🔴 CVE-2026-4484 - Critical (9.8)

The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_data...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4484 - Critical (9.8)

The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_data...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-33526: Critical Use-After-Free in Squid (<7.5) allows remote attackers to crash Squid via ICP traffic. icp_access rules are ineffective. Upgrade to 7.5+ or disable ICP (icp_port=0) ASAP! https://radar.offseq.com/threat/cve-2026-33526-cwe-416-use-after-free-in-squid-cac-5f2ea159 #OffSeq #Squid #Vuln #DoS

🚨 CVE-2026-33526: Critical Use-After-Free in Squid (<7.5) allows remote attackers to crash Squid via ICP traffic. icp_access rules are ineffective. Upgrade to 7.5+ or disable ICP (icp_port=0) ASAP! https://radar.offseq.com/threat/cve-2026-33526-cwe-416-use-after-free-in-squid-cac-5f2ea159 #OffSeq #Squid #Vuln #DoS

🟠 CVE-2026-33287 - High (7.5)

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript's `String.prototype.replace()` which interprets `$&` as a back reference to the ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33287 - High (7.5)

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript's `String.prototype.replace()` which interprets `$&` as a back reference to the ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33285 - High (7.5)

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's `memoryLimit` security mechanism can be completely bypassed by using reverse range expressions (e.g., `(100000000..1)`), allow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33285 - High (7.5)

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's `memoryLimit` security mechanism can be completely bypassed by using reverse range expressions (e.g., `(100000000..1)`), allow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4758 - High (8.8)

The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'WPJOBPORTALcustomfields::removeFileCustom' function in all versions up to, and including, 2.4.9. This makes it possibl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4758/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4758 - High (8.8)

The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'WPJOBPORTALcustomfields::removeFileCustom' function in all versions up to, and including, 2.4.9. This makes it possibl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4758/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34056 - High (7.7)

OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download Ensora eR...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34056 - High (7.7)

OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download Ensora eR...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33932 - High (7.6)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a stored cross-site scripting vulnerability in the CCDA document preview allows an attacker who can upload or send a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33932/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33932 - High (7.6)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a stored cross-site scripting vulnerability in the CCDA document preview allows an attacker who can upload or send a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33932/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33918 - High (7.6)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint `interface/billing/get_claim_file.php` only verifies that the caller has a valid ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33918/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33918 - High (7.6)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint `interface/billing/get_claim_file.php` only verifies that the caller has a valid ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33918/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33918 - High (7.6)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint `interface/billing/get_claim_file.php` only verifies that the caller has a valid ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33918/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33918 - High (7.6)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint `interface/billing/get_claim_file.php` only verifies that the caller has a valid ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33918/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33917 - High (8.8)

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vulnerability in the ajax_save CAMOS form that can be exploited by authenticated attackers. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33917/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33917 - High (8.8)

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vulnerability in the ajax_save CAMOS form that can be exploited by authenticated attackers. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33917/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33917 - High (8.8)

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vulnerability in the ajax_save CAMOS form that can be exploited by authenticated attackers. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33917/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33917 - High (8.8)

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vulnerability in the ajax_save CAMOS form that can be exploited by authenticated attackers. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33917/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33913 - High (7.7)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can upload a crafted CCDA document containing `` to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33913/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33913 - High (7.7)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated user with access to the Carecoordination module can upload a crafted CCDA document containing `` to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33913/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE ID: CVE-2026-33017
Vendor: Langflow
Product: Langflow
Date Added: 2026-03-25
Notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx ; https://nvd.nist.gov/vuln/detail/CVE-2026-33017
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33017

CISA has updated the KEV catalogue.

- CVE-2026-33017: Langflow Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-33017 #CISA #infosec #vulnerability

🟠 CVE-2025-33247 - High (7.8)

NVIDIA Megatron LM contains a vulnerability in quantization configuration loading, which could allow remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33247/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24150 - High (7.8)

NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of priv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24150/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-33286 in Graphiti (<1.10.2) lets unauthenticated attackers invoke arbitrary public methods via JSONAPI write requests. Patch to v1.10.2, restrict access, and validate inputs! https://radar.offseq.com/threat/cve-2026-33286-cwe-913-improper-control-of-dynamic-fd76d864 #OffSeq #CVE202633286 #Ruby #APIsecurity

🔴 CVE-2026-33286 - Critical (9.1)

Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execution vulnerability that affects Graphiti's JSONAPI write functionality. An attacker can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33282 - High (7.5)

Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing a malformed NGAP LocationReport message with `ue-presence-in-area-of-interest` event type and omitting the optional `UEPresenceInAreaOfInterestLis...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32536 - Critical (9.9)

Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows Using Malicious Files.This issue affects Green Downloads: from n/a through &lt;= 2.08.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32536/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32536 - Critical (9.9)

Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows Using Malicious Files.This issue affects Green Downloads: from n/a through &lt;= 2.08.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32536/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32537 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Port...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32537/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32537 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Port...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32537/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25001 - High (8.5)

Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through &lt;= 4.0.12.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25001 - High (8.5)

Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through &lt;= 4.0.12.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32534 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through &lt;= 3.0.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32534 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through &lt;= 3.0.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32539 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Blind SQL Injection.This issue affects PublishPress Revisions: from n/a through &lt;= 3.7.23.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32539 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Blind SQL Injection.This issue affects PublishPress Revisions: from n/a through &lt;= 3.7.23.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32573 - Critical (9.1)

Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through &lt;= 8.2.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32573 - Critical (9.1)

Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through &lt;= 8.2.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32513 - High (8.8)

Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through &lt;= 6.1.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32513/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32513 - High (8.8)

Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through &lt;= 6.1.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32513/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27044 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through &lt;= 4.12.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27044 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through &lt;= 4.12.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27044 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through &lt;= 4.12.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27044 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through &lt;= 4.12.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25366 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through &lt;= 2.7.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25366 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through &lt;= 2.7.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4719 - High (7.5)

Incorrect boundary conditions in the Graphics: Text component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4719/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4704 - High (7.5)

Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33680 - High (7.5)

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenticated users to list all link shares for a project, including their secret hashes. While `LinkShari...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ #Cybersecurity news & tips across the #fediverse

“🟠 CVE-2026-33678 - High (8.1) Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID fro...”

https://mastodon.social/@thehackerwire/116285975900964242

🤖 via RSS feed. Not an endorsement.

🟠 CVE-2026-33678 - High (8.1)

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID from the URL path. The permission check in `CanRead()` validat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33678/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32538 - High (7.5)

Insertion of Sensitive Information Into Sent Data vulnerability in Noor Alam SMTP Mailer smtp-mailer allows Retrieve Embedded Sensitive Data.This issue affects SMTP Mailer: from n/a through &lt;= 1.1.24.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32538 - High (7.5)

Insertion of Sensitive Information Into Sent Data vulnerability in Noor Alam SMTP Mailer smtp-mailer allows Retrieve Embedded Sensitive Data.This issue affects SMTP Mailer: from n/a through &lt;= 1.1.24.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32531 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kunco kunco allows PHP Local File Inclusion.This issue affects Kunco: from n/a through &lt; 1.4.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32531/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32531 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kunco kunco allows PHP Local File Inclusion.This issue affects Kunco: from n/a through &lt; 1.4.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32531/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30976 - High (8.6)

Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30976 - High (8.6)

Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33497 - High (7.5)

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33497/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33418 - High (7.5)

DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based approach to rewrite SVG `width`/`height` attributes, capping them at 2048px to prevent deni...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33316 - High (8.1)

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The `ResetPassword()` function sets the user’s status to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33316/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33316 - High (8.1)

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The `ResetPassword()` function sets the user’s status to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33316/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29839 - High (8.8)

DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29839/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33310 - High (8.8)

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33310/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33242 - High (7.5)

Salvo is a Rust web framework. Versions 0.39.0 through 0.89.2 have a Path Traversal and Access Control Bypass vulnerability in the salvo-proxy component. The vulnerability allows an unauthenticated external attacker to bypass proxy routing constra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33242/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32300 - High (8.1)

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the My Page profile update feature may allow modific...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32300/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32299 - High (7.5)

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an improper authorization issue in the page content retrieval feature may allow retriev...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32299/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32278 - High (8.2)

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32278 - High (8.2)

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32277 - High (8.7)

Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view. Versions 1.41.1 and 2.41.1 contain a patch.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32277 - High (8.7)

Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view. Versions 1.41.1 and 2.41.1 contain a patch.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4715 - Critical (9.1)

Uninitialized memory in the Graphics: Canvas2D component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4715/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4705 - Critical (9.8)

Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4705/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33218 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33218 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33218 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33218 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32546 - High (7.5)

Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Content: from n/a through &lt;= 3.2.22.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32546/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32546 - High (7.5)

Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Content: from n/a through &lt;= 3.2.22.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32546/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32546 - High (7.5)

Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Content: from n/a through &lt;= 3.2.22.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32546/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32546 - High (7.5)

Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Content: from n/a through &lt;= 3.2.22.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32546/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32525 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through &lt;= 3.5.6.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32525/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32525 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through &lt;= 3.5.6.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32525/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25447 - Critical (9.1)

Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through &lt;= 2.3.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25447 - Critical (9.1)

Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through &lt;= 2.3.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25447 - Critical (9.1)

Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through &lt;= 2.3.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25447 - Critical (9.1)

Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through &lt;= 2.3.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-20687 (CRITICAL): Use-after-free in Apple iOS/iPadOS/macOS/tvOS/watchOS lets malicious apps crash devices or write kernel memory. Patch to iOS/iPadOS 18.7.7/26.4, macOS Sequoia 15.7.5, Tahoe 26.4+ ASAP. https://radar.offseq.com/threat/cve-2026-20687-an-app-may-be-able-to-cause-unexpec-a39ac789 #OffSeq #AppleSecurity #InfoSec

🟠 CVE-2026-4712 - High (7.5)

Information disclosure in the Widget: Cocoa component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3988 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3988 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3988 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3988 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3988 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3988 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3857 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3857 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3857 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3857 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3857 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3857 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20012 - High (8.6)

A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20012/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20012 - High (8.6)

A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20012/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20125 - High (7.7)

A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) conditio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20125/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20125 - High (7.7)

A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) conditio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20125/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26832 - Critical (9.8)

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26832 - Critical (9.8)

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-32991 - Critical (9)

In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-32991/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-32991 - Critical (9)

In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-32991/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-3608: HIGH-severity vuln in ISC Kea DHCP (2.6.0 – 2.6.4, 3.0.0 – 3.0.2). Remote attackers can crash daemons, causing DoS. Restrict API/HA access, monitor traffic, and prep failover. Details: https://radar.offseq.com/threat/cve-2026-3608-cwe-617-reachable-assertion-in-isc-k-fed4f439 #OffSeq #CVE #DHCP #Infosec

⚠️ CRITICAL RCE in n8n (CVE-2026-33660): Auth'd users can exploit Merge node SQL to read files & execute code on n8n host. Patch to 2.14.1/2.13.3/1.123.26 ASAP. Limit permissions if you can't patch yet. https://radar.offseq.com/threat/cve-2026-33660-cwe-94-improper-control-of-generati-e1c73d20 #OffSeq #n8n #infosec #CVE202633660

⚠️ CRITICAL RCE in n8n (CVE-2026-33660): Auth'd users can exploit Merge node SQL to read files & execute code on n8n host. Patch to 2.14.1/2.13.3/1.123.26 ASAP. Limit permissions if you can't patch yet. https://radar.offseq.com/threat/cve-2026-33660-cwe-94-improper-control-of-generati-e1c73d20 #OffSeq #n8n #infosec #CVE202633660

🟠 CVE-2026-2995 - High (7.7)

GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2995/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2995 - High (7.7)

GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2995/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2995 - High (7.7)

GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2995/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2995 - High (7.7)

GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2995/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27889 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the na...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27889/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27889 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the na...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27889/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20086 - High (8.6)

A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20086/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20086 - High (8.6)

A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20086/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20084 - High (8.6)

A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded between VLANs, resulting in a denial of service (DoS) condition.

This vulnerability is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20084 - High (8.6)

A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded between VLANs, resulting in a denial of service (DoS) condition.

This vulnerability is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24157 - High (7.8)

NVIDIA NeMo Framework contains a vulnerability in checkpoint loading where an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24157/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22559 - High (8.8)

An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is socially engineered into clicking a malicious link.

Affected Products:
UniFi Network Server (Version 10.1....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22559/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33329 - High (8.1)

FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into files...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33329/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH: CVE-2026-2343 in PeproDev Ultimate Invoice ≤2.2.5 exposes PII via predictable ZIP archive names in bulk downloads. No auth needed — risk of mass data leaks! Disable feature, restrict access, monitor logs. https://radar.offseq.com/threat/cve-2026-2343-cwe-200-information-exposure-in-pepr-b24bfe87 #OffSeq #WordPress #Vuln

🔒 CVE-2026-28864 (HIGH): Local attackers can access Apple Keychain items on iOS, iPadOS, macOS, visionOS, watchOS. Patch to latest OS releases now to protect credentials. No known exploits yet. https://radar.offseq.com/threat/cve-2026-28864-a-local-attacker-may-gain-access-to-881070fb #OffSeq #Apple #Security #Keychain

🟠 CVE-2026-3104 - High (7.5)

A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain.
This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.
BIND 9 versions 9...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3104/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3104 - High (7.5)

A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain.
This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.
BIND 9 versions 9...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3104/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26830 - Critical (9.8)

