before calling device_unregister(). During device_unregister(), device_del() emits a KOBJ_nvd · 2026-09-11
[NVD] CVE-2026-80950 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesas_i3c_xfer, enqueues it, and waits for completionvd · 2026-09-11
[NVD] CVE-2026-80948 — In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() In iwl_op_mode_dvm_start(), jumping to out_free_eeprom currently bypasses the out_free_eeprom_blob label. Consequently, error paths triggered afternvd · 2026-09-11
[NVD] CVE-2026-80947 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop rtl8xxxu arms rx_urb_wq from the RX completion path: rtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_rx_urb(), which queues it on rx_urb_pending_nvd · 2026-09-11
[NVD] CVE-2026-80945 (CRITICAL 9.1) — In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - unmap dst before software fallback on decompress On a hardware analytics error, decompress retries through the software fallback, which writes req->dst with the CPU while it is still mapped DMA_FRnvd · 2026-09-11
[NVD] CVE-2026-80944 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Detach sync cmd buffer on interrupted wait mwifiex synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there. If wait_evnvd · 2026-09-11
[NVD] CVE-2026-80943 (HIGH 7.6) — In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids rtl92du_tx_fill_desc() uses ieee80211_get_tid() to read the QoS TID from the 802.11 header and then uses it as an index into sta_entry->tids[]. ieee8nvd · 2026-09-11
[NVD] CVE-2026-80937 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy mt7915_mcu_get_eeprom() copies a fixed EFUSE block into the driver's dev->mt76.eeprom.data buffer at the offset reported by the MCU respnvd · 2026-09-11
[NVD] CVE-2026-80936 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: cancel mlo_pm_work on stop mt7925 queues mlo_pm_work with a 5 second delay during multi-link power-save setup and never cancels it on the stop path. If the device is torn down inside that winvd · 2026-09-11
[NVD] CVE-2026-80935 (HIGH 8.8) — In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy mt7996_mcu_get_eeprom() derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr, nvd · 2026-09-11
[NVD] CVE-2026-80933 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmnvd · 2026-09-11
[NVD] CVE-2026-80932 (HIGH 8.4) — In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: flush works in dependency order virtio_vsock_remove() stops the virtqueues and then flushes each work item before freeing the enclosing virtio_vsock. The current order does not account for dependnvd · 2026-09-11
[NVD] CVE-2026-80931 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: w1: ds28e17: reject an oversize length on an I2C block read w1_f19_i2c_master_transfer() is the master_xfer for the DS28E17 1-Wire to I2C bridge. On an I2C_M_RECV_LEN read, it takes the length from the device. nvd · 2026-09-11
[NVD] CVE-2026-80929 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] cad_pid is global, and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user nvd · 2026-09-11
[NVD] CVE-2026-80928 (HIGH 7.8) — In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smack_file_send_sigiotask() When inspecting the credentials of another task, objective credentials (->real_cred, accessed with __task_cred()) must always be used. Accessing ->cred on a nnvd · 2026-09-11
[NVD] CVE-2026-80926 (CRITICAL 9.8) — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2_oplock_break_noti() reads opinfo->conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning thenvd · 2026-09-11
n8n security advisory (AV26-916)cccs_ca · 2026-09-11
CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patternsoss_sec · 2026-09-11
CVE-2026-67211: Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializeross_sec · 2026-09-11
Re: AI slops from Eveoss_sec · 2026-09-11
Progress security advisory (AV26-915)cccs_ca · 2026-09-11
Re: AI slops from Eveoss_sec · 2026-09-11
[NVD] CVE-2026-87910 — When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, thenvd · 2026-09-11
My Talk at DEF CONschneier · 2026-09-11
How Natural Language Search Powers Rapid Physical Security Intelligenceflashpoint · 2026-09-11
GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosurethehackernews · 2026-09-11
Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacksthehackernews · 2026-09-11
A Community Guide to the EU CRA September 11 Deadline for Manufacturersopenssf_blog · 2026-09-11
[Control Systems] National Instruments security advisory (AV26-914)cccs_ca · 2026-09-11
[direwolf] Port of Tanjung Pelepas posted to leak siteransomware_live · 2026-09-11
[Control systems] GeoVision security advisory (AV26-913)cccs_ca · 2026-09-11
[Control systems] Schneider Electric security advisory (AV26-912)cccs_ca · 2026-09-11
Crypto customers targeted by scammers after email marketing provider breachmalwarebytes_blog · 2026-09-11
Re: AI slops from Eveoss_sec · 2026-09-11
The Self-Expanding Stolen Inference Supply Chain: An AI Agent Harvesting and Re-Serving LLM Access, (Fri, Sep 11th)sans_isc · 2026-09-11
Claude Used to Automate Exploitation and Data Theft Across Multiple Victimsthehackernews · 2026-09-11
Re: AI slops from Eveoss_sec · 2026-09-11
[pear] Foss Inc. posted to leak siteransomware_live · 2026-09-11
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detectionthehackernews · 2026-09-11
How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surfacebleepingcomputer · 2026-09-11
MongoDB security advisory (AV26-911)cccs_ca · 2026-09-11
Simplify Threat Intelligence Procurement with SOCRadar and AWS Marketplacesocradar_blog · 2026-09-11
Metasploit Wrap Up: This One Goes to Sixteen!rapid7 · 2026-09-11
Navigating India's DPDP Rules 2025zscaler_threatlabz · 2026-09-11
The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environmentrapid7 · 2026-09-11
HashiCorp security advisory (AV26-910)cccs_ca · 2026-09-11
CVE-2026-82583, CVE-2026-78224, CVE-2026-82578: NextGen Mirth Connect SQL injection and XXEoss_sec · 2026-09-11
[fulcrumsec] Dustin Group posted to leak siteransomware_live · 2026-09-11
Android malware creates a hidden copy of your banking appmalwarebytes_blog · 2026-09-11
CISA Adds Three Known Exploited Vulnerabilities to Catalogcisa_advisories · 2026-09-11
CISA Adds One Known Exploited Vulnerability to Catalogcisa_advisories · 2026-09-11
Your Critical Vulnerabilities Might Not Be Your Biggest Riskthehackernews · 2026-09-11
[Panzer] Konica Minolta Bulgaria posted to leak siteransomware_live · 2026-09-11
Vibe-Terrorism: Inside the Yemen Cell That Used Claude to Build Guided Weaponssocradar_blog · 2026-09-11
Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoorsthehackernews · 2026-09-11
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoorthehackernews · 2026-09-11
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flawsthehackernews · 2026-09-11
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomwarethehackernews · 2026-09-11
[dragonforce] Medical Department Store posted to leak siteransomware_live · 2026-09-11
Risky Bulletin: Anthropic agents went hacking againriskybiz_news · 2026-09-11
The GNU C Library security advisory update for 2026-09-10oss_sec · 2026-09-11
Re: AI slops from Eveoss_sec · 2026-09-11
[Panzer] Agencia Estatal de Meteorología posted to leak siteransomware_live · 2026-09-11
Encrypted Client Hello Is Here to Stayzscaler_threatlabz · 2026-09-11
Linux Detection Engineering - Local Privilege Escalationelastic_security · 2026-09-11
[CISA KEV] CVE-2026-42016 — JFrog Artifactory: JFrog Artifactory Incorrect Authorization Vulnerabilitycisa_kev · 2026-09-11
[CISA KEV] CVE-2026-42018 — JFrog Artifactory: JFrog Artifactory Improper Authentication Vulnerabilitycisa_kev · 2026-09-11
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessionselastic_security · 2026-09-11
[CISA KEV] CVE-2026-84869 — ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerabilitycisa_kev · 2026-09-11
[CISA KEV] CVE-2026-85706 — GitLab Community Edition and Enterprise Edition: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerabilitycisa_kev · 2026-09-11
How to Enforce Zero Trust Policies Using Endpoint Application Contextzscaler_threatlabz · 2026-09-10
[GHSA] GHSA-wvm9-9g5j-623f (medium) — Open WebUI: Users denied by the OAuth role policy can still sign in via token exchangegithub_advisories · 2026-09-10
[GHSA] GHSA-w4v4-9rw7-5326 (high) — Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorizationgithub_advisories · 2026-09-10
[GHSA] GHSA-v67p-phpq-fc8x (high) — Traefik entrypoint header-name sanitization bypassed via request trailersgithub_advisories · 2026-09-10
[GHSA] GHSA-qqjf-53cj-pwvv (critical) — Traefik HTTP/3 Backend NTLM Connection Reusegithub_advisories · 2026-09-10
[GHSA] GHSA-f52w-8j3h-j724 (high) — Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logginggithub_advisories · 2026-09-10
[GHSA] GHSA-66hp-wgxq-6f5q (medium) — rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespacegithub_advisories · 2026-09-10
[GHSA] GHSA-486v-q2wf-fp2r (low) — rclone: http backend forwards custom/auth headers to a different host on redirectgithub_advisories · 2026-09-10
[Global Secret Group] CO-OP URBAN BANK LTD posted to leak siteransomware_live · 2026-09-10
[GHSA] GHSA-f8g7-2xjc-7mfh (medium) — rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destinationgithub_advisories · 2026-09-10
[GHSA] GHSA-p6m2-r3w9-mpxw (medium) — rclone local: crafted Range request against a translated symlink panics (DoS)github_advisories · 2026-09-10
[GHSA] GHSA-xwwr-4h3p-r22c (critical) — rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypassgithub_advisories · 2026-09-10
[GHSA] GHSA-p569-5gjg-9cmj (critical) — rclone: RC per-server auth-proxy bypassgithub_advisories · 2026-09-10