NCSC-NL, Security Advisories
advisories-ncsc-nl · A · active
https://advisories.ncsc.nl/rss/advisories
Dutch NCSC machine-readable advisory feed (added 2026-05-08). Returns CSAF/CVRF-style Cisco/Ivanti/Apache/MOVEit/PAN-OS advisories with publication and last-update dates. The HTML hub at https://www.ncsc.nl/actueel is navigation-only (STUB) so prefer this RSS. Cite advisories via https://advisories.ncsc.nl/advisory/{id}. | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → feed https://advisories.ncsc.nl/rss/advisories 5 (listing) then `python3 tools/fetch_source.py ncsc-nl csaf <NCSC-ID>` for the full advisory body, the /advisory?id= URL is a JS client-side redirect shell, do NOT bridge it directly. AVOID: WebFetch / bridge `url https://advisories.ncsc.nl/advisory?id=...` returns a JS redirect stub, not the advisory; the redirect target /<year>/<id-lower>-<ver>.html also serves a JS index page. Use the `ncsc-nl csaf` API subcommand for the structured body.. | 2026-07-05 admiralty audit: A (HIGH->A), Dutch national CERT, primary authority for its jurisdiction; keep active; body still via ncsc-nl csaf <ID> API subcommand. | 2026-08-03 weekly (recipe fix): for NCSC-NL NEWS (as opposed to advisories) use https://feeds.ncsc.nl/nieuws.rss, the www.ncsc.nl/rss/* paths fail. | 2026-10-02 (2026-10-02T0404Z-intel): human advisory pages (advisory?id=NCSC-2026-NNNN) fall through `extract` to the jina reader and spend credit; `ncsc-nl csaf NCSC-2026-NNNN` returns the same content free as CSAF with vendor references and per-CVE vectors, so it is the first rung. NCSC prose can disagree with the CVE entry's own vector. | 2026-10-15 (S1): use `ncsc-nl csaf <id>` instead of `extract` on advisories.ncsc.nl pages, which burns reader credit. | 2026-10-22 (S1): advisories.ncsc.nl/advisory?id=<id> renders only a redirect to the SPA home through `extract`; `ncsc-nl csaf <id>` returns the full advisory and is the working read.
Cited in 40 entries
Citation cadence
Citation days per ISO week (25 weeks of coverage span, total 35).
- CVE-2026-98432, Linux kernel IPv4 TCP: a use-after-free in connection setup, present since 4.4, has an Anthropic-built remote root exploit against MPTCP listeners that CloudLinux could not reproduce; Citrix XenServer, XCP-ng, MikroTik, Red Hat, Debian, CIQ and Amazon Linux have fixes, Ubuntu's are in progress and WatchGuard and Fortinet have none for their products (CVSS 9.8)2026-10-31
- CVE-2026-104286, Fortinet FortiMail: unauthenticated path traversal file write exploited as a zero-day, fixed in 8.0.2, 7.6.7 and 7.4.9 (CVSS 9.8)2026-10-02
- CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)2026-09-28
- CVE-2026-28324 / CVE-2026-28325: SolarWinds Observability Self-Hosted, two unauthenticated remote-code-execution flaws, no confirmed exploitation yet (CVSS 9.8 / 8.8)2026-09-24
- CVE-2026-94127, F5 BIG-IP APM: unauthenticated heap overflow in OAuth-profile processing reaches RCE on the TMM data plane (CVSS 9.8)2026-09-23
- CVE-2026-93952, Arista VeloCloud Orchestrator: actively exploited, two release trains still have no fix2026-09-23
- Oracle's September 2026 Critical Security Patch Update carries fifty unauthenticated CVSS 9.8+ flaws, concentrated in Fusion Middleware's identity, forms, directory and portal components, plus E-Business Suite, Hyperion, Analytics, Enterprise Manager, Communications and Supply Chain products2026-09-20
- CVE-2026-76460 (+ CVE-2026-76423), Cisco Identity Services Engine: unauthenticated API authentication bypass to root, found during a Cisco TAC support case, no workaround beyond ACLs (CVSS 10.0)2026-09-17
- CVE-2026-76461: Cisco Secure Email Gateway unauthenticated SQL injection in email parsing reaches root command execution, exploited before disclosure (CVSS 9.8)2026-09-15
- Ivanti September 2026 Security Update, ten CVEs across Neurons for ITSM, Sentry and EPMM, two unauthenticated CVSS 9.8 deserialization RCEs2026-09-11
- CVE-2026-87491, Google Chrome: V8 out-of-bounds write exploited in the wild, patched in Chrome 153 (seventh exploited Chrome zero-day of 2026)2026-09-10
- HPE Networking Fabric Composer and ArubaOS-CX: an unauthenticated CVSS 10.0 RCE and a CVSS 10.0 authentication bypass in the fabric-management plane, plus a CVSS 9.8 unauthenticated buffer-overflow RCE in the switch OS2026-09-04
- CVE-2026-20212, Cisco Nexus 9000 Series: unauthenticated root RCE via the Silicon One hardware-abstraction layer on TCP 43210/432112026-09-04
