🟠 CVE-2026-26029 - High (7.5)

sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use of child_process.exec when constructing Salesforce CLI commands with user-controlled in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26029/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26029 - High (7.5)

sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use of child_process.exec when constructing Salesforce CLI commands with user-controlled in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26029/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21537 - High (8.8)

Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21537/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21537 - High (8.8)

Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21537/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21256 - High (8.8)

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21256 - High (8.8)

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2315 - High (8.8)

Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2315/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2315 - High (8.8)

Inappropriate implementation in WebGPU in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2315/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2313 - High (8.8)

Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2313/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2313 - High (8.8)

Use after free in CSS in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2313/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2319 - High (7.5)

Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicious extension to potentially exploit object corruption via a malicious file. (Chromium se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2319/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2319 - High (7.5)

Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicious extension to potentially exploit object corruption via a malicious file. (Chromium se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2319/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26010 - High (7.6)

OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres). Any read-only user can gain access to a high...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26010/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26010 - High (7.6)

OpenMetadata is a unified metadata platform. Prior to 1.11.8, calls issued by the UI against /api/v1/ingestionPipelines leak JWTs used by ingestion-bot for certain services (Glue / Redshift / Postgres). Any read-only user can gain access to a high...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26010/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25924 - High (8.4)

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25924 - High (8.4)

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25759 - High (8.7)

Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that execu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25759/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25759 - High (8.7)

Statmatic is a Laravel and Git powered content management system (CMS). From 6.0.0 to before 6.2.3, a stored XSS vulnerability in content titles allows authenticated users with content creation permissions to inject malicious JavaScript that execu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25759/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-64487 - High (7.6)

Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a privilege escalation vulnerability exists in the Outline document management system due to inconsistent authorization checks between user and group membership mana...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-64487/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-64487 - High (7.6)

Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a privilege escalation vulnerability exists in the Outline document management system due to inconsistent authorization checks between user and group membership mana...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-64487/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21246 - High (7.8)

Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21246/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21246 - High (7.8)

Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21246/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21250 - High (7.8)

Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21250 - High (7.8)

Untrusted pointer dereference in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2314 - High (8.8)

Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2314/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2314 - High (8.8)

Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2314/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21259 - High (7.8)

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21259/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21259 - High (7.8)

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to elevate privileges locally.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21259/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21260 - High (7.5)

Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21260/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21260 - High (7.5)

Exposure of sensitive information to an unauthorized actor in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21260/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21511 - High (7.5)

Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21511/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21511 - High (7.5)

Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21511/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21357 - High (7.8)

InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21357/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21357 - High (7.8)

InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21357/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2360 - High (8)

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privil...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2360/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2360 - High (8)

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privil...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2360/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Palo Alto has three new advisories.

- This affects several CVEs: PAN-SA-2026-0002 Chromium: Monthly Vulnerability Update (February 2026) https://security.paloaltonetworks.com/PAN-SA-2026-0002

- CVE-2026-0229 PAN-OS: Denial of Service in Advanced DNS Security Feature https://security.paloaltonetworks.com/CVE-2026-0229

- CVE-2026-0228 PAN-OS: Improper Validation of Terminal Server Agent Certificate https://security.paloaltonetworks.com/CVE-2026-0228 #PaloAlto #infosec #vulnerability

Palo Alto has three new advisories.

- This affects several CVEs: PAN-SA-2026-0002 Chromium: Monthly Vulnerability Update (February 2026) https://security.paloaltonetworks.com/PAN-SA-2026-0002

- CVE-2026-0229 PAN-OS: Denial of Service in Advanced DNS Security Feature https://security.paloaltonetworks.com/CVE-2026-0229

- CVE-2026-0228 PAN-OS: Improper Validation of Terminal Server Agent Certificate https://security.paloaltonetworks.com/CVE-2026-0228 #PaloAlto #infosec #vulnerability

🟠 CVE-2026-23715 - High (7.8)

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds write vulnerability while parsing specially crafted XDB files. This ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23715/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23716 - High (7.8)

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted XDB files. This c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23716/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23717 - High (7.8)

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted XDB files. This c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23717/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23718 - High (7.8)

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted NDB files. This c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23718 - High (7.8)

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted NDB files. This c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2361 - High (8)

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code. When the anon.get_tablesample_ratio function is then called, the malicious c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2361/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2361 - High (8)

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a function containing malicious code. When the anon.get_tablesample_ratio function is then called, the malicious c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2361/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Palo Alto has three new advisories.

- This affects several CVEs: PAN-SA-2026-0002 Chromium: Monthly Vulnerability Update (February 2026) https://security.paloaltonetworks.com/PAN-SA-2026-0002

- CVE-2026-0229 PAN-OS: Denial of Service in Advanced DNS Security Feature https://security.paloaltonetworks.com/CVE-2026-0229

- CVE-2026-0228 PAN-OS: Improper Validation of Terminal Server Agent Certificate https://security.paloaltonetworks.com/CVE-2026-0228 #PaloAlto #infosec #vulnerability

Palo Alto has three new advisories.

- This affects several CVEs: PAN-SA-2026-0002 Chromium: Monthly Vulnerability Update (February 2026) https://security.paloaltonetworks.com/PAN-SA-2026-0002

- CVE-2026-0229 PAN-OS: Denial of Service in Advanced DNS Security Feature https://security.paloaltonetworks.com/CVE-2026-0229

- CVE-2026-0228 PAN-OS: Improper Validation of Terminal Server Agent Certificate https://security.paloaltonetworks.com/CVE-2026-0228 #PaloAlto #infosec #vulnerability

🔴 CVE-2025-64075 - Critical (10)

A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-64075/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-64075 - Critical (10)

A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-64075/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25084 - Critical (9.8)

Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Authentication Bypass Flaws Reported in ZLAN Industrial Gateways

ZLAN5143D industrial gateways contain two critical vulnerabilities (CVE-2026-25084 and CVE-2026-24789) that allow unauthenticated remote attackers to bypass security and reset device passwords. The vendor has not yet responded to these issues and there are no patches.

