🔴 CVE-2026-24841 - Critical (9.9)

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameter...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24841/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24841 - Critical (9.9)

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokploy's WebSocket endpoint `/docker-container-terminal`. The `containerId` and `activeWay` parameter...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24841/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24840 - High (8)

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation script (located at https://dokploy.com/install.sh, line 154) uses a hardcoded password when creating th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24840/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24840 - High (8)

Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a hardcoded credential in the provided installation script (located at https://dokploy.com/install.sh, line 154) uses a hardcoded password when creating th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24840/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24838 - Critical (9.1)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24838 - Critical (9.1)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24838 - Critical (9.1)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24838 - Critical (9.1)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, module title supports richtext which could include scripts that would execute in certain scenarios...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21569 - High (7.9)

This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.

This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21569/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21569 - High (7.9)

This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.

This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21569/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21569 - High (7.9)

This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.

This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21569/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21569 - High (7.9)

This High severity XXE (XML External Entity Injection) vulnerability was introduced in version 7.1.0 of Crowd Data Center and Server.

This XXE (XML External Entity Injection) vulnerability, with a CVSS Score of 7.9, allows an authenticated att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21569/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📰 Today's Top 21 Hacker News Stories (Sorted by Score) 📰
----------------------------------------
🔖 Title: TikTok users can't upload anti-ICE videos. The company blames tech issues
🔗 URL: https://www.cnn.com/2026/01/26/tech/tiktok-ice-censorship-glitch-cec
👍 Score: [983]
💬 Discussion: https://news.ycombinator.com/item?id=46779809
----------------------------------------
🔖 Title: Heathrow scraps liquid container limit
🔗 URL: https://www.bbc.com/news/articles/c1evvx89559o
👍 Score: [576]
💬 Discussion: https://news.ycombinator.com/item?id=46736815
----------------------------------------
🔖 Title: Cloudflare claimed they implemented Matrix on Cloudflare workers. They didn't
🔗 URL: https://tech.lgbt/@JadedBlueEyes/115967791152135761
👍 Score: [392]
💬 Discussion: https://news.ycombinator.com/item?id=46781516
----------------------------------------
🔖 Title: I made my own Git
🔗 URL: https://tonystr.net/blog/git_immitation
👍 Score: [287]
💬 Discussion: https://news.ycombinator.com/item?id=46778341
----------------------------------------
🔖 Title: U.S. government has lost more than 10k STEM PhDs since Trump took office
🔗 URL: https://www.science.org/content/article/u-s-government-has-lost-more-10-000-stem-ph-d-s-trump-took-office
👍 Score: [279]
💬 Discussion: https://news.ycombinator.com/item?id=46784263
----------------------------------------
🔖 Title: 430k-year-old well-preserved wooden tools are the oldest ever found
🔗 URL: https://www.nytimes.com/2026/01/26/science/archaeology-neanderthals-tools.html
👍 Score: [212]
💬 Discussion: https://news.ycombinator.com/item?id=46781530
----------------------------------------
🔖 Title: Xfwl4 – The Roadmap for a Xfce Wayland Compositor
🔗 URL: https://alexxcons.github.io/blogpost_15.html
👍 Score: [211]
💬 Discussion: https://news.ycombinator.com/item?id=46779645
----------------------------------------
🔖 Title: Velox: A Port of Tauri to Swift by Miguel de Icaza
🔗 URL: https://github.com/velox-apps/velox
👍 Score: [161]
💬 Discussion: https://news.ycombinator.com/item?id=46687729
----------------------------------------
🔖 Title: Snow Simulation Toy
🔗 URL: https://potch.me/2026/snow-simulation-toy.html
👍 Score: [150]
💬 Discussion: https://news.ycombinator.com/item?id=46691548
----------------------------------------
🔖 Title: SoundCloud Data Breach Now on HaveIBeenPwned
🔗 URL: https://haveibeenpwned.com/Breach/SoundCloud
👍 Score: [81]
💬 Discussion: https://news.ycombinator.com/item?id=46782930
----------------------------------------
🔖 Title: A simulation where life unfolds in real time
🔗 URL: https://soupof.life
👍 Score: [78]
💬 Discussion: https://news.ycombinator.com/item?id=46702948
----------------------------------------
🔖 Title: Lennart Poettering, Christian Brauner founded a new company
🔗 URL: https://amutable.com/about
👍 Score: [74]
💬 Discussion: https://news.ycombinator.com/item?id=46784572
----------------------------------------
🔖 Title: Prism
🔗 URL: https://openai.com/index/introducing-prism
👍 Score: [64]
💬 Discussion: https://news.ycombinator.com/item?id=46783752
----------------------------------------
🔖 Title: A first look at Aperture by Tailscale (private alpha)
🔗 URL: https://tailscale.com/blog/aperture-private-alpha
👍 Score: [62]
💬 Discussion: https://news.ycombinator.com/item?id=46782091
----------------------------------------
🔖 Title: OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
🔗 URL: https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467
👍 Score: [53]
💬 Discussion: https://news.ycombinator.com/item?id=46782662
----------------------------------------
🔖 Title: Doing the thing is doing the thing
🔗 URL: https://www.softwaredesign.ing/blog/doing-the-thing-is-doing-the-thing
👍 Score: [53]
💬 Discussion: https://news.ycombinator.com/item?id=46776155
----------------------------------------
🔖 Title: Flexible use of a multi-purpose tool by a cow
🔗 URL: https://doi.org/10.1016/j.cub.2025.11.059
👍 Score: [48]
💬 Discussion: https://news.ycombinator.com/item?id=46711159
----------------------------------------
🔖 Title: Two Twisty Shapes Resolve a Centuries-Old Topology Puzzle
🔗 URL: https://www.quantamagazine.org/two-twisty-shapes-resolve-a-centuries-old-topology-puzzle-20260120/
👍 Score: [40]
💬 Discussion: https://news.ycombinator.com/item?id=46770855
----------------------------------------
🔖 Title: AI2: Open Coding Agents
🔗 URL: https://allenai.org/blog/open-coding-agents
👍 Score: [27]
💬 Discussion: https://news.ycombinator.com/item?id=46783017
----------------------------------------
🔖 Title: One Human and One Agent = One Browser from Scratch
🔗 URL: https://simonwillison.net/2026/Jan/27/one-human-one-agent-one-browser/
👍 Score: [25]
💬 Discussion: https://news.ycombinator.com/item?id=46783024
----------------------------------------
🔖 Title: Clawdbot Renames to Moltbot
🔗 URL: https://github.com/moltbot/moltbot/commit/6d16a658e5ebe6ce15856565a47090d5b9d5dfb6
👍 Score: [19]
💬 Discussion: https://news.ycombinator.com/item?id=46783863
----------------------------------------

