Security Articles & Writeups - Page 3

CVE-2026-33032: Nginx UI Authentication Bypass Enables Unauthenticated Server Takeover (CVSS 9.8)

CVE-2026-33032 is a critical authentication bypass in Nginx UI affecting all versions, where the /mcp_message endpoint relies on an empty default IP whitelist that permits unrestricted access to all…

CVE-2026-33032

securityonline.info

CVE-2026-33026: Critical Nginx UI Backup Vulnerability (9.4 CVSS) - PoC Exploit Released

CVE-2026-33026 is a critical vulnerability in Nginx UI's backup mechanism that allows attackers to decrypt, modify, and re-encrypt backup archives due to client-side exposure of encryption keys and…

CVE-2026-33026

labs.watchtowr.com

CVE-2026-3055 Part 2: Multiple Memory Overread Vulnerabilities in Citrix NetScaler SAML/WSFED

CVE-2026-3055 encompasses at least two distinct memory overread vulnerabilities affecting Citrix NetScaler's /saml/login and /wsfed/passive endpoints when configured as a SAML identity provider.

CVE-2026-3055

Weekly Report Mar 30, 2026

Threat Landscape 23/03-30/03/2026: Supply Chain Attacks and Auth Failures Surge

Introduction The week of March 23-30, 2026 delivered a sobering reminder that fundamental security principles remain more honored in the breach than in practice.

CVE-2026-4567 CVE-2026-4585 CVE-2025-60949 CVE-2026-33634 CVE-2025-71275 +5 more

labs.watchtowr.com

CVE-2026-3055: Citrix NetScaler Memory Overread via SAML IdP XML Parsing

CVE-2026-3055 is a critical memory overread vulnerability (CVSS 9.3) in Citrix NetScaler ADC and Gateway affecting versions before 14.1-26.x, exploitable only when configured as a SAML Identity…

CVE-2026-3055

medium.com

CVE-2026-2256: AI Agent Command Injection via Unsafe Shell Execution in MS-Agent 1.5.2

A critical command injection vulnerability in MS-Agent's Shell tool (version 1.5.2) allows attackers to execute arbitrary OS commands by injecting malicious input through data sources like prompts,…

CVE-2026-2256

medium.com

CVE-2026-33696: n8n Prototype Pollution RCE in XML and GSuite Admin

CVE-2026-33696 exploits prototype pollution in n8n to achieve remote code execution through XML and GSuite Admin components.

CVE-2026-33696

infosecwriteups.com

CVE-2026-26123: Microsoft Authenticator Deep Link Hijacking Enables Full Account Takeover

An unclaimed deep link (ms-msa://) in Microsoft Authenticator allows any malicious app to intercept authentication tokens and achieve complete account takeover, bypassing 2FA and password protections…

CVE-2026-26123

labs.watchtowr.com

Ivanti EPMM Pre-Auth RCE via Bash Script Injection (CVE-2026-1281, CVE-2026-1340)

Two actively exploited pre-authentication remote code execution vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) leverage unsafe Bash script execution through Apache RewriteMap directives,…

CVE-2026-1281 CVE-2026-1340

labs.watchtowr.com

Juniper PTX Series Unauthenticated RCE via CVE-2026-21902 On-Box Anomaly Detection

CVE-2026-21902 is a critical pre-authentication remote code execution vulnerability in Juniper Junos OS Evolved affecting PTX Series routers, caused by improper permission assignment in the On-Box…

CVE-2026-21902

Medium

CVE-2026-20643: Critical WebKit Navigation API Bypass Exposes Apple Users to SOP Attacks

CVE-2026-20643 is a critical WebKit vulnerability in Apple's Navigation API that allows malicious web content to bypass Same-Origin Policy (SOP) protections, enabling attackers to steal session…

CVE-2026-20643

labs.watchtowr.com

A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE)

CVE-2026-32746 is a 32-year-old pre-authentication buffer overflow in GNU inetutils Telnetd's LINEMODE SLC negotiation handler that allows attackers to corrupt ~400 bytes of memory and achieve remote…

CVE-2026-32746