Sebastion
←All topics

ics

5 pieces of writing

security11 min read

Gitea CVE-2026-20896, Auth.js GHSA-7rqj-j65f-68wh and Anritsu CVE-2026-3356 show pre-operation authentication checks failing in 2026

Gitea, Auth.js and Anritsu show the same access-control design failure: trust is established before the operation, then later code consumes authority that was never proven at the point of use.

CVE-2025-10492: a Java deserialisation flaw in JasperReports gives attackers remote code execution on Hitachi Energy Ellipse
ics8 min read

CVE-2025-10492: a Java deserialisation flaw in JasperReports gives attackers remote code execution on Hitachi Energy Ellipse

Two CVEs in Siemens SICAM 8 firmware expose three product families to unauthenticated denial of service
siemens6 min read

Two CVEs in Siemens SICAM 8 firmware expose three product families to unauthenticated denial of service

Anritsu's spectrum monitors have no authentication and the vendor has no plans to add it
ics6 min read

Anritsu's spectrum monitors have no authentication and the vendor has no plans to add it

CVE-2026-3356 exposes a design-level authentication failure across Anritsu's entire Remote Spectrum Monitor line. CVSS 9.3, all versions affected, no fix planned.

Sandworm hit thirty Polish energy sites in a single night
security9 min read

Sandworm hit thirty Polish energy sites in a single night