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shel...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26830/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26830 - Critical (9.8)

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shel...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26830/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1519 - High (7.5)

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1519/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1519 - High (7.5)

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1519/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-33634: CRITICAL supply chain vuln in aquasecurity Trivy & GitHub Actions (<0.2.6) — credential-stealing malware deployed. Rotate all secrets, use safe versions, audit logs for 'tpcp-docs'. Full details: https://radar.offseq.com/threat/cve-2026-33634-cwe-506-embedded-malicious-code-in--163a34d0 #OffSeq #SupplyChain #CVE2026_33634

⚠️ CVE-2026-26306 (HIGH): OM Workspace (Windows ≤2.4) vulnerable to DLL hijacking. Local attackers can execute code via unsafe installer DLL loading. Patch urgently or restrict installs & use Safe DLL Search Mode. https://radar.offseq.com/threat/cve-2026-26306-uncontrolled-search-path-element-in-ee774158 #OffSeq #Vulnerability #Windows

⚠️ HIGH-severity XSS (CVE-2026-2072, CVSS 8.2) in Hitachi Infrastructure Analytics Advisor & Ops Center Analyzer <11.0.5-00. Exploitable by low-privilege users. Patch when available, restrict access, enable WAF. https://radar.offseq.com/threat/cve-2026-2072-cwe-79-improper-neutralization-of-in-c6f3add7 #OffSeq #XSS #Vuln #Hitachi

I updated the “Device Name” section of my “How to Fingerprint iOS Users” article to note that iOS 26.4 fixes CVE-2026-28877, which leaked the device name without needing a proper entitlement.

https://paradisefacade.com/blog/2026/3/9/how-to-fingerprint-users

Global cybersecurity alerts include active exploitation of Chrome Zero-Days (CVE-2026-3909/3910) and a Quest KACE SMA flaw for credential harvesting. Advanced threats like Android haptic keyloggers and deepfake identity fraud are emerging. Geopolitically, Persian Gulf tensions remain high, while the US announced a new cyber strategy to defend companies from foreign adversaries. In tech, NVIDIA Nemotron 3 Super is now on Amazon Bedrock.

#Cybersecurity #GeopoliticalNews #TechBrief

🟠 CVE-2026-33216 - High (8.6)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33216/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33216 - High (8.6)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33216/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33216 - High (8.6)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33216/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33216 - High (8.6)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33216/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4725 - Critical (10)

Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects Firefox &lt; 149.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4725/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4723 - Critical (9.8)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox &lt; 149.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4723/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4701 - Critical (9.8)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4701/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4717 - Critical (9.8)

Privilege escalation in the Netmonitor component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4717/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4716 - Critical (9.1)

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4716/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4714 - High (7.5)

Incorrect boundary conditions in the Audio/Video component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4714/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4713 - High (7.5)

Incorrect boundary conditions in the Graphics component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4713/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4711 - Critical (9.8)

Use-after-free in the Widget: Cocoa component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4711/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4722 - High (8.8)

Privilege escalation in the IPC component. This vulnerability affects Firefox &lt; 149.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4722/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-33254 - High (7.5)

NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this vulnerability may lead to a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33254/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-33248 - High (7.8)

NVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33248/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-33244 - Critical (9)

NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data. This vulnerability affects environments that use PyTorch versions earlier than 2.6. A successful exploit of this vulnera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33244/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New Nvidia advisories. This is a long list of vulnerabilities with varying severity.

Of note is the critical CVE-2025-33244: Security Bulletin: NVIDIA Apex - March 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5782

The rest: https://www.nvidia.com/en-us/product-security/ #infosec #Nvidia #vulnerability

🟠 CVE-2025-33238 - High (7.5)

NVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploit of this vulnerability may lead to denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33238/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24158 - High (7.5)

NVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a large compressed payload. A successful exploit of this vulnerability may lead to denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24158/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24152 - High (7.8)

NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalation of priv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24151 - High (7.8)

NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously crafted input. A successful exploit of this vulnerability may lead to code execution, escalation of privileges...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24141 - High (7.8)

NVIDIA Model Optimizer for Windows and Linux contains a vulnerability in the ONNX quantization feature, where a user could cause unsafe deserialization by providing a specially crafted input file. A successful exploit of this vulnerability might l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24159 - High (7.8)

NVIDIA NeMo Framework contains a vulnerability where an attacker may cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure and data tampering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24159/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Pharos Controls Patches Critical Root Access Flaw in Mosaic Show Controllers

Pharos Controls patched a critical vulnerability (CVE-2026-2417) in its Mosaic Show Controller that allows unauthenticated attackers to execute arbitrary commands with root privileges.