- CVE-2026-82078 / CVE-2026-81578, PaperCut NG/MF: an Apache Tapestry request-routing confusion chains an unauthenticated config rewrite to arbitrary code execution, exploited before a patch existed2026-08-29
- CVE-2026-62911, Microsoft Exchange Server MRSProxy: a missing channel-binding check lets a relayed Negotiate authentication take over every mailbox, public exploit code now live sixteen days after the patch2026-08-29
- CVE-2026-19490, Citrix NetScaler: an authentication bypass on Gateway and AAA virtual servers (CVSS 9.3), and on older builds no SAML configuration is needed to be exposed2026-08-20
- CVE-2026-58115, Siemens SIMATIC IoT2050 Advanced ships a Node-RED interface with no authentication, so one unauthenticated HTTP request runs code with maximum privileges on an OT edge gateway (CVSS 10.0); VulnCheck's canary caught exploitation2026-08-13
- SAP Commerce Cloud CVE-2026-58231: an unauthenticated request to a vulnerable Data Hub Adapter endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy2026-08-12
- CVE-2026-65400: macOS Screen Sharing lets a network attacker authenticate without valid credentials, the second severe defect in the same daemon in two releases2026-08-08
- Cisco IOS XE August 2026 hardening release, seven CVEs that each stand for a whole class of internally found bugs, no workarounds, and frontier AI models among the discovery tools2026-08-08
- Adobe Campaign Classic APSB26-120, three more unauthenticated CVSS 10.0 code-execution flaws, and last week's build 9398 is the version they affect2026-08-07
- Veeam Service Provider Console and Veeam ONE, ten CVEs, headed by an unauthenticated CVSS 10.0 remote code execution on the Veeam ONE agent host2026-08-06
- BSI and NCSC-NL withdraw SQLite advisories built on LLM-fabricated CVEs, and GitHub's advisory database was still serving one of them2026-08-04
- VMSA-2026-0006, VMware vCenter: unauthenticated Directory Service auth bypass and Syslog traversal RCE (both CVSS 9.8), plus a VMXNET3 guest-to-host escape2026-07-30
- Oracle July 2026 CPU, nine unauthenticated CVSS 10.0 flaws in Fusion Middleware, with NCSC-NL assessing large-scale abuse as very likely in the short term2026-07-26
- CVE-2026-16232, Check Point SmartConsole: authentication bypass to full admin, exploited in the wild (CVSS 9.1)2026-07-23
- CVE-2026-0770, Langflow: CISA confirms active exploitation of an unauthenticated exec_globals RCE the same day a 15-CVE batch (incl. unauthenticated account creation) is patched in 1.10.12026-07-22
- WP2Shell: pre-auth RCE chain in stock WordPress core (CVE-2026-63030 + CVE-2026-60137), out-of-band 7.0.2 patch, exploited within days and KEV-listed2026-07-18
- Firefox 152.0.6, chained WebAssembly memory-safety and DOM-navigation site-isolation flaws with public exploit code (CVE-2026-15718, CVE-2026-15719)2026-07-17
- Microsoft July 2026 Patch Tuesday ships two actively-exploited zero-days, AD FS local EoP (CVE-2026-56155) and unauthenticated SharePoint EoP (CVE-2026-56164)2026-07-14
- Ubiquiti UniFi SAB-066, 25 vulnerabilities incl. unauthenticated CVSS 10.0 command injection in UniFi Connect (CVE-2026-50746)2026-07-08
- CVE-2026-8451, Citrix NetScaler ADC/Gateway: pre-auth SAML memory overread (CitrixBleed lineage), public PoC2026-07-01
- CVE-2026-55200, libssh2 heap out-of-bounds write in ssh2_transport_read() with public PoC; companion pre-auth DoS CVE-2026-551992026-06-28
- June 2026 Patch Tuesday: four CVSS ≥ 9.1 criticals, Windows kernel TCP/IP RCE, Nuance PowerScribe, Azure Stack Edge, Exchange Online2026-06-12
- CVE-2026-25089, Fortinet FortiSandbox: unauthenticated OS command injection in the web UI's VNC-launch handler (CVSS 9.8 base)2026-06-12
- CVE-2026-50751: Check Point Security Gateway IKEv1 VPN authentication bypass, actively exploited, actor assessed with medium confidence to use Qilin ransomware2026-06-09
- CVE-2026-48710 "BadHost", Starlette (FastAPI / vLLM / LiteLLM / MCP SDK): Pre-Auth Auth Bypass via Malformed Host Header2026-05-30
- CVE-2026-4868 (+ five further CVEs), GitLab 19.0.1 / 18.11.4 / 18.10.7 patch release: Duo AI identity impersonation, unauthenticated project enumeration2026-05-29
- CVE-2026-41225: F5 BIG-IP iControl REST lets an authenticated Manager-role account run arbitrary commands and bypass Appliance mode (May 2026 quarterly)2026-05-17
- AMD-SB-7052 / CVE-2025-54518: AMD Zen 2 op-cache corruption lets local code run instructions at a higher privilege, guest to host included (CVSS 7.3); OS updates on EPYC 7002, OEM BIOS updates on Ryzen2026-05-16