NewNormal Security

A security company dedicated to making securing apps and companies more accessible without the BS

[NewNormal Security @NewScanTeam]

https://t.co/AVqFnoAgFv

[NewNormal Security @NewScanTeam]

NewNormal Security turns CVEs since the previous batch into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 25 Sep 2026

𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan:
🖥️ Unauthenticated MCP server — whoever finds the port drives its tools, as seen in DBHub CVE-2026-61742

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🕳️ Unauthenticated runtime-config endpoint — the whole server config read anonymously, admin email included, as seen in OpenObserve CVE-2026-63645

🖥️ Container log viewer with auth switched off — live logs of every container on the host: tokens, connection strings, reset links (Dozzle)

📦 WooCommerce reviews plugin with no permission check — a visitor does what the storefront reserves for staff (CVE-2026-89055)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #InfoDisclosure #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns CVEs since the previous batch into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 24 Sep 2026

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🔑 Blank default JWT signing secret — forge an admin session, and nothing can revoke it (SigNoz CVE-2026-97055)

🔓 Reports built for callers who never logged in — user names, devices, print history (PaperCut CVE-2026-87739)

📂 Path traversal in scan-to-fax settings — an admin foothold becomes commands on the host (PaperCut CVE-2026-82077)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #JWT #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns CVEs since the previous batch into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 23 Sep 2026

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🚨 VPN gateway RCE, exploited in the wild — unauthenticated code execution on the box that terminates your VPN (Check Point CVE-2026-93616, Check Point CVE-2026-85102)

🚨 Load balancer zero-day, exploited in the wild — unauthenticated RCE on an internet-facing BIG-IP running APM, now fingerprinted even with its admin UI firewalled off (F5 CVE-2026-94127)

🖥️ Service-discovery server left open — reads the admin password hash, then rewrites the live config every app behind it is pulling (Alibaba Nacos)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #RCE #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns CVEs since the previous batch into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 22 Sep 2026

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
✂️ Edge proxy path confusion and upgrade tunnelling — smuggle a request past the proxy's own access control (Envoy CVE-2026-73548, CVE-2026-73552, CVE-2026-73553, CVE-2026-73511, CVE-2026-73551)

🖥️ Service mesh proxy admin console reachable with no password — dump upstreams, listeners and the TLS material they reference (Envoy CVE-2026-73546)

📦 Network monitoring appliance on an unpatched build — read its stored config backups, or run commands on the box that sees every flow (ntop ntopng CVE-2026-84990, CVE-2026-82412)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #RequestSmuggling #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns CVEs since the previous batch into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 21 Sep 2026

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🔗 Host-header injection — the app builds its own download and asset links from a header you send, so every link can be aimed at the attacker (Eclipse Open VSX CVE-2025-12999)

📦 Unauthenticated file upload in a vulnerable plugin build — any visitor uploads a script and runs code (WooCommerce Online Product Designer CVE-2026-82187)

📦 Vulnerable WordPress plugin builds — shortcode injection, client-set order prices, unauthenticated import (GiveWP CVE-2026-85113, RestroPress CVE-2026-85010, To Do List Member CVE-2026-86802)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #HostHeaderInjection #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns CVEs since the previous batch into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 20 Sep 2026

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
📦 Missing authorization in a WordPress gallery plugin — any logged-in user reads image records they were never granted, including client proofing sets (NextGEN Gallery CVE-2026-81652, CVE-2026-81654)

📦 PHP object injection over XML-RPC — attacker-chosen classes instantiated inside the site (Forminator CVE-2026-87067)

🔎 Reverse-proxy admin panel now fingerprinted with its release — the box fronting a self-hosted estate appears in the inventory, so advisories against it can be matched (nginx-proxy-manager CVE-2026-93964)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #BrokenAccessControl #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns CVEs since the previous batch into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 19 Sep 2026

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🖥️ Container registry open to anonymous push, or running a build whose bearer-token check can be bypassed — every image, and a tag they can overwrite (zot CVE-2026-61833)

🖥️ Database console on the internet — a login in front of a database whose permission checks any account can walk around (ArcadeDB CVE-2026-93593, CVE-2026-93594, CVE-2026-93595, CVE-2026-93598)

🖥️ Self-hosted AI model server with no authentication — free inference on your GPUs, and one bad request stops the engine for everyone (as seen in vLLM CVE-2026-93592)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #ExposedInterface #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns CVEs since the previous batch into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 14 Sep 2026

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🕳️ Video platform feeds that hand the uploader's email address and last-login time to an unauthenticated request, private videos included (WWBN AVideo CVE-2026-90549)

🔓 Admin-only menu APIs answering anonymous callers, exposing the navigation a site hides and the user groups it is gated on (WWBN AVideo CVE-2026-90541)

🔎 AVideo now identified by name and release from the pages it already serves — what makes any advisory against it matchable

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #DataExposure #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns the last 24 hours of CVEs into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 11 Sep 2026

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
📦 Reverse proxy on a build named in this week's advisories — reach the protected backend with none of its auth, allowlist or rate-limit middleware (Traefik CVE-2026-88877, CVE-2026-88007, CVE-2026-88009, CVE-2026-88008, CVE-2026-88004, CVE-2026-88878, CVE-2026-88879, CVE-2026-88011, CVE-2026-88012)