**If you use ZLAN5143D gateways, make sure they are isolated from the internet and accessible only from trusted networks. Since the vendor hasn't provided a patch, network isolation and VPN-only access are your only defense. Reach out to the vendor for patches, and if no patches are available, start planning a replacement.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-flaws-uncovered-in-zlan-industrial-gateways-k-4-k-9-i/gD2P6Ple2L

🔴 CVE-2026-25084 - Critical (9.8)

Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Authentication Bypass Flaws Reported in ZLAN Industrial Gateways

ZLAN5143D industrial gateways contain two critical vulnerabilities (CVE-2026-25084 and CVE-2026-24789) that allow unauthenticated remote attackers to bypass security and reset device passwords. The vendor has not yet responded to these issues and there are no patches.

**If you use ZLAN5143D gateways, make sure they are isolated from the internet and accessible only from trusted networks. Since the vendor hasn't provided a patch, network isolation and VPN-only access are your only defense. Reach out to the vendor for patches, and if no patches are available, start planning a replacement.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-flaws-uncovered-in-zlan-industrial-gateways-k-4-k-9-i/gD2P6Ple2L

🔴 CVE-2026-24789 - Critical (9.8)

An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Authentication Bypass Flaws Reported in ZLAN Industrial Gateways

ZLAN5143D industrial gateways contain two critical vulnerabilities (CVE-2026-25084 and CVE-2026-24789) that allow unauthenticated remote attackers to bypass security and reset device passwords. The vendor has not yet responded to these issues and there are no patches.

**If you use ZLAN5143D gateways, make sure they are isolated from the internet and accessible only from trusted networks. Since the vendor hasn't provided a patch, network isolation and VPN-only access are your only defense. Reach out to the vendor for patches, and if no patches are available, start planning a replacement.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-flaws-uncovered-in-zlan-industrial-gateways-k-4-k-9-i/gD2P6Ple2L

🔴 CVE-2026-24789 - Critical (9.8)

An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Authentication Bypass Flaws Reported in ZLAN Industrial Gateways

ZLAN5143D industrial gateways contain two critical vulnerabilities (CVE-2026-25084 and CVE-2026-24789) that allow unauthenticated remote attackers to bypass security and reset device passwords. The vendor has not yet responded to these issues and there are no patches.

**If you use ZLAN5143D gateways, make sure they are isolated from the internet and accessible only from trusted networks. Since the vendor hasn't provided a patch, network isolation and VPN-only access are your only defense. Reach out to the vendor for patches, and if no patches are available, start planning a replacement.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-flaws-uncovered-in-zlan-industrial-gateways-k-4-k-9-i/gD2P6Ple2L

🟠 CVE-2026-23720 - High (7.8)

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds read vulnerability while parsing specially crafted NDB files. This c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21329 - High (7.8)

After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must ope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21329/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21329 - High (7.8)

After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must ope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21329/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21321 - High (7.8)

After Effects versions 25.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21321/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21321 - High (7.8)

After Effects versions 25.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21321/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21323 - High (7.8)

After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must ope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21323/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21323 - High (7.8)

After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must ope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21323/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21324 - High (7.8)

After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21324/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21324 - High (7.8)

After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21324/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21326 - High (7.8)

After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must ope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21326/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21326 - High (7.8)

After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must ope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21326/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21335 - High (7.8)

Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21335/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21335 - High (7.8)

Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21335/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21345 - High (7.8)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerabil...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21345/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21345 - High (7.8)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerabil...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21345/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21346 - High (7.8)

Bridge versions 15.1.3, 16.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21346/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21346 - High (7.8)

Bridge versions 15.1.3, 16.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21346/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21342 - High (7.8)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21342/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21342 - High (7.8)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21342/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

libpng 1.6.55 has been released with fix to CVE-2026-25646:

"CVE-2026-25646 (High): Heap buffer overflow in png_set_quantize when called with no histogram and a palette larger than twice the requested maximum number of colors.

The vulnerability exists in the color quantization code that reduces the number of colors in a palette. A logic error in the color distance table causes current palette indices to be stored where original indices are expected. After palette entries are swapped during color pruning, the index mismatch causes the pruning loop to fail to find valid candidates, the search bound grows past the end of a heap-allocated buffer, and out-of-bounds reads occur.

The images that trigger this vulnerability are valid per the PNG specification. The bug has existed since the initial version of png_set_quantize (then called png_set_dither).

Unlike the recent CVEs fixed in libpng 1.6.51, 1.6.52 and 1.6.54, whichaffected the simplified API, this vulnerability affects the low-level function png_set_quantize.

This can result in denial of service and potentially information disclosure or arbitrary code execution via heap corruption."

Announcement: https://www.openwall.com/lists/oss-security/2026/02/09/7
Advisory: https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3
Fix: https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88

#CVE_2026_25646 #vulnerability #infosec #cybersecurity

🟠 CVE-2026-25577 - High (7.5)

Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticate...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25577/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25577 - High (7.5)

Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticate...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25577/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-1235: CRITICAL deserialization flaw in WP eCommerce (≤3.15.1) allows unauthenticated PHP object injection via AJAX. No patch yet. Disable vulnerable AJAX actions & audit plugins. High risk for EU e-commerce sites. https://radar.offseq.com/threat/cve-2026-1235-cwe-502-deserialization-of-untrusted-67de3834 #OffSeq #WordPress #Security

🟠 CVE-2026-21312 - High (7.8)

Audition versions 25.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must op...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21312/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21312 - High (7.8)

Audition versions 25.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must op...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21312/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Windows RasMan Zero-Day Exploited: February 2026 Patch Released

Microsoft has urgently released security updates on February 10, 2026, to fix a critical zero-day vulnerability in the Windows Remote Access Connection Manager (RasMan) service. This flaw, tracked as CVE-2026-21525, is actively exploited in the wild, enabling attackers to crash systems and disrupt remote connections—a serious concern for organizations relying on VPNs, remote desktops, and other…

https://undercodenews.com/critical-windows-rasman-zero-day-exploited-february-2026-patch-released/

🔐 CVE-2026-21525
CVE-2026-21525

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

📊 CVSS Score: 6.2
⚠️ Severity: Medium
🚨 Exploited: true
📅 Published: 10.02.2026, 18:16
🏷️ Aliases: CVE-2026-21525
🛡️ CWE: CWE-476
🔗 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (secure@microsoft.com)
📚 References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21525

🚨 [CISA-2026:0210] CISA Adds 6 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0210)

CISA has added 6 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-21510 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21510)
- Name: Microsoft Windows Shell Protection Mechanism Failure Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21510

⚠️ CVE-2026-21513 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21513)
- Name: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-21513 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21513

⚠️ CVE-2026-21514 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21514)
- Name: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Office
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21514

⚠️ CVE-2026-21519 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21519)
- Name: Microsoft Windows Type Confusion Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21519

⚠️ CVE-2026-21525 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21525)
- Name: Microsoft Windows NULL Pointer Dereference Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21525

⚠️ CVE-2026-21533 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21533)
- Name: Microsoft Windows Improper Privilege Management Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21533

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260210 #cisa20260210 #cve_2026_21510 #cve_2026_21513 #cve_2026_21514 #cve_2026_21519 #cve_2026_21525 #cve_2026_21533 #cve202621510 #cve202621513 #cve202621514 #cve202621519 #cve202621525 #cve202621533

CISA has updated the KEV catalogue, and Microsoft is the winner.

- CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21514

- CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21519

- CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21533

- CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21510

- CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21525

CVE-2026-21513: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21513

More:

CISA Releases Guide to Help Critical Infrastructure Users Adopt More Secure Communication https://www.cisa.gov/news-events/news/cisa-releases-guide-help-critical-infrastructure-users-adopt-more-secure-communication

The guide: https://www.cisa.gov/resources-tools/resources/barriers-secure-ot-communication-why-johnny-cant-authenticate

Poland Energy Sector Cyber Incident Highlights OT and ICS Security Gaps https://www.cisa.gov/news-events/alerts/2026/02/10/poland-energy-sector-cyber-incident-highlights-ot-and-ics-security-gaps #CISA #infosec #Microsoft #vulnerability

CVE ID: CVE-2026-21525
Vendor: Microsoft
Product: Windows
Date Added: 2026-02-10
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21525
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21525

‼️ CISA has added 6 vulnerabilities to the KEV Catalog

CVE-2026-21513: Microsoft Internet Explorer Protection Mechanism Failure Vulnerability: Microsoft Internet Explorer contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability: Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.

CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability: Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability: Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.

CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability: Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.

CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability: Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.

🔐 CVE-2026-21525
CVE-2026-21525

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

📊 CVSS Score: 6.2
⚠️ Severity: Medium
🚨 Exploited: true
📅 Published: 10.02.2026, 18:16
🏷️ Aliases: CVE-2026-21525
🛡️ CWE: CWE-476
🔗 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (secure@microsoft.com)
📚 References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21525

CISA has updated the KEV catalogue, and Microsoft is the winner.

- CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21514

- CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21519

- CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21533

- CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21510

- CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21525

CVE-2026-21513: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21513

More:

CISA Releases Guide to Help Critical Infrastructure Users Adopt More Secure Communication https://www.cisa.gov/news-events/news/cisa-releases-guide-help-critical-infrastructure-users-adopt-more-secure-communication

The guide: https://www.cisa.gov/resources-tools/resources/barriers-secure-ot-communication-why-johnny-cant-authenticate

Poland Energy Sector Cyber Incident Highlights OT and ICS Security Gaps https://www.cisa.gov/news-events/alerts/2026/02/10/poland-energy-sector-cyber-incident-highlights-ot-and-ics-security-gaps #CISA #infosec #Microsoft #vulnerability

CVE ID: CVE-2026-21525
Vendor: Microsoft
Product: Windows
Date Added: 2026-02-10
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21525
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21525

‼️ CISA has added 6 vulnerabilities to the KEV Catalog

CVE-2026-21513: Microsoft Internet Explorer Protection Mechanism Failure Vulnerability: Microsoft Internet Explorer contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability: Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.

CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability: Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability: Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.

CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability: Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.

CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability: Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.

I'm just reading this GNU telnetd CVE from last month. I did not realize that telnet was still a thing, but it turns out anybody could provide a username of "-f root" and, boom, they had root. The vulnerability existed for 11 years. *Wow*. https://www.cve.org/CVERecord?id=CVE-2026-24061

I can't remember if I cried
When my `-f root` hit an ACL line
But something touched me deep inside…

The day the telnet died

On January 14, 2026, global telnet traffic observed by the GreyNoise Global Observation Grid fell off a cliff. A 59% sustained reduction, eighteen ASNs going completely silent, five countries vanishing (telnet-wise) from our data entirely. Six days later, CVE-2026-24061 dropped. Coincidence is one explanation.

https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/

~/CVE/CVE-2026-24061_telnetd

Analisi approfondita del CVE-2026-24061 telnetd exploit. Scopri come una mancata sanificazione in GNU InetUtils permetta l'ottenimento di privilegi...

🔗️ [Lobsec] https://link.is.it/6L9jY6

I'm just reading this GNU telnetd CVE from last month. I did not realize that telnet was still a thing, but it turns out anybody could provide a username of "-f root" and, boom, they had root. The vulnerability existed for 11 years. *Wow*. https://www.cve.org/CVERecord?id=CVE-2026-24061

I can't remember if I cried
When my `-f root` hit an ACL line
But something touched me deep inside…

The day the telnet died

On January 14, 2026, global telnet traffic observed by the GreyNoise Global Observation Grid fell off a cliff. A 59% sustained reduction, eighteen ASNs going completely silent, five countries vanishing (telnet-wise) from our data entirely. Six days later, CVE-2026-24061 dropped. Coincidence is one explanation.

https://www.labs.greynoise.io/grimoire/2026-02-10-telnet-falls-silent/

~/CVE/CVE-2026-24061_telnetd

Analisi approfondita del CVE-2026-24061 telnetd exploit. Scopri come una mancata sanificazione in GNU InetUtils permetta l'ottenimento di privilegi...

🔗️ [Lobsec] https://link.is.it/6L9jY6

🟠 CVE-2026-21513 - High (8.8)

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21513/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔐 CVE-2026-21513
CVE-2026-21513

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

📊 CVSS Score: 8.8
⚠️ Severity: High
🚨 Exploited: true
📅 Published: 10.02.2026, 18:16
🏷️ Aliases: CVE-2026-21513
🛡️ CWE: CWE-693
🔗 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (secure@microsoft.com)
📚 References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513

🚨 [CISA-2026:0210] CISA Adds 6 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0210)

CISA has added 6 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-21510 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21510)
- Name: Microsoft Windows Shell Protection Mechanism Failure Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21510

⚠️ CVE-2026-21513 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21513)
- Name: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-21513 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21513

⚠️ CVE-2026-21514 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21514)
- Name: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Office
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21514

⚠️ CVE-2026-21519 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21519)
- Name: Microsoft Windows Type Confusion Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21519

⚠️ CVE-2026-21525 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21525)
- Name: Microsoft Windows NULL Pointer Dereference Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21525

⚠️ CVE-2026-21533 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21533)
- Name: Microsoft Windows Improper Privilege Management Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21533

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260210 #cisa20260210 #cve_2026_21510 #cve_2026_21513 #cve_2026_21514 #cve_2026_21519 #cve_2026_21525 #cve_2026_21533 #cve202621510 #cve202621513 #cve202621514 #cve202621519 #cve202621525 #cve202621533

CISA has updated the KEV catalogue, and Microsoft is the winner.

- CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21514

- CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21519

- CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21533

- CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21510

- CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21525

CVE-2026-21513: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21513

More:

CISA Releases Guide to Help Critical Infrastructure Users Adopt More Secure Communication https://www.cisa.gov/news-events/news/cisa-releases-guide-help-critical-infrastructure-users-adopt-more-secure-communication

The guide: https://www.cisa.gov/resources-tools/resources/barriers-secure-ot-communication-why-johnny-cant-authenticate

Poland Energy Sector Cyber Incident Highlights OT and ICS Security Gaps https://www.cisa.gov/news-events/alerts/2026/02/10/poland-energy-sector-cyber-incident-highlights-ot-and-ics-security-gaps #CISA #infosec #Microsoft #vulnerability

CVE ID: CVE-2026-21513
Vendor: Microsoft
Product: Windows
Date Added: 2026-02-10
Notes: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-21513 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21513
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21513

‼️ CISA has added 6 vulnerabilities to the KEV Catalog

CVE-2026-21513: Microsoft Internet Explorer Protection Mechanism Failure Vulnerability: Microsoft Internet Explorer contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability: Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.

CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability: Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability: Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.

CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability: Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.

CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability: Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.

🟠 CVE-2026-21513 - High (8.8)

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21513/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔐 CVE-2026-21513
CVE-2026-21513

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

📊 CVSS Score: 8.8
⚠️ Severity: High
🚨 Exploited: true
📅 Published: 10.02.2026, 18:16
🏷️ Aliases: CVE-2026-21513
🛡️ CWE: CWE-693
🔗 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (secure@microsoft.com)
📚 References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513

CISA has updated the KEV catalogue, and Microsoft is the winner.

- CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21514

- CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21519

- CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21533

- CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21510

- CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21525

CVE-2026-21513: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21513

More:

CISA Releases Guide to Help Critical Infrastructure Users Adopt More Secure Communication https://www.cisa.gov/news-events/news/cisa-releases-guide-help-critical-infrastructure-users-adopt-more-secure-communication

The guide: https://www.cisa.gov/resources-tools/resources/barriers-secure-ot-communication-why-johnny-cant-authenticate

Poland Energy Sector Cyber Incident Highlights OT and ICS Security Gaps https://www.cisa.gov/news-events/alerts/2026/02/10/poland-energy-sector-cyber-incident-highlights-ot-and-ics-security-gaps #CISA #infosec #Microsoft #vulnerability

CVE ID: CVE-2026-21513
Vendor: Microsoft
Product: Windows
Date Added: 2026-02-10
Notes: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-21513 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21513
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21513

‼️ CISA has added 6 vulnerabilities to the KEV Catalog

CVE-2026-21513: Microsoft Internet Explorer Protection Mechanism Failure Vulnerability: Microsoft Internet Explorer contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability: Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.

CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability: Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability: Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.

CVE-2026-21519: Microsoft Windows Type Confusion Vulnerability: Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.

CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability: Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.

🔴 CVE-2025-8025 - Critical (9.8)

Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dinosoft ERP: from < 3.0.1 throug...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8025/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-8025 - Critical (9.8)

Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dinosoft ERP: from < 3.0.1 throug...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8025/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0910 - High (8.8)

The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13 via deserialization of untrusted input in the 'wpforo_display_array_data' function. This makes it possible for authenticated a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0910/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0910 - High (8.8)

The wpForo Forum plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.13 via deserialization of untrusted input in the 'wpforo_display_array_data' function. This makes it possible for authenticated a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0910/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-8668 - Critical (9.4)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard allows Reflected XSS.This issue a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-8668 - Critical (9.4)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard allows Reflected XSS.This issue a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-12059 - Critical (9.8)

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Logo Software Industry and Trade Inc. Logo j-Platform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Logo ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-12059 - Critical (9.8)

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Logo Software Industry and Trade Inc. Logo j-Platform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Logo ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48503 - High (7.8)

A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48503/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48503 - High (7.8)

A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48503/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2250 - High (7.5)

The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2250 - High (7.5)

The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2249 - Critical (9.8)

METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with &#03...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2249/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2249 - Critical (9.8)

METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with &#03...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2249/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2248 - Critical (9.8)

METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2248/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2248 - Critical (9.8)

METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2248/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: CVE-2026-1560 in Lazy Blocks (WordPress, ≤4.2.0) lets Contributor+ users run arbitrary code via improper code generation (CWE-94). No public exploits yet — restrict roles and monitor activity! https://radar.offseq.com/threat/cve-2026-1560-cwe-94-improper-control-of-generatio-655d2091 #OffSeq #WordPress #RCE #Vuln

🚨 CRITICAL: CVE-2026-1357 impacts WPvivid Backup & Migration (all versions). Unauthenticated file upload via directory traversal enables RCE. Disable plugin or restrict access immediately! https://radar.offseq.com/threat/cve-2026-1357-cwe-434-unrestricted-upload-of-file--8f35918d #OffSeq #WordPress #Infosec #CVE20261357

A critical arbitrary file upload vulnerability (CVE-2026-1357, CVSS 9.8) was discovered in the WPvivid Backup & Migration plugin, which is installed on over 800,000 WordPress sites.

