❌

Visualização normal

Antes de ontemCybersecurity News
  • ✇Cybersecurity News
  • Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0 Do Son
    A critical LiteLLM vulnerability (CVSS 10.0) lets an unauthenticated file read leak the master key on Enterprise proxies. Update to 1.106.5 now. Related Posts: Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public Adobe Patches Nine Critical Vulnerabilities in Campaign Classic and Connect The post Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0 appeared firs
     
  • ↗️

Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0

✇Cybersecurity News
Por:Do Son
28 de Outubro de 2026, 05:49

A critical LiteLLM vulnerability (CVSS 10.0) lets an unauthenticated file read leak the master key on Enterprise proxies. Update to 1.106.5 now.

Related Posts:

The post Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0 appeared first on Daily CyberSecurity.

  • ✇Cybersecurity News
  • Python Ships Emergency Releases After emSign CA Certificate Incident Do Son
    The emSign CA certificate was pulled from certifi. A new Python security release updates pip to block MITM risks. Upgrade pip and uv now. Related Posts: iOS 27.1 iPhone Duo Release Targets Foldable Hardware OpenAI Cuts Internet Access for Frontier Model Training Google Privacy Policy Change Raises Gmail Ad Concerns The post Python Ships Emergency Releases After emSign CA Certificate Incident appeared first on Daily CyberSecurity.
     
  • ↗️

Python Ships Emergency Releases After emSign CA Certificate Incident

✇Cybersecurity News
Por:Do Son
23 de Outubro de 2026, 06:09

The emSign CA certificate was pulled from certifi. A new Python security release updates pip to block MITM risks. Upgrade pip and uv now.

Related Posts:

The post Python Ships Emergency Releases After emSign CA Certificate Incident appeared first on Daily CyberSecurity.

  • ✇Firewall Daily – The Cyber Express
  • SAP Patches Critical CVSS 10.0 Flaw in Cloud SDK for Python Ashish Khaitan
    SAP released its October 2026 security patch on Tuesday, October 13, delivering 22 new and updated security notes. Four of them address critical-severity vulnerabilities. The most severe is CVE-2026-89111, a maximum-rated flaw in the Cloud SDK for Python. Several of the bugs could allow attackers to invoke internal operations or execute code, which could lead to complete compromise of affected systems.  SAP's patch day summary breaks the release down into 16 new security notes, four GitHub se
     
  • ↗️

SAP Patches Critical CVSS 10.0 Flaw in Cloud SDK for Python

✇Firewall Daily – The Cyber Express
Por:Ashish Khaitan
14 de Outubro de 2026, 05:08

CVE-2026-89111

SAP released its October 2026 security patch on Tuesday, October 13, delivering 22 new and updated security notes. Four of them address critical-severity vulnerabilities. The most severe is CVE-2026-89111, a maximum-rated flaw in the Cloud SDK for Python. Several of the bugs could allow attackers to invoke internal operations or execute code, which could lead to complete compromise of affected systems.  SAP's patch day summary breaks the release down into 16 new security notes, four GitHub security advisories, and two updates to previously released notes. The company recommends that customers visit its support portal and apply the patches as a priority. 

CVE-2026-89111 Puts Cloud SDK for Python Users at Risk 

CVE-2026-89111 has a CVSS score of 10.0. It is an OAuth2 server-side request forgery (SSRF) vulnerability affecting multi-tenant BTP applications that use Cloud SDK for Python versions earlier than 0.45.2. It is tracked under GitHub advisory GHSA-4mv3-jxxm-9cx2.  SAP describes the risk in its advisory: "An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated." 

Other Critical Fixes in the SAP Security Patch 

Note 3797111 resolves CVE-2026-89110 (CVSS 9.9). This is a broken access control issue in certain portal functionality of NetWeaver Visual Composer, version VC70RUNTIME 7.50.  Note 3805589 fixes CVE-2026-89107 (CVSS 9.9), a code injection bug in S/4HANA's Manage Substitution/Validation Rules. It affects S4CORE versions 105 through 109.  Note 3798788 covers CVE-2026-89108 (CVSS 9.1), a missing authorization check in the Configuration Service of SAP Manufacturing Integration and Intelligence (XMII 15.4 and 15.5). 

High-Severity Vulnerabilities 

Three notes are rated high. Note 3800517 patches CVE-2026-89113 (CVSS 8.8), an SQL injection flaw in Commerce Cloud's OOTB code (COM_CLOUD 2211-JDK21).  Note 3765424 addresses CVE-2026-58249 (CVSS 7.5), a memory corruption bug in the Internet Communication Manager of NetWeaver and Web Dispatcher. It affects a wide range of components, including HDB 2.00, KRNL64UC 7.53, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, and CONTSERV 7.53 and 7.54. It also covers WEBDISP 7.53, 7.54, 7.77, 7.93 and 9.16, and KERNEL 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19 and 9.20.  Note 3626303 fixes CVE-2026-89120 (CVSS 7.1), a missing authorization check in the ABAP Platform (KERNEL 7.93 and 9.16). 

Medium and Low-Severity Notes 

Cross-site scripting (XSS) makes up a large share of the remaining fixes: 
  • CVE-2026-76972 (6.5) affects Manufacturing Integration and Intelligence (note 3798823). 
  • CVE-2026-89117 (6.1) affects the Enterprise Portal, EP-ADMIN 7.50 (note 3779985). 
  • CVE-2026-76975 (6.1) affects the SAPUI5 Support Assistant Overlay (note 3794572). 
  • CVE-2026-76976 (5.4) affects NetWeaver AS ABAP applications based on SAP GUI for HTML (note 3671819). 
  • CVE-2026-89106 (4.4) affects SAPUI5 (note 3799054). 
Two updated notes also deal with older issues. Note 3689080, first released in March 2026, covers CVE-2026-24316 (6.4), an SSRF flaw in NetWeaver AS for ABAP that spans SAP_BASIS 740 through 918. Note 3629325, from September 2025, addresses CVE-2025-42938 (6.1), an XSS bug in the NetWeaver ABAP Platform.  The Enterprise Portal receives two more fixes. Note 3790401 resolves an open redirect, CVE-2026-89122 (6.1), and note 3789825 resolves an information disclosure flaw, CVE-2026-89118 (5.3). Both affect EP-RUNTIME 7.50.  The other GitHub advisories cover three open-source components: 
  • CVE-2026-89112 (6.5) is a broken access control flaw in CLA-Assistant versions up to 2.13.1 that exposes signers' PII. 
  • CVE-2026-89116 (5.9) is an OS command injection bug in Yeoman-UI version 1.25.1 and earlier. 
  • CVE-2026-89105 (4.2) is an improper authentication issue in the HybridTokenAuthenticator of the cloud-security-services-integration-library, affecting versions 3.6.6 up to, but not including, 4.1.1. 
Missing authorization checks were also fixed in two more products. CVE-2026-89121 (4.7) affects S/4HANA Linear Asset Management (S4CORE 109), and CVE-2026-89124 (4.3) affects Global Trade Services, edition for SAP HANA (GTSCORE 200 and 300).  The only low-rated note, 3767634, addresses CVE-2026-58242 (CVSS 3.5), an improper authorization check in Cloud Connector 2.0. 
  • ✇Cybersecurity News
  • Critical Python SSL Vulnerabilities Fixed in CPython Do Son
    CPython developers fixed critical Python SSL vulnerabilities. Update now to resolve these Python SSL vulnerabilities and protect secure network sockets. Related Posts: PoC Exploit Released for Next.js RCE Flaw CVE-2026-94545 ASUS Security Vulnerabilities Expose Routers and Motherboards MediaWiki External Data CVE-2026-100382 (CVSS 10) Unauthenticated RCE Exploited in the Wild, PoC Public The post Critical Python SSL Vulnerabilities Fixed in CPython appeared first on Daily CyberSecurity.
     
  • ↗️

Critical Python SSL Vulnerabilities Fixed in CPython

✇Cybersecurity News
Por:Do Son
30 de Setembro de 2026, 22:39

CPython developers fixed critical Python SSL vulnerabilities. Update now to resolve these Python SSL vulnerabilities and protect secure network sockets.

Related Posts:

The post Critical Python SSL Vulnerabilities Fixed in CPython appeared first on Daily CyberSecurity.

New Python Infostealer Targets 17 Browsers to Steal Passwords, Cards and Session Cookies

✇GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
Por:Mayura Kathir
28 de Setembro de 2026, 04:26

A Python-based information stealer that targets data from 17 Chromium-based browsers, alongside Firefox, to harvest saved credentials, payment-card details, browsing history and active session cookies. The malware is delivered through a builder framework that enables operators to generate customized Windows payloads and configure their own data-exfiltration webhook. The archive included a “TokenGrabber Builder” folder containing […]

The post New Python Infostealer Targets 17 Browsers to Steal Passwords, Cards and Session Cookies appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

❌
❌