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing

Link: https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467
Discussion: https://news.ycombinator.com/item?id=46782662

OpenSSL Security Advisory

https://openssl-library.org/news/secadv/20260127.txt

One high, one medium, and 9 low severity issues.

The high severity is a stack buffer overflow in CMS AuthEnvelopedData parsing (CVE-2025-15467): attacker provides an oversized IV, leading to buffer overflow prior to authentication, possibly leading to remote code execution if you're parsing untrusted CMS or PKCS#7 content with AEAD (e.g., AES-GCM).

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
Link: https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467
Comments: https://news.ycombinator.com/item?id=46782662

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467
#ycombinator

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing

https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing - https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467

#hackernews

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing

https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467

#HackerNews

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing

Link: https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467
Discussion: https://news.ycombinator.com/item?id=46782662

OpenSSL Security Advisory

https://openssl-library.org/news/secadv/20260127.txt

One high, one medium, and 9 low severity issues.

The high severity is a stack buffer overflow in CMS AuthEnvelopedData parsing (CVE-2025-15467): attacker provides an oversized IV, leading to buffer overflow prior to authentication, possibly leading to remote code execution if you're parsing untrusted CMS or PKCS#7 content with AEAD (e.g., AES-GCM).

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
Link: https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467
Comments: https://news.ycombinator.com/item?id=46782662

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing
https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467
#ycombinator

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing

https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467

OpenSSL: Stack buffer overflow in CMS AuthEnvelopedData parsing

https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467

#HackerNews

🟠 CVE-2026-24837 - High (7.6)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a module friendly name could include scripts that will run during som...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24837/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24837 - High (7.6)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, a module friendly name could include scripts that will run during som...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24837/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24836 - High (7.6)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include script...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24836 - High (7.6)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Starting in version 9.0.0 and prior to versions 9.13.10 and 10.2.0, extensions could write richtext in log notes which can include script...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24833 - High (7.6)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module could install with richtext in its description field which could contain scripts that will...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24833 - High (7.6)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to versions 9.13.10 and 10.2.0, a module could install with richtext in its description field which could contain scripts that will...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-23830 - Critical (10)

SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Func...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23830/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-23830 - Critical (10)

SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Func...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23830/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67645 - High (8.8)

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control in the Profile Edit endpoint. An authenticated normal user can modify the request paramet...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67645 - High (8.8)

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control in the Profile Edit endpoint. An authenticated normal user can modify the request paramet...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-55292 - High (8.2)

Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC address, rather than their public key. This aspect downgrades the security, specifically by...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-55292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-55292 - High (8.2)

Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC address, rather than their public key. This aspect downgrades the security, specifically by...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-55292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

‼️CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Severity: Critical
CVSS: 9.8
Zero Day: Yes
CVE Published: January 27th, 2026

Advisory: https://github.com/advisories/GHSA-2x38-48vp-w23x

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

🚨 [CISA-2026:0127] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0127)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-24858 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24858)
- Name: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: Multiple Products
- Notes: Please adhere to Fortinet's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Fortinet products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://fortiguard.fortinet.com/psirt/FG-IR-26-060 ; https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios ; https://nvd.nist.gov/vuln/detail/CVE-2026-24858

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260127 #cisa20260127 #cve_2026_24858 #cve202624858

Fortinet Confirms Actively Exploited Critical FortiCloud SSO Zero-Day (CVE-2026-24858)

A New Authentication Bypass Shakes Fortinet’s Security Ecosystem Fortinet has confirmed the active exploitation of a previously unknown, critical authentication bypass vulnerability affecting its FortiCloud single sign-on (SSO) infrastructure. Tracked as CVE-2026-24858, the flaw allows attackers to gain unauthorized administrative access to Fortinet devices across different customer…

https://undercodenews.com/fortinet-confirms-actively-exploited-critical-forticloud-sso-zero-day-cve-2026-24858/

A single flaw in FortiCloud SSO let hackers jump from their own accounts straight into other companies’ networks, creating admin access in seconds. How did this happen and what does it mean for SSO security everywhere?

https://thedefendopsdiaries.com/anatomy-of-the-forticloud-sso-zero-day-cve-2026-24858-and-its-broader-implications/

🔴 CVE-2026-24858 - Critical (9.8)

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

‼️CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Severity: Critical
CVSS: 9.8
Zero Day: Yes
CVE Published: January 27th, 2026

Advisory: https://github.com/advisories/GHSA-2x38-48vp-w23x

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

🔴 CVE-2026-24858 - Critical (9.8)

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24778 - High (8.8)

Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaSc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24778 - High (8.8)

Ghost is an open source content management system. In Ghost versions 5.43.0 through 5.12.04 and 6.0.0 through 6.14.0, an attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaSc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24765 - High (7.8)

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

RE: https://phpc.social/@sebastian/115965753874226093

This is CVE-2026-24765 now.

🟠 CVE-2026-24765 - High (7.8)

PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and 8.5.52 involving unsafe deserialization of code coverage data in PHPT test execution. The vulnerability exists i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

RE: https://phpc.social/@sebastian/115965753874226093

This is CVE-2026-24765 now.

🟠 CVE-2025-59106 - High (8.8)

The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-59106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-59106 - High (8.8)

The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-59106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-21589 - Critical (9.8)

An Authentication Bypass Using an
Alternate Path or Channel vulnerability in Juniper Networks Session Smart
Router may allows a network-based attacker to bypass authentication
and take administrative control of the device.

This issue affects Sess...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-21589/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-21589 - Critical (9.8)

An Authentication Bypass Using an
Alternate Path or Channel vulnerability in Juniper Networks Session Smart
Router may allows a network-based attacker to bypass authentication
and take administrative control of the device.

This issue affects Sess...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-21589/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-21589 - Critical (9.8)

An Authentication Bypass Using an
Alternate Path or Channel vulnerability in Juniper Networks Session Smart
Router may allows a network-based attacker to bypass authentication
and take administrative control of the device.

This issue affects Sess...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-21589/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-21589 - Critical (9.8)

An Authentication Bypass Using an
Alternate Path or Channel vulnerability in Juniper Networks Session Smart
Router may allows a network-based attacker to bypass authentication
and take administrative control of the device.

This issue affects Sess...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-21589/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24881 - High (8.1)

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of serv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24881/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24881 - High (8.1)

In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily be leveraged for denial of serv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24881/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24747 - High (8.8)

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24747/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24747 - High (8.8)

PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24747/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24882 - High (8.4)

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24882 - High (8.4)

In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during handling of the PKDECRYPT command for TPM-backed RSA and ECC keys.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

‼️CISA has added 5 vulnerabilities to the KEV Catalog

https://darkwebinformer.com/cisa-kev-catalog/

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability

CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability

CVE ID: CVE-2026-23760
Vendor: SmarterTools
Product: SmarterMail
Date Added: 2026-01-26
Notes: https://www.smartertools.com/smartermail/release-notes/current ; https://nvd.nist.gov/vuln/detail/CVE-2026-23760
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23760

CISA has updated the KEV catalogue.

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-24061

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-23760

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-52691

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2018-14634 #CISA #Linux #infosec #vulnerability #GNU

New advisory.

High severity NVIDIA runx vulnerability: CVE-2025-33234 https://nvidia.custhelp.com/app/answers/detail/a_id/5764 #Nvidia #vulnerability #infosec

🟠 CVE-2025-33234 - High (7.8)

NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33234/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New advisory.

High severity NVIDIA runx vulnerability: CVE-2025-33234 https://nvidia.custhelp.com/app/answers/detail/a_id/5764 #Nvidia #vulnerability #infosec

🟠 CVE-2025-33234 - High (7.8)

NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33234/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23593 - High (7.5)

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affect...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23593/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23593 - High (7.5)

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affect...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23593/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24874 - Critical (9.1)

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in themrdemonized xray-monolith.This issue affects xray-monolith: before 2025.12.30.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24874/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24874 - Critical (9.1)

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in themrdemonized xray-monolith.This issue affects xray-monolith: before 2025.12.30.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24874/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24874 - Critical (9.1)

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in themrdemonized xray-monolith.This issue affects xray-monolith: before 2025.12.30.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24874/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24874 - Critical (9.1)

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in themrdemonized xray-monolith.This issue affects xray-monolith: before 2025.12.30.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24874/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24873 - High (7.8)

Out-of-bounds Read vulnerability in Rinnegatamante lpp-vita.This issue affects lpp-vita: before lpp-vita r6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24873/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24873 - High (7.8)

Out-of-bounds Read vulnerability in Rinnegatamante lpp-vita.This issue affects lpp-vita: before lpp-vita r6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24873/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24832 - Critical (9.8)

Out-of-bounds Write vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24832 - Critical (9.8)

Out-of-bounds Write vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24831 - High (7.5)

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24831/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24831 - High (7.5)

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24831/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24831 - High (7.5)

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24831/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24831 - High (7.5)

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24831/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22260 - High (7.5)

Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, Suricata can crash with a stack overflow. Version 8.0.3 patches the issue. As a workaround, use default values for `request-body-limit` and `respo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22260/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22260 - High (7.5)

Suricata is a network IDS, IPS and NSM engine. Starting in version 8.0.0 and prior to version 8.0.3, Suricata can crash with a stack overflow. Version 8.0.3 patches the issue. As a workaround, use default values for `request-body-limit` and `respo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22260/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23881 - High (7.7)

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine that allows users with policy creation privileges to cause denial of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23881/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23881 - High (7.7)

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have unbounded memory consumption in Kyverno's policy engine that allows users with policy creation privileges to cause denial of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23881/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24869 - High (8.1)

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability affects Firefox < 147.0.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24869/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24869 - High (8.1)

Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability affects Firefox < 147.0.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24869/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22039 - Critical (9.9)

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyverno Policy apiCall. The resolved `urlPath` is executed using the K...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22039 - Critical (9.9)

Kyverno is a policy engine designed for cloud native platform engineering teams. Versions prior to 1.16.3 and 1.15.3 have a critical authorization boundary bypass in namespaced Kyverno Policy apiCall. The resolved `urlPath` is executed using the K...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📢 Correctif d'urgence de Microsoft pour une zero‑day Office (CVE‑2026‑21509) activement exploitée
📝 Source: BleepingComputer — Microsoft diffuse des mis...
📖 cyberveille : https://cyberveille.ch/posts/2026-01-27-correctif-d-urgence-de-microsoft-pour-une-zero-day-office-cve-2026-21509-activement-exploitee/
🌐 source : https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-actively-exploited-office-zero-day-vulnerability/
#CVE_2026_21509 #Microsoft_Office #Cyberveille

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation
#CVE_2026_21509
https://thehackernews.com/2026/01/microsoft-issues-emergency-patch-for.html

[VULN] ⚠️"Une faille de Microsoft Office est activement exploitée par des pirates "

(NdR : cybercriminels et/ou opérateurs malveillants agissant pour le compte d’une entité soutenant les intérêts géopolitiques d’un État)

"Microsoft alerte sur une nouvelle faille critique dans Office. Déjà exploitée par des cybercriminels, la vulnérabilité permet de désactiver la sécurité mise en place par Microsoft. L’éditeur a commencé à déployer d’urgence un correctif pour Microsoft 365 et les versions récentes d’Office.

…

Pour protéger les internautes contre les attaques en cours, Microsoft a déployé une mise à jour qui « corrige la vulnérabilité qui contourne les mesures d’atténuation » d’Office. Les utilisateurs de Microsoft 365 et Microsoft Office sont invités à installer le correctif sans tarder.

Les utilisateurs d’Office 2021 et des versions ultérieures « seront automatiquement protégés grâce à une modification côté serveur, mais devront redémarrer leurs applications Office pour que cette modification prenne effet ». Il n’y a donc rien à faire, sauf redémarrer vos applications. Enfin, Microsoft n’a pas encore corrigé le tir sur Office 2016 et 2019. En attendant un correctif, Microsoft propose des mesures d’atténuation à ses utilisateurs."
👇
https://www.01net.com/actualites/faille-microsoft-office-activement-exploitee-pirates.html

🔬
⬇️
https://vulnerability.circl.lu/vuln/CVE-2026-21509

📜
⬇️
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509

💬
⬇️
https://infosec.pub/post/41135178

#CyberVeille #Microsoft #CVE_2026_21509

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation https://thehackernews.com/2026/01/microsoft-issues-emergency-patch-for.html

The vulnerability, tracked as CVE-2026-21509, carries a CVSS score of 7.8 out of 10.0. It has been described as a security feature bypass in Microsoft Office. https://thehackernews.com/2026/01/microsoft-issues-emergency-patch-for.html

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation

https://thehackernews.com/2026/01/microsoft-issues-emergency-patch-for.html

Microsoft a patché en urgence une faille de sécurité zero-day dans Office : CVE-2026-21509 https://www.it-connect.fr/microsoft-office-faille-zero-day-cve-2026-21509/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft #Office

Microsoft Issues Emergency Patch for Actively Exploited Office Zero-Day

Microsoft released emergency updates for an actively exploited Office zero-day (CVE-2026-21509) that allows attackers to bypass OLE security protections when a user opens a malicious file.

**For everyone using Microsoft Office, this is important and urgent. Hackers attack with malicious MS Office documents. Restart all Microsoft 365 and Office 2021 applications immediately to trigger the service-side security fix. For older versions like Office 2016, apply registry workarounds until Microsoft releases a formal patch.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/microsoft-issues-emergency-patch-for-actively-exploited-office-zero-day-v-8-i-f-4/gD2P6Ple2L

„In Office 2016 bis Office 2024 (auch LTSC), sowie die Microsoft 365 Apps für Unternehmen steckt eine Sicherheitslücke, die aktiv ausgenutzt wird.“

https://www.deskmodder.de/blog/2026/01/27/office-mit-aktiv-ausgenutzter-sicherheitsluecke-cve-2026-21509/

‼️CISA has added 5 vulnerabilities to the KEV Catalog

https://darkwebinformer.com/cisa-kev-catalog/

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability

CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability

CVE ID: CVE-2026-21509
Vendor: Microsoft
Product: Office
Date Added: 2026-01-26
Notes: Please adhere to Microsoft’s recommended guidelines to address this vulnerability. Implement all final mitigations provided by the vendor for Office 2021, and apply the interim corresponding mitigations for Office 2016 and Office 2019 until the final patch becomes available. For more information please see: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21509
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21509

‼️ CVE-2026-21509: Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally

▪️Zero Day: Yes; Actively exploited
▪️CVSS: 7.8
▪️CVE Published: Today, January 26th, 2026

Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509

Affected Products:

▪️Microsoft Office 2016 (64-bit edition)
▪️Microsoft Office 2016 (32-bit edition)
▪️Microsoft Office LTSC 2024 for 64-bit editions
▪️Microsoft Office LTSC 2024 for 32-bit editions
▪️Microsoft Office LTSC 2021 for 32-bit editions
▪️Microsoft Office LTSC 2021 for 64-bit editions
▪️Microsoft 365 Apps for Enterprise for 64-bit Systems
▪️Microsoft 365 Apps for Enterprise for 32-bit Systems
▪️Microsoft Office 2019 for 64-bit editions
▪️Microsoft Office 2019 for 32-bit editions

🟠 CVE-2026-21509 - High (7.8)

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Microsoft releases emergency patch for an Office zero-day

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509

🟠 CVE-2026-24875 - High (7.8)

Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24875/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24875 - High (7.8)

Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24875/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24872 - Critical (9.8)

improper pointer arithmetic

vulnerability in ProjectSkyfire SkyFire_548.This issue affects SkyFire_548: before 5.4.8-stable5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24872/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24872 - Critical (9.8)

improper pointer arithmetic

vulnerability in ProjectSkyfire SkyFire_548.This issue affects SkyFire_548: before 5.4.8-stable5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24872/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-68670 - Critical (9.1)

xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-68670/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-68670 - Critical (9.1)

xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-68670/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-1470 - Critical (9.9)

n8n contains a critical Remote Code Execution (RCE) vulnerability in its workflow Expression evaluation system. Expressions supplied by authenticated users during workflow configuration may be evaluated in an execution context that is not sufficie...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1470/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21720 - High (7.5)

Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the refresh sits in the 10-slot worker queue longer than three seconds, the handler times out and stops listening for the result, so that goroutine block...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

‼️CISA has added 5 vulnerabilities to the KEV Catalog

https://darkwebinformer.com/cisa-kev-catalog/

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability

CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability

CVE ID: CVE-2025-52691
Vendor: SmarterTools
Product: SmarterMail
Date Added: 2026-01-26
Notes: https://www.smartertools.com/smartermail/release-notes/current ; https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-52691
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-52691

CISA has updated the KEV catalogue.

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-24061

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-23760

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-52691

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2018-14634 #CISA #Linux #infosec #vulnerability #GNU

🟠 CVE-2025-41727 - High (7.8)

A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41727/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24828 - High (7.5)

Missing Release of Memory after Effective Lifetime vulnerability in Is-Daouda is-Engine.This issue affects is-Engine: before 3.3.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24828/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24830 - Critical (9.8)

Integer Overflow or Wraparound vulnerability in Ralim IronOS.This issue affects IronOS: before v2.23-rc2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24830/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21721 - High (8.1)

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashbo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21721/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24470 - High (8.1)

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enab...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24470/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-14459 - High (8.5)

A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechan...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14459/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-41726 - High (8.8)

A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41726/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24827 - High (7.5)

Out-of-bounds Write vulnerability in gerstrong Commander-Genius.This issue affects Commander-Genius: before Release refs/pull/358/merge.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24827/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1361 - High (7.8)

ASDA-Soft Stack-based Buffer Overflow Vulnerability

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1361/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24523 - High (7.5)

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <= 1.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24523/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24523 - High (7.5)

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <= 1.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24523/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24536 - High (7.5)

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve Embedded Sensitive Data.This issue affects Webpushr: from n/a through <= 4.38.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24536/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24531 - Critical (9.8)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusion.This issue affects Prowess: from n/a through <= 2.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24531/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New.

NIST: CVE-2026-24656: Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter https://nvd.nist.gov/vuln/detail/CVE-2026-24656 #infosec #vulnerability #Apache #NIST

Apache Hadoop HDFS Native Client Vulnerability

Apache Hadoop's HDFS native client contains a vulnerability (CVE-2025-27821) that allows attackers to cause system crashes or data corruption through an out-of-bounds write.

**If you are using Hadoop HDFS native client, plan an update. The flaw isn't immiediately exploited, so prioritize isolating and limiting who can access the Hadoop cluster using that client. Then plan an update to 3.4.2**
#cybersecurity #infosec #advisory #databreach
https://beyondmachines.net/event_details/apache-hadoop-hdfs-native-client-vulnerability-s-e-u-o-v/gD2P6Ple2L

🟠 CVE-2026-24490 - High (8.1)

MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim'...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24490/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24486 - High (8.6)

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24486/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24486 - High (8.6)

Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24486/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24534 - High (8.8)

Missing Authorization vulnerability in uPress Booter booter-bots-crawlers-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booter: from n/a through <= 1.5.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24532 - High (8.8)

Missing Authorization vulnerability in SiteLock SiteLock Security sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security: from n/a through <= 5.0.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24532/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24524 - High (8.1)

Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.1.35.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24524/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24524 - High (8.1)

Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.1.35.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24524/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22582 - Critical (9.8)

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagemen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22582/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22582 - Critical (9.8)

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagemen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22582/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22585 - Critical (9.8)

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Mani...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22585/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22585 - Critical (9.8)

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Mani...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22585/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24538 - High (7.6)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in omnipressteam Omnipress omnipress allows PHP Local File Inclusion.This issue affects Omnipress: from n/a through <= 1.6.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24538 - High (7.6)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in omnipressteam Omnipress omnipress allows PHP Local File Inclusion.This issue affects Omnipress: from n/a through <= 1.6.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

‼️CISA has added 5 vulnerabilities to the KEV Catalog

https://darkwebinformer.com/cisa-kev-catalog/

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability

CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability

‼️CVE-2026-24061: Telnet RCE Exploit

GitHub: https://github.com/SafeBreach-Labs/CVE-2026-24061

This script exploits the CVE-2026-24061 vulnerability in Telnet servers using a malformed USER environment variable.

CVSS: 9.8

Usage:

python telnet_rce.py <host> [-p <port>]

Arguments:

host: Target IP address or hostname (required)
-p, --port: Target port (default: 23)

Example:

python telnet_rce.py 192.168.1.100
python telnet_rce.py example.com -p 23

Writeup: https://www.safebreach.com/blog/safebreach-labs-root-cause-analysis-and-poc-exploit-for-cve-2026-24061/

CVE ID: CVE-2026-24061
Vendor: GNU
Product: InetUtils
Date Added: 2026-01-26
Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://cgit.git.savannah.gnu.org/cgit/inetutils.git ; https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc; https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b ; https://nvd.nist.gov/vuln/detail/CVE-2026-24061
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-24061

CISA has updated the KEV catalogue.

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-24061

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-23760

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-52691

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2018-14634 #CISA #Linux #infosec #vulnerability #GNU

The telnetd vuln has a CVE now - CVE-2026-24061

Proof of concept: https://github.com/SafeBreach-Labs/CVE-2026-24061/blob/main/telnet_rce.py

11-Year-Old critical telnetd flaw found in GNU InetUtils (CVE-2026-24061) https://securityaffairs.com/187255/security/11-year-old-critical-telnetd-flaw-found-in-gnu-inetutils-cve-2026-24061.html

Global: US, Ukraine, and Russia held talks in Abu Dhabi on Jan 24. Israel conducts a large-scale operation for the last hostage in Gaza.

Tech: Apple's iOS 26 update faces user complaints of bugs and battery drain (Jan 25). NVIDIA plans high-performance ARM chips for Q2 2026.

Cybersecurity: A critical GNU InetUtils telnetd vulnerability (CVE-2026-24061) is actively exploited for root access (Jan 24). New DynoWiper malware was used in a failed Sandworm attack on Poland's power sector (Jan 24).

#News #Anonymous #AnonNews_irc

GNU InetUtils telnetd Authentication Bypass Exploited in the Wild

A critical authentication bypass in GNU InetUtils telnetd (CVE-2026-24061) is actively exploited only days after the public reporting of the flaw. It's urgent that you block any telnet server you are using from the Internet.

**THIS IS URGENT! Check if you are using Telnet anywhere in your network. IMMEDIATELY isolate the Telnet interface to trusted networks and patch the code. Then stop using Telnet and switch to SSH.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/gnu-inetutils-telnetd-authentication-bypass-exploited-in-the-wild-8-f-f-u-3/gD2P6Ple2L

oh lol - 2026 - 9.8er (critical) CVE im *telnetd* :D (CVE-2026-24061)

https://nvd.nist.gov/vuln/detail/CVE-2026-24061

@distrowatch There's a critical vulnerability in the server side, CVE-2026-24061, to do with environment handling - see https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-telnetd-auth-bypass-flaw-to-get-root/

Telnet RCE Exploit https://github.com/SafeBreach-Labs/CVE-2026-24061

Hackers are now getting instant root access to thousands of legacy devices with a single Telnet handshake—no password needed. The flaw is shockingly simple and already being exploited. How safe are your old systems?

https://thedefendopsdiaries.com/cve-2026-24061-how-a-telnetd-flaw-grants-root-access-across-legacy-devices/

‼️CISA has added 5 vulnerabilities to the KEV Catalog

https://darkwebinformer.com/cisa-kev-catalog/

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability

CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability

CVE ID: CVE-2018-14634
Vendor: Linux
Product: Kernal
Date Added: 2026-01-26
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/about/ ; https://www.kernel.org/ ; https://www.cve.org/CVERecord?id=CVE-2018-14634; https://access.redhat.com/errata/RHSA-2018:3540 ; https://nvd.nist.gov/vuln/detail/CVE-2018-14634
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2018-14634

CISA has updated the KEV catalogue.

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-24061

CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-23760

CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-52691

CVE-2018-14634: Linux Kernel Integer Overflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2018-14634 #CISA #Linux #infosec #vulnerability #GNU

EUVD has listed critical CVE-2026-21962 Oracle HTTP Server vulnerability https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-3550

Oracle Critical Patch Update Advisory - January 2026 https://www.oracle.com/security-alerts/cpujan2026.html #infosec #vulnerability #Oracle

EUVD has listed critical CVE-2026-21962 Oracle HTTP Server vulnerability https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-3550

Oracle Critical Patch Update Advisory - January 2026 https://www.oracle.com/security-alerts/cpujan2026.html #infosec #vulnerability #Oracle

🔴 CVE-2026-22586 - Critical (9.8)

Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22586/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22586 - Critical (9.8)

Hard-coded Cryptographic Key vulnerability in Salesforce Marketing Cloud Engagement (CloudPages, Forward to a Friend, Profile Center, Subscription Center, Unsub Center, View As Webpage modules) allows Web Services Protocol Manipulation. This issue...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22586/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-22709 Exposes Critical vm2 Sandbox Escape Risk in Nodejs Environments

Introduction: A Familiar Sandbox, A Repeating Security Pattern The vm2 library has long been positioned as a safety layer for running untrusted JavaScript inside Node.js applications. For years, it served as a quiet backbone for SaaS platforms, online code runners, chatbots, and developer tools that needed isolation without sacrificing flexibility. However, history has shown that vm2’s…

https://undercodenews.com/cve-2026-22709-exposes-critical-vm2-sandbox-escape-risk-in-nodejs-environments/

Critical sandbox escape flaw discovered in popular vm2 NodeJS library

A critical-severity vulnerability in the vm2 Node.js sandbox library, tracked as CVE-2026-22709, allows escaping the sandbox and executing...

🔗️ [Bleepingcomputer] https://link.is.it/hbFnIL

Critical sandbox escape flaw discovered in popular vm2 NodeJS library

A critical-severity vulnerability in the vm2 Node.js sandbox library, tracked as CVE-2026-22709, allows escaping the sandbox and executing...

🔗️ [Bleepingcomputer] https://link.is.it/hbFnIL

🔴 CVE-2026-22709 - Critical (9.8)

vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22709/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

GitHub just updated these:

CVE-2026-22709, critical: vm2 has a Sandbox Escape https://github.com/advisories/GHSA-99p7-6v5w-7xg8

CVE-2026-22696, critical: dcap-qvl has Missing Verification for QE Identity https://github.com/advisories/GHSA-796p-j2gh-9m2q #infosec #vulnerability

GitHub just updated these:

CVE-2026-22709, critical: vm2 has a Sandbox Escape https://github.com/advisories/GHSA-99p7-6v5w-7xg8

CVE-2026-22696, critical: dcap-qvl has Missing Verification for QE Identity https://github.com/advisories/GHSA-796p-j2gh-9m2q #infosec #vulnerability

🔴 CVE-2026-22583 - Critical (9.8)

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module) allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engageme...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22583/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-52024 - Critical (9.4)

A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index listing all...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-52024/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-13952 - Critical (9.8)

A web page that contains unusual GPU shader code is loaded from the Internet into the GPU compiler process triggers a write use-after-free crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privile...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13952/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70982 - Critical (9.9)

Incorrect access control in the importUser function of SpringBlade v4.5.0 allows attackers with low-level privileges to arbitrarily import sensitive user data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67274 - High (7.5)

An issue in continuous.software aangine v.2025.2 allows a remote attacker to obtain sensitive information via the excel-integration-service template download module, integration-persistence-service job listing module, portfolio-item-service data r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-52026 - High (7.5)

An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend platform thru 2025-05-28. This unauthenticated endpoint returns a list of cashier accounts, including names, email addresses, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-52026/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-52025 - Critical (9.4)

An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability arises because user input is directly inserted into a dynamic SQL query syntax without pro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-52025/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67264 - High (7.8)

An OS command injection vulnerability in the com.sprd.engineermode component in Doogee Note59, Note59 Pro, and Note59 Pro+ allows a local attacker to execute arbitrary code and escalate privileges via the EngineerMode ADB shell, due to incomplete ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67264/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1283 - High (7.8)

A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS 2025 through Release SOLIDWORKS 2026 could allow an attacker to execute arbitrary code while opening a specially c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical File Upload Flaw reported RealHomes CRM Plugin

RealHomes CRM plugin version 1.0.1 patches a critical file upload vulnerability (CVE-2025-67968) that allowed low-privileged users to take over WordPress sites. The flaw affected over 30,000 real estate websites by failing to validate user permissions and file types.

**If you are using RealHomes CRM plugin, update it ASAP to version 1.0.1. Attackers can easily upload web shell and take over your website. When coding, always use proper permission checks and file type validation for file uploads.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-file-upload-flaw-reported-realhomes-crm-plugin-h-i-l-g-i/gD2P6Ple2L

🟠 CVE-2026-24367 - High (8.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through &lt; 3.2.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24367/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-66428 - High (8.8)

An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20736 - High (7.5)

Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an attachment to a repository may be able to delete it after losing access to that repository by making the request through a different rep...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20736/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-20897 - Critical (9.1)

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20897/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

If you missed this, Microsoft posted several security updates yesterday, all of them critical, affecting Microsoft accounts, Copilot, Office, Azure, and Entra: https://msrc.microsoft.com/update-guide

Noteworthy:

- Microsoft Account Spoofing Vulnerability: CVE-2026-21264 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21264

- Azure Entra ID Elevation of Privilege Vulnerability: CVE-2026-24305 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24305

- Azure Front Door Elevation of Privilege Vulnerability: CVE-2026-24306 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24306 #infosec #Microsoft #Azure #Copilot #vulnerability

🟠 CVE-2026-24609 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent laurent allows PHP Local File Inclusion.This issue affects Laurent: from n/a through &lt;= 3.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24609/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69908 - High (7.5)

An unauthenticated information disclosure vulnerability in Newgen OmniApp allows attackers to enumerate valid privileged usernames via a publicly accessible client-side JavaScript resource.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69908/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0710 - High (8.4)

A flaw was found in SIPp. A remote attacker could exploit this by sending specially crafted Session Initiation Protocol (SIP) messages during an active call. This vulnerability, a NULL pointer dereference, can cause the application to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0710/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-14866 - High (8.8)

The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigured capability check on the 'save_secondary_roles_field' function. This makes it possible ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14866/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-4320 - Critical (10)

Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Authentication Bypass, Password Recovery Exploitation.This issue affe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-4320/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15063 - Critical (9.8)

Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ollama MCP Server. Authentication is not required to exploit this ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15063/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-15062 - High (7.8)

Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15062/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0762 - High (8.1)

GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS serve...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0762/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1284 - High (7.8)

An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS 2025 through Release SOLIDWORKS 2026 could allow an attacker to execute arbitrary code while opening a specially crafted...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-13374 - Critical (9.8)

The Kalrav AI Agent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the kalrav_upload_file AJAX action in all versions up to, and including, 2.3.3. This makes it possible for unauthenticated atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13374/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1257 - High (7.5)

The Administrative Shortcodes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.3.4 via the 'slug' attribute of the 'get_template' shortcode. This is due to insufficient path validation on user-supp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1257/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24412 - High (8.8)

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have aHeap Buffer Overflow vulnerability in the CIccTagXmlSegmentedCurve::ToXml() function. This occurs ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24412/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70986 - High (7.5)

Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access sensitive department data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70986/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1428 - High (8.8)

Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1427 - High (8.8)

Organization Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1427/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1420 - High (8.8)

A flaw has been found in Tenda AC23 16.03.07.52. This impacts an unknown function of the file /goform/WifiExtraSet. This manipulation of the argument wpapsk_crypto causes buffer overflow. Remote exploitation of the attack is possible. The exploit ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1420/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0911 - High (7.5)

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action_import_module() function in all versions up to, and including, 7.8.9.2...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0911/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69180 - High (8.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind SQL Injection.This issue affects Ultra Portfolio: from n/a through &lt;= 6.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack