A security company dedicated to making securing apps and companies more accessible without the BS
Meridian, ID
Joined July 2026
- Tweets72
- Following14
- Followers6
- Likes0
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 22 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ฅ๏ธ Message-broker admin console left open โ make yourself an administrator with no login, or reach the broker's admin API and delete topics (Apache Pulsar Manager CVE-2026-105944, Apache Pulsar)
๐ฆ Reverse proxy on an unpatched build โ unauthenticated RCE via an image plugin, anonymous writes to the shared cache, two cache-poisoning desyncs (Apache Traffic Server CVE-2026-111813, CVE-2026-111811, CVE-2026-111816, CVE-2025-31699)
๐ฆ Store plugin that trusts a spoofed identity โ act as another account with no password (Brainstorm Force SureCart CVE-2026-112241)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #AuthBypass #CSO #REDTEAM
We had the PHP2Shell covered because we already respond to all CVEs daily. Get NewScan for free today and see what you apps look like to attackers.
Let us know how we can help.
#PHP2Shell #PHP
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 21 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐จ Media server fetches any URL you hand it โ SSRF pivot off the media box onto the internal network, plus cross-plugin function calls, exploited in the wild right now (Plex CVE-2026-96654, CVE-2026-96652, CVE-2026-96655)
โก GitOps controller renders untrusted repository content โ code execution inside the component holding credentials for every cluster it deploys to (Argo CD CVE-2026-113708, CVE-2026-113672, CVE-2026-113709)
๐ณ๏ธ WordPress plugin leaves its user-import file publicly readable โ the imported customer list downloads to anyone who asks for it (WholesaleX CVE-2026-111956)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #SSRF #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 21 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐จ Media server fetches any URL you hand it โ SSRF pivot off the media box onto the internal network, plus cross-plugin function calls, exploited in the wild right now (Plex CVE-2026-96654, CVE-2026-96652, CVE-2026-96655)
โก GitOps controller renders untrusted repository content โ code execution inside the component holding credentials for every cluster it deploys to (Argo CD CVE-2026-113708, CVE-2026-113672, CVE-2026-113709)
๐ณ๏ธ WordPress plugin leaves its user-import file publicly readable โ the imported customer list downloads to anyone who asks for it (WholesaleX CVE-2026-111956)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #SSRF #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 20 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ Monitoring tool ships its database collections world-readable โ one anonymous read returns the SMTP password and every alerting webhook (CheckCle CVE-2026-112292)
๐ฆ Outdated Python web server matched offline against seven advisories โ request smuggling from ambiguous framing, an attacker-chosen request scheme, and three ways to hold a connection or file descriptor open (aiohttp CVE-2026-111750, CVE-2026-111748, CVE-2026-111063, CVE-2026-111064, CVE-2026-111065, CVE-2026-111066, CVE-2026-111749)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #RequestSmuggling #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 19 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ฆ Vulnerable Apache Camel builds โ a routed message deserialized into code execution on the integration host, plus SSRF and XXE in the same pipelines (Apache Camel CVE-2026-78162, CVE-2026-78165, CVE-2026-88901)
๐ฆ Vulnerable Apache Answer builds โ private posts read anonymously, and an emailed verification code accepted on a different workflow (Apache Answer CVE-2026-76994, CVE-2026-67249)
๐ฆ Vulnerable Gitea builds โ a signed-in user reads another account's keys and watched private repos (Gitea CVE-2026-97859, CVE-2026-110311)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #Deserialization #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 18 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ฆ Vulnerable phpMyFAQ builds โ a passkey enrolled against any account with no authentication, and a user record that hands back its TOTP secret (phpMyFAQ CVE-2026-111911, CVE-2026-111882, CVE-2026-111905)
๐ฆ Vulnerable Coder builds โ a lookalike hostname trusted as a workspace proxy and handed the session credentials meant for it (Coder CVE-2026-111927, CVE-2026-111934, CVE-2026-111930)
๐ Self-hosted database explorer now identifiable โ the admin UI in front of your databases gets a name in the inventory (Clidey WhoDB)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #AuthBypass #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 17 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐จ Remote-support appliance matched to an actively-exploited spoofing bug โ file operations on the appliance itself (BeyondTrust CVE-2026-102764)
๐ฆ Database version read off the connection handshake โ the server names its own build before anyone authenticates (MariaDB CVE-2026-85746, CVE-2026-85748, CVE-2026-97380)
๐ฆ Vulnerable WordPress plugin builds โ object injection at checkout, a raced OTP lockout, customer records read by anyone (LearnPress CVE-2026-104736, LatePoint CVE-2026-110653, CVE-2026-111602, ThirstyAffiliates CVE-2026-97314, aThemeArt CVE-2026-111413)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #AuthBypass #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 16 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐จ CI build server authentication bypass โ an unauthenticated request creates an administrator and walks off with the signing keys and deploy credentials (JetBrains CVE-2023-42793, JetBrains CVE-2024-27198)
๐ฆ Vulnerable CI server build โ the server is now identifiable and its release readable, and the protocol its build agents report over runs code on it (JetBrains CVE-2026-111094, CVE-2026-111095, CVE-2026-111096)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #AuthBypass #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 15 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ฆ Search server on a build with known RCE โ a config-API call turns a document update into command execution (Apache Solr CVE-2017-12629, CVE-2019-17558)
๐ฆ Legacy Elasticsearch 1.x โ a scripted search runs code on the node, or a crafted plugin/snapshot path reads any file off its disk (Elastic Elasticsearch CVE-2014-3120, CVE-2015-1427, CVE-2015-3337, CVE-2015-5531)
๐ฆ Unpatched CouchDB โ an anonymous document promotes itself to database administrator, then runs OS commands (Apache CouchDB CVE-2017-12635, CVE-2017-12636, CVE-2022-24706)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #RCE #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 14 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐จ VPN appliance auth bypass, exploited in the wild โ unauthenticated command execution on the box terminating your remote access (Ivanti CVE-2026-104935)
๐ณ๏ธ phpinfo() served at the site root โ the PHP config and the container's environment, database URLs and API keys included, to anyone loading the home page (FrankenPHP CVE-2026-85733)
๐ Auth skipped for anything shaped like a static file โ append ?x=.js to an admin path and the gate waves the request through (Dockhand CVE-2026-110130)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #AuthBypass #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 10 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ Mass assignment / BOPLA โ the scanner creates an object carrying role and is_admin fields and reads back whether the server kept them (CWE-915)
๐ Cross-user BOLA โ a second identity updates your object, confirmed by reading it back, not inferred from a status code (CWE-639)
๐ State-precondition bypass โ an operation the app's own 409 gates on object state succeeds on an object not in that state (CWE-841)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #BOLA #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 9 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ฅ๏ธ Unauthenticated AI KV-cache API โ the cache layer behind a vLLM deployment answers anonymously, and the same service runs a Python file you upload (LMCache CVE-2026-107204, CVE-2026-107205, CVE-2026-107206, CVE-2026-107207)
โก Pre-auth RCE on a SAML-configured load balancer โ memory overflow in the SAML handler, no credentials needed (Citrix CVE-2026-107406)
๐ Pre-auth SSRF on a remote-access appliance โ an unintended access path makes the appliance fetch internal URLs for you (SonicWall CVE-2026-102255)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #RCE #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 7 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ Pre-auth arbitrary file read โ the server returns its own deployment descriptor, then the config and credentials beside it, with no login (Atlassian CVE-2026-21589)