🔓 Authorization written as a list of HTTP verbs, with one verb missing from the list — send the same request as PATCH and the access check never runs (OpenNMS CVE-2026-89054)

🕳️ Media-server plugin status page answering anonymously — read the host's binary paths, open ports and plugin log without logging in (WWBN AVideo CVE-2026-89248)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #AuthBypass #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns the last 24 hours of CVEs into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 10 Sep 2026

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🚨 Firewall management console auth bypass — an internal session ID accepted from the network hands over the console as root (Cisco CVE-2026-20079)

🚨 SSL-VPN on an unpatched firmware train — pre-auth memory corruption on the box facing the internet (Fortinet CVE-2025-25249)

🚨 Internet-exposed gateway flagged against a new actively-exploited auth bypass (Citrix CVE-2026-19490)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #AuthBypass #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns the last 24 hours of CVEs into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 9 Sep 2026

𝗔𝗱𝗱𝗲𝗱 𝘁𝗼 𝗡𝗲𝘄𝗦𝗰𝗮𝗻 𝘁𝗼𝗱𝗮𝘆:
🚨 Actively exploited pre-authentication RCE — exposed N-central servers now surface the advisory before attackers take the RMM and managed endpoints (N-able CVE-2026-86218)

📦 Regular-expression denial of service — crafted commit author metadata can exhaust apps pinned to vulnerable GitPython builds (GitPython CVE-2026-87819)

📦 Regular-expression denial of service — attacker-controlled Git clone paths can exhaust vulnerable n8n workers (n8n CVE-2026-86081)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #RCE #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns the last 24 hours of CVEs into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 8 Sep 2026

𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan:
🕳️ Database dump left readable in the web root — every stored record, password hashes included, from one anonymous GET (code-projects CVE-2026-86519)

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🖥️ Management API serving with no password set — full workspace and config control, plus a one-call public tunnel that puts the open instance on the internet (knowns CVE-2026-86543)

🖥️ Setup wizard still reachable on an unconfigured server — gives up the exact build number, and leaves the first admin account there for the taking (JetBrains YouTrack)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #AuthBypass #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns the last 24 hours of CVEs into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 7 Sep 2026

𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan:
🔓 IP allow-list bypass via a spoofed X-Forwarded-For — reaches the admin pages the IP check was the only thing guarding (PrestaShop CVE-2026-84186)

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
📦 Deserialization RCE in an https://t.co/m8ii6riqDN file-upload control — unauthenticated code execution on the web server (Progress Telerik CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184, CVE-2026-13185, CVE-2026-13186, CVE-2026-13190)

📦 Stored XSS in a WordPress plugin's lazy-load image parser — script that runs for every later visitor to the page (Powerkit CVE-2026-2390)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #Deserialization #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns the last 24 hours of CVEs into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 6 Sep 2026

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🔎 Search platform fingerprinting — Apache Solr's exact build now reads off the admin page it already serves, which is what makes any advisory against it matchable

🔎 Search cluster fingerprinting — an Elasticsearch node's real version instead of just "a cluster is here", and CrateDB no longer answers to the name

🔎 Document database fingerprinting — CouchDB's version, still readable on an install that has an admin password set

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #Fingerprinting #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns the last 24 hours of CVEs into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 3 Sep 2026

𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan:
🚨 Unauthenticated MCP server access — anonymous clients can list and call an AI gateway's tools, hijacking sessions (LiteLLM CVE-2026-59822)

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🚨 Auth bypass via path-suffix match — a request ending in /configs skips authentication, reaching workflow creation and RCE as root (Kestra CVE-2026-49869)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #AuthBypass #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

NewNormal Security turns the last 24 hours of CVEs into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 2 Sep 2026

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
📦 Vulnerable XML parser version — crafted end tags can stall the Node.js event loop (xmldom CVE-2026-83619)

📦 Vulnerable gRPC library version — fragmented HTTP/2 frames can exhaust server memory (gRPC-Go CVE-2026-84304)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #DoS #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

What's in a Name?

https://t.co/05kkDhKCQp

#appsec #infosec #API

[NewNormal Security @NewScanTeam]

@mikesaleme NewScan WILL categorize it as an authentication issue on a scan.

[NewNormal Security @NewScanTeam]

NewNormal Security turns the last 24 hours of CVEs into new detections, every day.

𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 30 Aug 2026

𝗔𝗹𝗿𝗲𝗮𝗱𝘆 𝗰𝗼𝘃𝗲𝗿𝗲𝗱 by NewScan:
🔓 MCP server that authenticates no caller — drive every tool the agent exposes, anonymously (argocd-mcp CVE-2026-82456)

🔑 JWT accepted without checking its signature — forge a token for any user (Omnivore CVE-2026-82454)

𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆:
🔀 SSRF allow-list that forgets carrier-grade NAT — reach the cloud metadata service the guard was written to block (Memos CVE-2026-82476)

📦 WordPress SSO plugin with an authentication bypass — sign in as any account, no password (miniOrange SAML Single Sign On CVE-2026-75807)

Test your stack with NewScan — free, self-hosted:
https://t.co/fmt3Xhf2El

#infosec #AppSec #SSRF #CSO #REDTEAM

[NewNormal Security @NewScanTeam]

@mikesaleme It's certainly a big misconfiguration to skip authentication