**Make sure all Pharos Mosaic Show Controllers are isolated from the internet and accessible from trusted networks only. Check your version, if you are running 2.15.3, you are at risk. Plan an update the firmware to version 2.16 or later.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/pharos-controls-patches-critical-root-access-flaw-in-mosaic-show-controllers-1-6-s-3-0/gD2P6Ple2L

🔴 CVE-2026-4702 - Critical (9.8)

JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4702/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29785 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29785 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29785 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29785 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4700 - Critical (9.8)

Mitigation bypass in the Networking: HTTP component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4700/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33554 - High (7.5)

ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33554/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30653 - High (7.5)

An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function HandleAuthenticationFailure of the component AMF

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30653/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32276 - High (8.8)

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an authenticated user may be able to execute arbitrary code in the Code Study Plugin. V...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32276/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33484 - High (7.5)

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71275 - Critical (9.8)

Zimbra Collaboration Suite (ZCS) PostJournal service version 8.8.15 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by exploiting improper sanitization of the RCPT TO parameter ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4673 - High (8.8)

Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4673 - High (8.8)

Heap buffer overflow in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4679 - High (8.8)

Integer overflow in Fonts in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4679/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4675 - High (8.8)

Heap buffer overflow in WebGL in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4675/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4674 - High (8.8)

Out of bounds read in CSS in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4674/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4674 - High (8.8)

Out of bounds read in CSS in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4674/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4677 - High (8.8)

Inappropriate implementation in WebAudio in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4677/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Citrix patched this yesterday.

Arctic Wolf: CVE‑2026‑3055: Critical Unauthenticated Memory-Read Vulnerability in Citrix NetScaler ADC and Gateway https://arcticwolf.com/resources/blog/cve-2026-3055/

Citrix: NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-3055 and CVE-2026-4368 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696300&articleURL=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_3055_and_CVE_2026_4368 #infosec #vulnerability

Critical Memory Leak and Session Hijacking Vulnerabilities Patched in Citrix NetScaler

Citrix patched a critical memory overread (CVE-2026-3055) and a high-severity session-swapping race condition (CVE-2026-4368) in NetScaler ADC and Gateway. These vulnerabilities allow unauthenticated attackers to leak sensitive memory data or hijack user sessions in environments configured for SAML or VPN services.

**If possible, make sure your NetScaler ADC and Gateway appliances are isolated from the internet and accessible from trusted networks only. Them plan a quick update. If you can't isolate from the internet, this is urgent. Update the firmware to the fixed versions (14.1-66.59, 13.1-62.23, or 13.1-37.262 for FIPS/NDcPP). Attackers have previously exploited similar flaws via the CitrixBleed exploit.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-memory-leak-and-session-hijacking-vulnerabilities-patched-in-citrix-netscaler-s-x-0-i-0/gD2P6Ple2L

🟠 CVE-2025-60946 - High (8.8)

Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file directories. Fixed in 8.1.0 alpha.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-60946/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-4283 in WP DSGVO Tools (GDPR) plugin allows unauthenticated attackers to irreversibly destroy non-admin accounts via 'super-unsubscribe' AJAX. All versions ≤3.1.38 affected. Remove '[unsubscribe_form]' & monitor for abuse. https://radar.offseq.com/threat/cve-2026-4283-cwe-862-missing-authorization-in-leg-b0b3a8d9 #OffSeq #WordPress #Infosec

🔴 CVE-2026-4283 - Critical (9.1)

The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to unauthorized account destruction in all versions up to, and including, 3.1.38. This is due to the `super-unsubscribe` AJAX action accepting a `process_now` parameter from unauthentica...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27654 - High (8.2)

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27654/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2026-011
CODESYS Control V3 - Untrusted boot application

The CODESYS Control runtime system provides a user management mechanism with multiple privilege groups. While only the privileged Administrators and Developer groups are intended to load or debug applications on the controller, users in the restricted Service group are allowed to perform maintenance operations, including explicitly replacing the boot application.
#CVE CVE-2025-41660

https://certvde.com/en/advisories/vde-2026-011/

#CSAF https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-02_vde-2026-011.json

🔴 CVE-2026-4750 - Critical (9.1)

Out-of-bounds Read vulnerability in fabiangreffrath woof.This issue affects woof: before woof_15.3.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4640 - High (7.5)

Vitals ESP developed by Galaxy Software Services has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to execute certain functions to obtain sensitive information.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4640/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33298 - High (7.8)

llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions. This ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33298/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33298 - High (7.8)

llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions. This ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33298/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack