Needs attention · 7
- TW-01React Server Components typed-array RCEA flaw in how React Server Components serialize several typed arrays in one payload can let an unauthenticated attacker run code on the server.CVE-2026-126187 · CVE-2026-96889Prioritize patchingChecked Nov 11
- TW-02*sshole: OpenSSH password bypass on musl LinuxAn authentication bypass in OpenSSH's sshd on musl-based Linux without PAM, including Alpine's default package, lets attackers log in to accounts with no password set.CVE-2026-123158Prioritize patchingChecked Nov 6
- TW-03php2shellPHP runtime flaws can let unauthenticated attackers run code; a related session upload progress flaw affects applications with specific session settings.CVE-2026-109618 · CVE-2026-109619 · CVE-2026-115560Prioritize patchingChecked Nov 9
- TW-04Linux IPv4 TCP use-after-freeA race condition in Linux's IPv4 TCP connection handling can expose kernel memory, crash a host, or allow remote code execution before application authentication.CVE-2026-98432Prioritize patchingChecked Nov 2
- TW-05eMudhra certificate compromiseEight compromised eMudhra intermediate certificates could enable server impersonation and interception of traffic where affected certificates remain trusted.Review trust settingsChecked Nov 2
- TW-06node2shellCVE-2026-111497 is a memory-corruption flaw in the shared Brotli decoder. Any service that decompresses attacker-controlled Brotli, in a request or an HTTP response, can be exposed.CVE-2026-111497Assess your exposureChecked Oct 25
- TW-07Citrix NetScaler command executionAn unauthenticated attacker can execute commands on affected NetScaler ADC and Gateway appliances, including default configurations.CVE-2026-88771Prioritize patchingChecked Oct 19
Reference · 1
Briefing source: Cloudflare Radar Zero Wire (Cloudforce One).