The flaw allows unauthenticated attackers to upload arbitrary files, potentially achieving remote code execution and full site takeover.

Update to version 0.9.124. Wordfence Premium users received firewall protection on January 22.

https://www.wordfence.com/blog/2026/02/800000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-wpvivid-backup-wordpress-plugin/

#WordPress #WebSecurity #Wordfence

@odo
From https://www.cve.org/CVERecord?id=CVE-2026-20841
> Improper neutralization of special elements used in a command ('command injection') […]

So maybe notepad just runs something like
```cmd
start "" $link_src
```

And when you write something like
```md
[trust me bro](mailto:foo@bar.baz & echo u pwnd)
```
in your md ...

It maybe translates to something like
```cmd
start "" mailto:foo@bar.baz & echo u pwnd
```

I don't know what the actual vuln is. But sounds like something like the above. Hopefully not that simple. 🤞

@AmeliaBR

@mttaggart for those utilizing MS defender stack here is a detection for it:
https://github.com/0x-cde/Threat-Hunting-with-KQL/blob/main/Queries/CVE-2026-20841.md

⚠️ Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code over a network

https://www.cve.org/CVERecord?id=CVE-2026-20841

#notepad #CVE202620841 #cybersecurity

moves.
- TikTok launches opt-in Local Feed in the US using precise location data.
- Windows Notepad remote code execution vulnerability CVE-2026-20841.
- Europe’s hypersonic program: Mach 6 test completed in Norway as defense autonomy advances. [2/2]

https://winbuzzer.com/2026/02/11/microsoft-patches-notepad-rce-vulnerability-cve-2026-20841-xcxwbn/

Microsoft Patches High-Severity Notepad Remote Code Execution Flaw

#Cybersecurity #MicrosoftNotepad #Microsoft #Windows #MicrosoftWindows #Windows11 #PatchTuesday #SecurityPatches #WindowsVulnerability #Vulnerability

Here's my CVE-2026-20841 PoC.

(Not really, but I have a feeling it's something that rhymes with this)

The Vibe-coding Era at Microsoft is going greaaaaaaaat.... https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

Looks like the vibe coders at Microsoft forgot to add "don't introduce command injection vulnerabilities" to their prompts?

https://www.cve.org/CVERecord?id=CVE-2026-20841

🔥 Notepad colpito da vulnerabilità critica
Notepad in Windows 11 espone milioni di PC a un attacco remoto: la vulnerabilità CVE-2026-20841 sfrutta il supporto Markdown per eseguire codice malevolo con un semplice clic su un link

https://gomoot.com/notepad-di-windows-11-colpito-da-vulnerabilita-critica/

#news #notepad #sicurezza #tech

Windows Notepad App Remote Code Execution Vulnerability: https://www.cve.org/CVERecord?id=CVE-2026-20841

Discussion: http://news.ycombinator.com/item?id=46971516

Windows Notepad App Remote Code Execution Vulnerability

Link: https://www.cve.org/CVERecord?id=CVE-2026-20841
Discussion: https://news.ycombinator.com/item?id=46971516

Imagine being jail to an operating system where even the blast editor is vulnerable

Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code over a network.

https://www.cve.org/CVERecord?id=CVE-2026-20841

Keep contributing and funding alternatives for all of us.

#windows #linux #foss #infosec #opensource

https://www.cve.org/CVERecord?id=CVE-2026-20841

Notepad++: alcune mie versioni erano vulnerabili

MS Notepad: hold my beer

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

Windows Notepad App Remote Code Execution Vulnerability https://lobste.rs/s/kp7jlq #windows
https://www.cve.org/CVERecord?id=CVE-2026-20841

Remote Code Execution on notepad
FUCKING NOTEPAD

Microsoft, keep your claws out of the working code! Notepad does NOT need upgrades to be anything else than an entirely plain text editor.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

Just A+ work all around.

"Windows Notepad App Remote Code Execution Vulnerability"

https://www.cve.org/CVERecord?id=CVE-2026-20841

Falha crítica no Bloco de notas (CVE-2026-20841). Um invasor poderia colocar um link malicioso em um arquivo Markdown que, ao ser clicado pela vítima, executaria códigos remotamente. Quem mandou macular a simplicidade do Bloco de notas? Já tem correção disponível. https://www.cve.org/CVERecord?id=CVE-2026-20841&utm_medium=social&utm_source=manualdousuario

Windows Notepad App Remote Code Execution Vulnerability: https://www.cve.org/CVERecord?id=CVE-2026-20841

Discussion: http://news.ycombinator.com/item?id=46971516

1976:
In fünfzig Jahren werden wir fliegende Autos haben.

2026:
Schwere Sicherheitslücke in ... Notepad.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

Что ни день, то повод посмеяться над микрослопом.

Была обнаружена уязвимость, которая позволяет злоумышленникам запускать произвольный код на компьютере жертвы через БЛОКНОТ, сука. Серьёзность уязвимости помечена как ВЫСОКАЯ

https://www.cve.org/CVERecord?id=CVE-2026-20841

Windows Notepad App Remote Code Execution Vulnerability: https://www.cve.org/CVERecord?id=CVE-2026-20841

Discussion: http://news.ycombinator.com/item?id=46971516

Windows Notepad App Remote Code Execution Vulnerability

Link: https://www.cve.org/CVERecord?id=CVE-2026-20841
Discussion: https://news.ycombinator.com/item?id=46971516

Notepad.exe RCE Vulnerability 8.8
Are you shitting me?

https://www.cve.org/CVERecord?id=CVE-2026-20841

#cve202620841 #notepad #windows #rce #infosec

Windows Notepad App Remote Code Execution Vulnerability: https://www.cve.org/CVERecord?id=CVE-2026-20841

Discussion: http://news.ycombinator.com/item?id=46971516

Notepad... NOTEPAD!

CVE Record: CVE-2026-20841

https://www.cve.org/CVERecord?id=CVE-2026-20841

What the.. how?

Notepad was the simplest application on windows. What have they done to it?

https://www.cve.org/CVERecord?id=CVE-2026-20841

Really looking forward to the analysis of this remote code execution vulnerability in [checks notes] Windows Notepad

https://www.cve.org/CVERecord?id=CVE-2026-20841

Windows Notepad App Remote Code Execution Vulnerability

Link: https://www.cve.org/CVERecord?id=CVE-2026-20841
Discussion: https://news.ycombinator.com/item?id=46971516

Microsoft hat NOTEPAD.EXE jetzt erfolgreich kaputt gespielt.

https://www.cve.org/CVERecord?id=CVE-2026-20841

#copilot #clippy

Notepad RCE? https://cvefeed.io/vuln/detail/CVE-2026-20841

lmao, it's 2026 and we have spaceships in the heliosphere, high-resolution images of Pluto and a permanent robotic presence, in orbit and on ground, on Mars.

plus remote code execution in fucking Notepad.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

#slop

age-verification concerns.
- Windows security flaws: multiple 2026 CVEs (Notepad RCE CVE-2026-20841; MSHTML; CVE-2026-21510/13/19/25/33) and ongoing Patch Tuesday updates.
- AI and work: productivity boosts but rising cognitive load and burnout; AI adoption altering job markets and roles.
- Open/indie web and OSS: growing use of Pixelfed, Matrix, Zulip; open-source Discord alternatives (Stoat chat); broader Fediverse/indie-web movement.
- Space/AI funding and policy: [2/3]

Windows Notepad App Remote Code Execution Vulnerability
Link: https://www.cve.org/CVERecord?id=CVE-2026-20841
Comments: https://news.ycombinator.com/item?id=46971516

lol

Windows Notepad App Remote Code Execution Vulnerability

https://www.cve.org/CVERecord?id=CVE-2026-20841

📜 Latest Top Story on #HackerNews: Windows Notepad App Remote Code Execution Vulnerability
🔍 Original Story: https://www.cve.org/CVERecord?id=CVE-2026-20841
👤 Author: riffraff
⭐ Score: 63
💬 Number of Comments: 12
🕒 Posted At: 2026-02-11 06:15:33 UTC
🔗 URL: https://news.ycombinator.com/item?id=46971516
#news #hackernewsbot #bot #hackernews

Windows Notepad App Remote Code Execution Vulnerability

Link: https://www.cve.org/CVERecord?id=CVE-2026-20841
Discussion: https://news.ycombinator.com/item?id=46971516

#Windows #sécurité
Oh misère, y'a même des failles RCE dans le Notepad de Windows ???
https://www.cve.org/CVERecord?id=CVE-2026-20841

Windows Notepad App Remote Code Execution Vulnerability - https://www.cve.org/CVERecord?id=CVE-2026-20841

#hackernews

Windows Notepad App Remote Code Execution Vulnerability

https://www.cve.org/CVERecord?id=CVE-2026-20841

#HackerNews

Windows Notepad App Remote Code Execution Vulnerability

https://www.cve.org/CVERecord?id=CVE-2026-20841

#windows

Notepad was nice because all it did was display some text. Not necessarily very well, but it was better than whatever combination of decisions lead to “Windows Notepad App Remote Code Execution Vulnerability”.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

Microsoft: I have made Notepad✨

Security researchers: You fucked up a perfectly good plaintext editor is what you did. Look at it. It's got RCEs.

https://www.cve.org/CVERecord?id=CVE-2026-20841

They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector.

This CVE is an 8.8 severity RCE in Notepad of all things lmao.

Apparently, the "innovation" of adding markdown support came with the ability of launching unverified protocols that load and execute remote files.

We have reached a point where the simple act of opening a .md file in a native utility can compromise your system. Is nothing safe anymore? 😭

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

#noai #microslop #microsoft #windows #programming #writing #windows11 #enshittification #cybersecurity #infosec #technology

What is it, Microsoft shited their pants again lol ​:neofox_laugh_tears:​
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841
Even this page didn't load properly ​:neofox_laugh_tears:​
#Microsoft #windows

@stefan@akko.lightnovel-dungeon.de @volpeon@icy.wyvern.rip Nope.

Here is the CVE
https://www.cve.org/CVERecord?id=CVE-2026-20841

microsoft: we have made a new notepad.exe

everyone else: you f***ed up a perfectly good text editor, is what you did. look at it. it's got RCE.

https://www.cve.org/CVERecord?id=CVE-2026-20841

CVE-2026-20841 = Windows Notepad App Remote Code Execution Vulnerability

"An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files."

lolwut

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

someone earlier today said "RCE in Notepad" and i was like "haha funny" and then someone ELSE said RCE in Notepad and then i was like youve gotta be fucking kidding me

Kein Kommentar. Wäre nicht zitierfähig. Aber...
RCE im Notizblock?! Wie verstrahlt- uhm "vibed" ist das denn?!

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

https://www.cve.org/CVERecord?id=CVE-2026-20841

Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code over a network.

Notepad

over a network

Microsoft Windows 11 enshitification continues with its screwing up what was a perfectly functional text file editor - Notepad - adding layers of garbage on it and congratulations, Notepad, yes, bleeding Notepad now has a code execution vulnerability on it.

https://www.cve.org/CVERecord?id=CVE-2026-20841

It's only the Windows 11 Notepad they've screwed up - anyone on any earlier version, which for safety's sake should only be online if it is Windows 10 with the Extended Service Updates (new one just today), is fine.

RE: https://tech.lgbt/@solonovamax/116049115040950367

https://www.cve.org/CVERecord?id=CVE-2026-20841

WHAT'S THE NETWORK ELEMENT in FUCKING NOTEPAD

WHAT BIT COULD IT BEEEEEEEE

edit: ahhh! the notepad thing might not be copilot. the bug is that a URL in a markdown file can actually be a sploit that runs stuff as the user. so this may not be an ai story. dammit.

"Windows Notepad App Remote Code Execution Vulnerability"

That's it: I'm going back to AppleWorks, on my Apple IIe.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

CVE-2026-20841

@m4rc3l CVE-2026-20841 #c3d2leaks

From the WTF department, sorry, I mean from Microsoft: an RCE in Notepad of all things. (Well, the new app with AI and stuff; not the old one.)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

A vulnerability in Notepad 🤦‍♂️
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

@mttaggart for those utilizing MS defender stack here is a detection for it:
https://github.com/0x-cde/Threat-Hunting-with-KQL/blob/main/Queries/CVE-2026-20841.md

⚠️ Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code over a network

https://www.cve.org/CVERecord?id=CVE-2026-20841

#notepad #CVE202620841 #cybersecurity

https://winbuzzer.com/2026/02/11/microsoft-patches-notepad-rce-vulnerability-cve-2026-20841-xcxwbn/

Microsoft Patches High-Severity Notepad Remote Code Execution Flaw

#Cybersecurity #MicrosoftNotepad #Microsoft #Windows #MicrosoftWindows #Windows11 #PatchTuesday #SecurityPatches #WindowsVulnerability #Vulnerability

Here's my CVE-2026-20841 PoC.

(Not really, but I have a feeling it's something that rhymes with this)

The Vibe-coding Era at Microsoft is going greaaaaaaaat.... https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

🔥 Notepad colpito da vulnerabilità critica
Notepad in Windows 11 espone milioni di PC a un attacco remoto: la vulnerabilità CVE-2026-20841 sfrutta il supporto Markdown per eseguire codice malevolo con un semplice clic su un link

https://gomoot.com/notepad-di-windows-11-colpito-da-vulnerabilita-critica/

#news #notepad #sicurezza #tech

Windows Notepad App Remote Code Execution Vulnerability

Link: https://www.cve.org/CVERecord?id=CVE-2026-20841
Discussion: https://news.ycombinator.com/item?id=46971516

Imagine being jail to an operating system where even the blast editor is vulnerable

Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code over a network.

https://www.cve.org/CVERecord?id=CVE-2026-20841

Keep contributing and funding alternatives for all of us.

#windows #linux #foss #infosec #opensource

Windows Notepad App Remote Code Execution Vulnerability https://lobste.rs/s/kp7jlq #windows
https://www.cve.org/CVERecord?id=CVE-2026-20841

Remote Code Execution on notepad
FUCKING NOTEPAD

Microsoft, keep your claws out of the working code! Notepad does NOT need upgrades to be anything else than an entirely plain text editor.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

Just A+ work all around.

"Windows Notepad App Remote Code Execution Vulnerability"

https://www.cve.org/CVERecord?id=CVE-2026-20841

Falha crítica no Bloco de notas (CVE-2026-20841). Um invasor poderia colocar um link malicioso em um arquivo Markdown que, ao ser clicado pela vítima, executaria códigos remotamente. Quem mandou macular a simplicidade do Bloco de notas? Já tem correção disponível. https://www.cve.org/CVERecord?id=CVE-2026-20841&utm_medium=social&utm_source=manualdousuario

1976:
In fünfzig Jahren werden wir fliegende Autos haben.

2026:
Schwere Sicherheitslücke in ... Notepad.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

Что ни день, то повод посмеяться над микрослопом.

Была обнаружена уязвимость, которая позволяет злоумышленникам запускать произвольный код на компьютере жертвы через БЛОКНОТ, сука. Серьёзность уязвимости помечена как ВЫСОКАЯ

https://www.cve.org/CVERecord?id=CVE-2026-20841

Windows Notepad App Remote Code Execution Vulnerability

Link: https://www.cve.org/CVERecord?id=CVE-2026-20841
Discussion: https://news.ycombinator.com/item?id=46971516

Notepad.exe RCE Vulnerability 8.8
Are you shitting me?

https://www.cve.org/CVERecord?id=CVE-2026-20841

#cve202620841 #notepad #windows #rce #infosec

Notepad... NOTEPAD!

CVE Record: CVE-2026-20841

https://www.cve.org/CVERecord?id=CVE-2026-20841

What the.. how?

Notepad was the simplest application on windows. What have they done to it?

https://www.cve.org/CVERecord?id=CVE-2026-20841

Really looking forward to the analysis of this remote code execution vulnerability in [checks notes] Windows Notepad

https://www.cve.org/CVERecord?id=CVE-2026-20841

Windows Notepad App Remote Code Execution Vulnerability

Link: https://www.cve.org/CVERecord?id=CVE-2026-20841
Discussion: https://news.ycombinator.com/item?id=46971516

Microsoft hat NOTEPAD.EXE jetzt erfolgreich kaputt gespielt.

https://www.cve.org/CVERecord?id=CVE-2026-20841

#copilot #clippy

Notepad RCE? https://cvefeed.io/vuln/detail/CVE-2026-20841

lmao, it's 2026 and we have spaceships in the heliosphere, high-resolution images of Pluto and a permanent robotic presence, in orbit and on ground, on Mars.

plus remote code execution in fucking Notepad.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

#slop

Windows Notepad App Remote Code Execution Vulnerability
Link: https://www.cve.org/CVERecord?id=CVE-2026-20841
Comments: https://news.ycombinator.com/item?id=46971516

lol

Windows Notepad App Remote Code Execution Vulnerability

https://www.cve.org/CVERecord?id=CVE-2026-20841

Windows Notepad App Remote Code Execution Vulnerability

Link: https://www.cve.org/CVERecord?id=CVE-2026-20841
Discussion: https://news.ycombinator.com/item?id=46971516

#Windows #sécurité
Oh misère, y'a même des failles RCE dans le Notepad de Windows ???
https://www.cve.org/CVERecord?id=CVE-2026-20841

Windows Notepad App Remote Code Execution Vulnerability

https://www.cve.org/CVERecord?id=CVE-2026-20841

#HackerNews

Windows Notepad App Remote Code Execution Vulnerability

https://www.cve.org/CVERecord?id=CVE-2026-20841

#windows

Notepad was nice because all it did was display some text. Not necessarily very well, but it was better than whatever combination of decisions lead to “Windows Notepad App Remote Code Execution Vulnerability”.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

Microsoft: I have made Notepad✨

Security researchers: You fucked up a perfectly good plaintext editor is what you did. Look at it. It's got RCEs.

https://www.cve.org/CVERecord?id=CVE-2026-20841

They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector.

This CVE is an 8.8 severity RCE in Notepad of all things lmao.

Apparently, the "innovation" of adding markdown support came with the ability of launching unverified protocols that load and execute remote files.

We have reached a point where the simple act of opening a .md file in a native utility can compromise your system. Is nothing safe anymore? 😭

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

#noai #microslop #microsoft #windows #programming #writing #windows11 #enshittification #cybersecurity #infosec #technology

@stefan@akko.lightnovel-dungeon.de @volpeon@icy.wyvern.rip Nope.

Here is the CVE
https://www.cve.org/CVERecord?id=CVE-2026-20841

microsoft: we have made a new notepad.exe

everyone else: you f***ed up a perfectly good text editor, is what you did. look at it. it's got RCE.

https://www.cve.org/CVERecord?id=CVE-2026-20841

CVE-2026-20841 = Windows Notepad App Remote Code Execution Vulnerability

"An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files."

lolwut

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

https://www.cve.org/CVERecord?id=CVE-2026-20841

Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code over a network.

Notepad

over a network

Microsoft Windows 11 enshitification continues with its screwing up what was a perfectly functional text file editor - Notepad - adding layers of garbage on it and congratulations, Notepad, yes, bleeding Notepad now has a code execution vulnerability on it.

https://www.cve.org/CVERecord?id=CVE-2026-20841

It's only the Windows 11 Notepad they've screwed up - anyone on any earlier version, which for safety's sake should only be online if it is Windows 10 with the Extended Service Updates (new one just today), is fine.

RE: https://tech.lgbt/@solonovamax/116049115040950367

https://www.cve.org/CVERecord?id=CVE-2026-20841

WHAT'S THE NETWORK ELEMENT in FUCKING NOTEPAD

WHAT BIT COULD IT BEEEEEEEE

edit: ahhh! the notepad thing might not be copilot. the bug is that a URL in a markdown file can actually be a sploit that runs stuff as the user. so this may not be an ai story. dammit.

"Windows Notepad App Remote Code Execution Vulnerability"

That's it: I'm going back to AppleWorks, on my Apple IIe.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

CVE-2026-20841

@m4rc3l CVE-2026-20841 #c3d2leaks

From the WTF department, sorry, I mean from Microsoft: an RCE in Notepad of all things. (Well, the new app with AI and stuff; not the old one.)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

A vulnerability in Notepad 🤦‍♂️
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20841

RE: https://infosec.exchange/@ozu/116041085922526875

Another another vuln. CVE-2025-52436

Critical FortiOS Vulnerability Exposes Networks to LDAP Authentication Bypass

Fortinet has issued a major security alert warning of a serious flaw in its FortiOS firewall software. The vulnerability, tracked as CVE-2026-22153, allows attackers to bypass LDAP authentication entirely—meaning hackers can gain access without needing a valid username or password. This type of breach could compromise sensitive enterprise networks and VPN connections, putting critical data at…

https://undercodenews.com/critical-fortios-vulnerability-exposes-networks-to-ldap-authentication-bypass/

🚨 CVE-2026-25993 (CRITICAL): EverShop <2.1.1 allows unauthenticated SQL injection via url_key in category handling. Upgrade to 2.1.1+ or enforce input validation now! https://radar.offseq.com/threat/cve-2026-25993-cwe-89-improper-neutralization-of-s-6994a1ac #OffSeq #SQLInjection #Infosec #EverShop #Vuln

🟠 CVE-2026-25947 - High (8.8)

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25947/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25947 - High (8.8)

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25947/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1848 - High (7.5)

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1848/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1848 - High (7.5)

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes if the total number of connections exceeds available resources. This only applies to connections accepted from the proxy port, p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1848/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21352 - High (7.8)

DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim mu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21352 - High (7.8)

DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim mu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1507 - High (7.5)

The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denial-of-service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1507/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1507 - High (7.5)

The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denial-of-service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1507/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21349 - High (7.8)

Lightroom Desktop versions 15.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21349/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21349 - High (7.8)

Lightroom Desktop versions 15.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21349/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New.

Ivanti's vulnerabilities have been wreaking havoc in Europe.

Meanwhile:

Ivanti February 2026 Security Update https://www.ivanti.com/blog/february-2026-security-update

The actual security advisory affecting CVE-2026-1602 and CVE-2026-1603 was posted yesterday:

Ivanti Security Advisory EPM February 2026 for EPM 2024 https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024 #Ivanti #infosec #vulnerability

New.

Ivanti's vulnerabilities have been wreaking havoc in Europe.

Meanwhile:

Ivanti February 2026 Security Update https://www.ivanti.com/blog/february-2026-security-update

The actual security advisory affecting CVE-2026-1602 and CVE-2026-1603 was posted yesterday:

Ivanti Security Advisory EPM February 2026 for EPM 2024 https://hub.ivanti.com/s/article/Security-Advisory-EPM-February-2026-for-EPM-2024 #Ivanti #infosec #vulnerability

🟠 CVE-2026-21344 - High (7.8)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerabil...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21344/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21344 - High (7.8)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerabil...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21344/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21347 - High (7.8)

Bridge versions 15.1.3, 16.0.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21347/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21347 - High (7.8)

Bridge versions 15.1.3, 16.0.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21347/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21353 - High (7.8)

DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21353/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21353 - High (7.8)

DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21353/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21341 - High (7.8)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21341/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21341 - High (7.8)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21341/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21343 - High (7.8)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerabil...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21343/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21343 - High (7.8)

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerabil...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21343/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

A critical zero-day vulnerability in Microsoft Word, identified as CVE-2026-21514, has been disclosed. The flaw is being actively exploited in the wild.
https://cybersecuritynews.com/microsoft-office-word-0-day-vulnerability/

🟠 CVE-2026-21514 - High (7.8)

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21514/