@CCBalert

CCB Alert is the advisory page of the Centre for Cybersecurity Belgium @CCBbelgium. Use [email protected] for interaction.

 Belgium
ccb.belgium.be
Joined August 2009
  • Tweets3.8K
  • Following201
  • Followers7.3K
145Media
Warning: A critical remote code execution vulnerability in #Drupal core could allow attackers to execute arbitrary code, in some cases without authentication, via certain contributed modules. CVE-2026-108097. Read the advisory drupal.org/sa-core-2026-014 and #Patch #Patch #Patch

Drupal core - Critical - Remote code execution - SA-CORE-2026-014

drupal.org
1
256
Warning: 3 critical vulnerabilities in #MariaDB Server may allow low-privileged attackers to access or corrupt data, cause crashes, or execute code. CVE-2026-92262, CVE-2026-85746 & CVE-2026-85748 CVSS(3.1): 9.9. Read the advisory github.com/MariaDB/server/se… and #Patch #Patch #Patch

Numerous issues caused by historical #mysql50# tablename encoding bypass

### Impact Normally MariaDB encodes tables names when storing them on the filesystem, e.g. table `a-b` is stored in files `a@002db` (plus some extension). A `#mysql50#` bypass prefix allows to acc...

github.com
1
2
287
Warning: Two critical heap-based buffer overflow vulnerabilities in #NGINX Plus and Open Source allow attackers to cause denial of service or possibly execute code. CVE-2026-15176 CVE-2026-93479 CVSS(4.0): 9.2. #Patch #Patch #Patch
1
245
Warning: A critical template injection vulnerability in #Adobe Commerce and #Magento Open Source allows unauthenticated attackers to execute arbitrary code. #RCE CVE-2026-103849 CVSS(3.1): 10.0. #Patch #Patch #Patch
1
241
Warning: Critical, unauthenticated arbitrary-file-access in #Atlassian #Jira #Confluence Data Centre #CVE-2026-21589 CVSS: 9.3 can lead to sensitive data exposure in the web application root directory. On CISA kev list. See: advisory ccb.belgium.be/advisories/wa…. #Patch #Patch #Patch
1
290
Warning: High Incorrect Authorization in #SonicWall Network Security Manager (NSM). CVE-2026-96540 CVSS: 8.8. This can potentially let a remote authenticated attacker obtain sensitive information, escalate to admin, or intercept other users’ communications! #Patch #Patch #Patch
1
1
305
Warning: High Improper Access Control in #Grafana. CVE-2026-9703 CVSS: 7.1. This can let an authenticated Viewer create, modify, and delete Loki alerting rules for all users of the data source! #Patch #Patch #Patch
1
277
Warning: Critical SQL Injection in #n8n. #CVE-2026-110840 #CVE-2026-110847 CVSS: 9.8. These flaws can lead to unauthenticated remote database manipulation. #Patch #Patch #Patch
1
1
1
300
Warning: Missing Authentication in #QNAP sMedio DTCP MOVE. #CVE-2026-34006 CVSS: 9.8. This flaw can allow remote attackers to gain full access to the system. #Patch #Patch #Patch
2
234
Warning: Critical Path Traversal in #Gitea. #CVE-2026-59774 CVSS: 9.8. This flaw can let unauthenticated attackers read service account files and under specific conditions execute commands as the Gitea service account. #Patch #Patch #Patch
308
Warning: Critical Authentication Bypass in #BeyondTrust. #CVE-2026-102764 CVSS: 9.3. This vulnerability can lead to unauthorized file operations and remote code execution. #Patch #Patch #Patch
264
Warning: Multiple Critical Buffer Overflows and Auth Bypass in #Juniper. #CVE-2026-101954 CVSS: 9.8. These flaws can lead to remote code execution and full device takeover. #Patch #Patch #Patch
306
Warning: #ActivelyExploited remote code execution in Palo Alto #PAN-OS. #CVE-2026-0322 CVSS: 8.6. An authenticated attacker can execute arbitrary code as root, #RCE! See our advisory for more info: ccb.belgium.be/advisories/wa… #Patch #Patch #Patch
2
290
Warning: #ActivelyExploited remote code execution in #CiscoSecureEmail. #CVE-2026-76519 CVSS: 9.8. Attackers can abuse Advanced Malware Protection to write files and remotely execute arbitrary code #RCE! See our advisory for more info: ccb.belgium.be/advisories/wa… #Patch #Patch #Patch
1
258
Warning: #ActivelyExploited vulnerability in #Bricksforge plugin for WordPress. CVE-2026-85097 CVSS: 9.8. This allows unauthenticated attackers to upload and execute arbitrary files #RCE! More info: wordfence.com/threat-intel/v… #Patch #Patch #Patch

Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter...

wordfence.com
1
262
Warning: #ActivelyExploited vulnerability in #CollaboraOnline. CVE-2026-110447 CVSS: 9.2. When Nextcloud with CollaboraOnline is installed with richdocumentscode, there is a remote, unauthenticated injection vulnerability #RCE! See: github.com/CollaboraOnline/o… #Patch #Patch #Patch

Unauthenticated OS command injection in the richdocumentscode proxy

### Impact Users of Nextcloud with [Collabora Online - Built-in CODE Server](https://apps.nextcloud.com/apps/richdocumentscode) app can be vulnerable through proxy.php. A request can cause an op...

github.com
1
271
Warning: Multiple #ActivelyExploited vulnerabilities in #AhsayCBS. CVE-2026-105134 CVSS: 10 & CVE-2026-105133. Authentication bypass chained with an arbitrary file write allows unauthenticated remote code execution on the host OS #RCE! ahsay.com/en/support/help-ce… #Patch #Patch #Patch

AhsayCBS (DIY) v10.3.4 Release Notes (05-Aug-2026) | Ahsay Backup

Add support for Hyper-V backup on Windows 11, Debian 12.15/13.6, and macOS 26.6 support. Improved Restore Index File warning, and more

ahsay.com
265
Warning: Critical Arbitrary Code Execution in #JFrog CLI. CVE-2026-92892 CVSS: 9.0. This flaw can lead to potential arbitrary command execution on the host running the CLI under specific configurations! #Patch #Patch #Patch
1
310
Warning: High severity vulnerabilities in #OpenVPN. CVE-2026-88964, CVE-2026-84790. These flaws allow attacks via an integer underflow in the domain search list and certificate subject impersonation using NULL bytes. #Patch #Patch #Patch
1
253
Warning: Critical Server-Side Request Forgery in #Adobe ColdFusion. CVE-2026-106622 CVSS: 10.0. This unauthenticated SSRF flaw allows attackers to escalate privileges and access internal services without user interaction in versions up to 2025.0.13 and 2023.0.25. #Patch #Patch
1
264
Load more