๐ฆ Plugin writing a credential to a world-readable log โ the shipping carrier's API key, and with it the power to change order statuses (Geliver CVE-2026-103378)
๐ฆ REST routes registered with no permission check โ unpublished store records read anonymously (WPCafe CVE-2026-86816)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #PathTraversal #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 6 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ First-run setup endpoint still reachable on a provisioned BPM engine โ an unauthenticated caller creates an administrator and inherits every deployed process and stored credential (Camunda CVE-2026-77226)
๐ฆ Outdated build with known remote code execution โ matched offline against the version the server publishes itself (Langflow CVE-2026-105697, Langflow CVE-2026-105740)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #AuthBypass #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 5 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐จ SAML gateway denial of service โ a zero-day that knocks a VPN gateway's SAML logins offline, exploited before the patch shipped (Citrix NetScaler CVE-2026-88779)
๐ฆ Forged admin session cookie on a web file server โ a predictable signing key lets anyone mint an admin cookie and run code (Rejetto HFS CVE-2026-61500)
๐ Identity provider fingerprint โ ZITADEL is now named in the inventory, so advisories against it can match
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #AuthBypass #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 4 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ฆ Unpatched single sign-on server โ unauthenticated class loading, cross-realm session theft, OAuth2 SSRF (Open Identity Platform OpenAM CVE-2026-105115, CVE-2026-105114, CVE-2026-105116, CVE-2026-105117, CVE-2026-105118, CVE-2026-105120, CVE-2026-105121, CVE-2026-105122)
๐ฆ Outdated WordPress plugins โ SQL injection, privilege escalation, cross-site scripting (Unlimited Elements CVE-2026-103355, CVE-2026-103342, CVE-2026-103344; Ultimate Member CVE-2026-96451; TranslatePress CVE-2026-103062; Kadence Blocks CVE-2026-103354; WP Statistics CVE-2026-97276)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #SSO #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 3 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ณ๏ธ Configuration export archive left downloadable โ the whole settings tree, role matrix and stored API keys, read with no login (Backdrop CMS CVE-2026-104476)
๐ฆ OpenPGP and MLS signature bindings accepted without proof โ a signing subkey with no back-signature verifies anyway (Bouncy Castle CVE-2026-71885)
๐ฆ Worker pool runs whatever module its caller's options object names โ a request-shaped options bag picks the file a worker executes (Tinypool CVE-2026-104849)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #DataExposure #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 2 Oct 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐จ Mail-gateway path traversal with a NULL-byte bypass โ one unauthenticated request writes arbitrary files on the appliance (Fortinet CVE-2026-104286)
โก Exposed PHP code generator or debug panel โ scaffolding that writes attacker-chosen code into the live webroot, or stored sessions and config served to anyone (Yii CVE-2026-103475)
๐ Secure file-transfer appliance now fingerprinted โ four advisories reachable with no credentials attach to it (Kiteworks CVE-2026-102115, CVE-2026-102147, CVE-2026-102106, CVE-2026-102121)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #PathTraversal #CSO #REDTEAM
NewNormal Security turns CVEs since the previous batch into new detections, every day.
๐๐ฎ๐ถ๐น๐ ๐๐ฉ๐ ๐ฅ๐ฒ๐ฝ๐ผ๐ฟ๐ โ 30 Sep 2026
๐๐ฑ๐ฑ๐ฒ๐ฑ to NewScan ๐๐ผ๐ฑ๐ฎ๐:
๐ฆ Command execution via git arguments in a Node app โ an attacker's command runs as the app (simple-git CVE-2026-102828, CVE-2026-102826, CVE-2026-102827)
๐ฆ HTTP client stalled by the server it calls โ hangs forever, eats memory, or skips proxy TLS checks (urllib3 CVE-2026-97689, CVE-2026-97687, CVE-2026-97688)
๐ฅ๏ธ Static-site generator's dev server left exposed โ whole config readable, files rewritable, no login (Marmite CVE-2026-102811, CVE-2026-102810)
Test your stack with NewScan โ free, self-hosted:
newnormalsecurity.com/newscaโฆ
#infosec #AppSec #RCE #CSO #REDTEAM