Posts by Igal Zeifman

• Emerging Threats

IBM has disclosed three critical flaws in WebSphere Application Server 8.5 and 9.0, including identity spoofing and two remote code execution paths that let unauthenticated attackers impersonate users or run code.

• Emerging Threats

An authentication bypass flaw in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS lets a remote attacker forge override cookies and establish an unauthorized VPN connection.

• Emerging Threats

Sample of assets impacted by NGINX nginx-poolslip vulnerability, identified by the CyCognito Platform What is CVE-2026-9256? CVE-2026-9256, publicly nicknamed “nginx-poolslip,” is a heap buffer overflow in the ngx_http_rewrite_module component of NGINX Plus and NGINX Open Source. The flaw is triggered when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. Under these conditions, NGINX underestimates the length of the output after URI escaping, producing an out-of-bounds write inside the worker process memory pool. The…

• Emerging Threats

A critical arbitrary file write vulnerability in Grafana’s SQL expressions feature can be chained with a Grafana Enterprise plugin to achieve full remote code execution on the underlying host.

• Emerging Threats

An unauthenticated SQL injection in Drupal core’s database abstraction API lets a remote attacker execute arbitrary SQL against PostgreSQL-backed sites, with a path to full database compromise and, in elevated configurations, remote code execution on the underlying host.

• Emerging Threats

A critical authentication bypass in the peering handshake of Cisco Catalyst SD-WAN Controller and Manager lets an unauthenticated remote attacker and issue arbitrary NETCONF commands.

• Emerging Threats

A heap buffer overflow in NGINX’s rewrite module lets an unauthenticated attacker crash worker processes with a single crafted HTTP request, and on hosts with ASLR disabled can be leveraged for remote code execution.

• Emerging Threats

A cross-site scripting vulnerability in Microsoft Exchange Server’s Outlook Web Access lets an unauthenticated attacker execute arbitrary JavaScript in a victim’s browser session by sending a specially crafted email, and is already being exploited in the wild.

• Emerging Threats

A critical use-after-free vulnerability in Exim’s BDAT message body parsing path, allows an unauthenticated network attacker to execute arbitrary code on the underlying mail server.

• Emerging Threats

An authenticated admin RCE vulnerability in Ivanti Endpoint Manager Mobile is being actively exploited in the wild.