Telekom Security

Mar 03, 2026 Threat Intelligence

Mass exploitation of CVE-2026-1281 and CVE-2026-1340 in Ivanti EPMM

In early 2026, two critical zero-day vulnerabilities in Ivanti’s mobile device management platform - CVE-2026-1281 and CVE-2026-1340 - emerged as significant drivers of incident activity across multiple sectors. Both flaws, rated CVSS 9....

Nov 25, 2025 Security Advisory

REDAXO Mediapool Reflected Cross-Site Scripting

A reflected Cross-Site Scripting vulnerability (CVE-2025-66026) has been identified in the REDAXO Mediapool component. The issue allows arbitrary JavaScript execution in the backend when a user visits a specially crafted link while authe...

Nov 04, 2025 Security Advisory

Multiple vulnerabilities in Janitza UMG 96RM-E

Several vulnerabilities were discovered during testing of a Janitza UMG 96RM-E device.

Jun 03, 2025 Security Advisory

Multiple vulnerabilities in Kanboard (Exploiting web applications Part II)

This article is a continuation of a write-up series, where we discuss web application vulnerabilities found during red team operations. This time, the target was the Kanboard software.

Apr 01, 2025 Security Advisory

Rasa (un)authenticated Remote Code Execution via remote model loading (CVE-2024-49375)

During an internal penetration test a product was checked which uses Rasa to build a conversational AI. A mixture of penetration testing and source code analysis led to the discovery of an (un)authenticated Remote Code Execution.

Mar 14, 2025 Security Advisory

Multiple critical vulnerabilities in SICK DL100-2xxxxxxx Products

Several vulnerabilities were discovered during testing of a DL100 device.

Jan 14, 2025 Security Advisory

Remote code execution in LDAP Account manager through CVE-2024-23333 (Exploiting web applications Part I)

During red teaming engagements, the first step is to gain a foothold in the client’s network. That might happen through a phishing attempt, malicious payloads, physical access to the client’s site or an assumed breach. But what happens o...

Dec 19, 2024 Security Advisory

Remote buffer overflow vulnerability in SharkSSL TLS handshake processing

A new remote buffer overflow vulnerability was discovered in the latest version of the SharkSSL libraryfrom 05.05.2024 (https://github.com/RealTimeLogic/SharkSSL) by security evaluators of DeutscheTelekom Security GmbH and Deutsche Telek...

Telekom Security Updates