Citrix NetScaler ADC & Gateway face CRITICAL memory overflow vulnerabilities (CVE-2026-107412, CVSS 9.5). Risk: DoS & unpredictable behavior. No patch or version details yet — track vendor advisories. https://radar.offseq.com/threat/multiple-memory-overflow-vulnerabilities-can-lead-to-unpredictable-or-erroneous-behavior-and-denial-of-355bfe4e95285557 #OffSeq #Citrix #InfoSec #DoS

CVE-2026-107412 | CRITICAL memory overflow in Citrix NetScaler ADC/Gateway (CVSS 9.5). Affects <14.1-73.58 & <13.1-64.39. Can cause denial of service. Patch immediately to fixed versions. https://radar.offseq.com/threat/cve-2026-107412-multiple-memory-overflow-vulnerabilities-can-lead-to-unpredictable-or-erroneous-4e2ceac955d02e79 #OffSeq #Citrix #Infosec #Vuln

Citrix NetScaler ADC & Gateway face CRITICAL memory overflow vulnerabilities (CVE-2026-107412, CVSS 9.5). Risk: DoS & unpredictable behavior. No patch or version details yet — track vendor advisories. https://radar.offseq.com/threat/multiple-memory-overflow-vulnerabilities-can-lead-to-unpredictable-or-erroneous-behavior-and-denial-of-355bfe4e95285557 #OffSeq #Citrix #InfoSec #DoS

CVE-2026-107412 | CRITICAL memory overflow in Citrix NetScaler ADC/Gateway (CVSS 9.5). Affects <14.1-73.58 & <13.1-64.39. Can cause denial of service. Patch immediately to fixed versions. https://radar.offseq.com/threat/cve-2026-107412-multiple-memory-overflow-vulnerabilities-can-lead-to-unpredictable-or-erroneous-4e2ceac955d02e79 #OffSeq #Citrix #Infosec #Vuln

CVE-2026-107410: CRITICAL memory overflow in Citrix NetScaler ADC & Gateway (CVSS 9.3) risks denial of service & unpredictable behavior. No patch yet — monitor Citrix for updates. https://radar.offseq.com/threat/cve-2026-107410-vulnerability-in-citrix-netscaler-adc-4d60b72db68e0ce6 #OffSeq #Citrix #Vuln #CVE2026107410

CVE-2026-107410: CRITICAL memory overflow in Citrix NetScaler ADC & Gateway (CVSS 9.3) risks denial of service & unpredictable behavior. No patch yet — monitor Citrix for updates. https://radar.offseq.com/threat/cve-2026-107410-vulnerability-in-citrix-netscaler-adc-4d60b72db68e0ce6 #OffSeq #Citrix #Vuln #CVE2026107410

🔴 CVE-2026-127277 - Critical (10)

A security flaw has been discovered in Linksys EA8100 1.0.3.216940. The affected element is an unknown function of the file etc/init.d/service_smbd.sh of the component SMB Service. Performing a manipulation of the argument ANON_ACCESS results in i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-127277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-127277 - Critical (10)

A security flaw has been discovered in Linksys EA8100 1.0.3.216940. The affected element is an unknown function of the file etc/init.d/service_smbd.sh of the component SMB Service. Performing a manipulation of the argument ANON_ACCESS results in i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-127277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86322 - High (8.8)

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86322/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86322 - High (8.8)

A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86322/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-127275 - Critical (10)

A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredWiFiWarning of the file ui_server.lua of the component JNAP API. This manipulation of the argument isEnabled/enabled causes...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-127275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-127275 - Critical (10)

A vulnerability was determined in Linksys EA8100 1.0.3.216940. This issue affects the function SetRemoteSetting/SetUnsecuredWiFiWarning of the file ui_server.lua of the component JNAP API. This manipulation of the argument isEnabled/enabled causes...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-127275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-126982 - High (7.5)

A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-126982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-126982 - High (7.5)

A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to be circumvented when polymorphic data is deserialized into loosely typed members. An unauthorized party who can supply or plant ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-126982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-126366 - High (7.5)

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declare...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-126366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-126366 - High (7.5)

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declare...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-126366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-120868 is a CRITICAL memory overflow in Citrix NetScaler ADC/Gateway (CVSS 9.3). Exploitation leads to denial of service or erratic behavior. Patch to 14.1-73.58/13.1-64.39 now. Details: https://radar.offseq.com/threat/cve-2026-120868-memory-overflow-in-packet-processing-can-lead-to-unpredictable-or-erroneous-behavior-c23ec696d999cbc7 #OffSeq #Citrix #Vuln #PatchNow

CVE-2026-120868 is a CRITICAL memory overflow in Citrix NetScaler ADC/Gateway (CVSS 9.3). Exploitation leads to denial of service or erratic behavior. Patch to 14.1-73.58/13.1-64.39 now. Details: https://radar.offseq.com/threat/cve-2026-120868-memory-overflow-in-packet-processing-can-lead-to-unpredictable-or-erroneous-behavior-c23ec696d999cbc7 #OffSeq #Citrix #Vuln #PatchNow

Red Hat Satellite vulnerabilities fixed: CVE-2026-107360 (CVSS 9.6) sandbox bypass leads 21 new Red Hat CVEs across Satellite, RHEL and Ansible.

#RedHat #Satellite #Foreman #RHEL #Ansible #Vulnerability #CyberSecurity #InfoSec

https://securityonline.info/red-hat-satellite-vulnerabilities-cve-2026-107360/?utm_source=mastodon&utm_medium=jetpack_social

Red Hat Satellite vulnerabilities fixed: CVE-2026-107360 (CVSS 9.6) sandbox bypass leads 21 new Red Hat CVEs across Satellite, RHEL and Ansible.

#RedHat #Satellite #Foreman #RHEL #Ansible #Vulnerability #CyberSecurity #InfoSec

https://securityonline.info/red-hat-satellite-vulnerabilities-cve-2026-107360/?utm_source=mastodon&utm_medium=jetpack_social

safemode

https://nvd.nist.gov/vuln/detail/cve-2026-107360

A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.

🟠 CVE-2026-126793 - High (8)

An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileg...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-126793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-126793 - High (8)

An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileg...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-126793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⛔ New security advisory:

CVE-2026-126170 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-126170-fortianalyzer-unauth-rce-in-fortimanager-too-poc/?utm_source=mastodon&utm_medium=social

by Yazoul AI

#CVE #PatchNow #InfoSecCommunity

ManageEngine critical vulnerabilities fixed: CVE-2026-12591 (CVSS 9.9) in M365 Manager Plus, CVE-2026-12507 RCE in ServiceDesk Plus, DDI Central flaws.

#ManageEngine #Zoho #ServiceDeskPlus #DDICentral #RCE #Vulnerability #CyberSecurity #InfoSec

https://securityonline.info/manageengine-critical-vulnerabilities-cve-2026-12591/?utm_source=mastodon&utm_medium=jetpack_social

ManageEngine critical vulnerabilities fixed: CVE-2026-12591 (CVSS 9.9) in M365 Manager Plus, CVE-2026-12507 RCE in ServiceDesk Plus, DDI Central flaws.

#ManageEngine #Zoho #ServiceDeskPlus #DDICentral #RCE #Vulnerability #CyberSecurity #InfoSec

https://securityonline.info/manageengine-critical-vulnerabilities-cve-2026-12591/?utm_source=mastodon&utm_medium=jetpack_social

ManageEngine critical vulnerabilities fixed: CVE-2026-12591 (CVSS 9.9) in M365 Manager Plus, CVE-2026-12507 RCE in ServiceDesk Plus, DDI Central flaws.

#ManageEngine #Zoho #ServiceDeskPlus #DDICentral #RCE #Vulnerability #CyberSecurity #InfoSec

https://securityonline.info/manageengine-critical-vulnerabilities-cve-2026-12591/?utm_source=mastodon&utm_medium=jetpack_social

ManageEngine critical vulnerabilities fixed: CVE-2026-12591 (CVSS 9.9) in M365 Manager Plus, CVE-2026-12507 RCE in ServiceDesk Plus, DDI Central flaws.

#ManageEngine #Zoho #ServiceDeskPlus #DDICentral #RCE #Vulnerability #CyberSecurity #InfoSec

https://securityonline.info/manageengine-critical-vulnerabilities-cve-2026-12591/?utm_source=mastodon&utm_medium=jetpack_social

Remote attackers may read and write arbitrary files and conduct denial-of-service attacks. The defendant offers no alibi. Synology-SA-26:19 also names a co-conspirator, CVE-2026-85101.

Sentencing is immediate: patch Synology DSM to version 7.2.1 or later. Court is adjourned.

Reward: You've received the Scales of Justice Badge — tarnished, but still better than your unpatched NAS.

https://www.rescana.com/post/synology-dsm-cve-2026-76954-sql-injection-patch-now

#Synology #SQLInjection (2/2)

Remote attackers may read and write arbitrary files and conduct denial-of-service attacks. The defendant offers no alibi. Synology-SA-26:19 also names a co-conspirator, CVE-2026-85101.

Sentencing is immediate: patch Synology DSM to version 7.2.1 or later. Court is adjourned.

Reward: You've received the Scales of Justice Badge — tarnished, but still better than your unpatched NAS.

https://www.rescana.com/post/synology-dsm-cve-2026-76954-sql-injection-patch-now

#Synology #SQLInjection (2/2)

Remote attackers may read and write arbitrary files and conduct denial-of-service attacks. The defendant offers no alibi. Synology-SA-26:19 also names a co-conspirator, CVE-2026-85101.

Sentencing is immediate: patch Synology DSM to version 7.2.1 or later. Court is adjourned.

Reward: You've received the Scales of Justice Badge — tarnished, but still better than your unpatched NAS.

https://www.rescana.com/post/synology-dsm-cve-2026-76954-sql-injection-patch-now

#Synology #SQLInjection (2/2)

🏆 New Achievement! Synology DSM: Guilty on All Counts!

The court finds Synology DSM's Auth API in flagrant violation of secure coding statutes, specifically CWE-89: Improper Neutralization of SQL Commands. The evidence, submitted by Nguyễn Bá Nam Dũng and Hà Thế Long of Viettel Cyber Security Research Lab, is damning: CVE-2026-76954 scores a 9.8 CVSS — network-reachable, no privileges, no interaction required. (1/2)

Remote attackers may read and write arbitrary files and conduct denial-of-service attacks. The defendant offers no alibi. Synology-SA-26:19 also names a co-conspirator, CVE-2026-85101.

Sentencing is immediate: patch Synology DSM to version 7.2.1 or later. Court is adjourned.

Reward: You've received the Scales of Justice Badge — tarnished, but still better than your unpatched NAS.

https://www.rescana.com/post/synology-dsm-cve-2026-76954-sql-injection-patch-now

#Synology #SQLInjection (2/2)

🏆 New Achievement! Synology DSM: Guilty on All Counts!

The court finds Synology DSM's Auth API in flagrant violation of secure coding statutes, specifically CWE-89: Improper Neutralization of SQL Commands. The evidence, submitted by Nguyễn Bá Nam Dũng and Hà Thế Long of Viettel Cyber Security Research Lab, is damning: CVE-2026-76954 scores a 9.8 CVSS — network-reachable, no privileges, no interaction required. (1/2)

🐧 SIGINT // Ubuntu Watch — 2026-11-13

A remotely reachable TCP flaw in the kernel is the one to care about. This write-up adds hunting and mitigation guidance, and notes Livepatch doesn't cover it yet, so homelabbers need a real patch and reboot. Exposed hosts first.

🔗 https://threatdefence.com/article/linux-kernel-tcp-cve-2026-98432-mitigation-hunting

#Ubuntu #Linux #infosec

N-able has disclosed two flaws, 4EverAble2Shell and Agent2Shell, affecting N-central.

Attackers are chaining an Apache Axis vulnerability (CVE-2026-90436) with an N-central privilege escalation weakness to gain root/SYSTEM-level access.

Active exploitation is confirmed, with threat actors deploying XMRig Monero miners on servers in multiple countries.

Notably, 19 of 21 victims identified were already running a previous hotfix,…

https://en.hacks.gr/epitheseis-se-diakomistes-n-central-gia-egkatastasi-kryptonomismaton/

#Nable #Ncentral #CVE202690436 #malware

PostgreSQL security update 18.7 fixes 52 CVEs, including CVE-2026-6460 and 31 other code execution flaws. PostgreSQL 14 reaches end of life.

#PostgreSQL #Postgres #DatabaseSecurity #CVE #PatchNow #RCE #CyberSecurity #InfoSec

https://securityonline.info/postgresql-security-update-52-cves/?utm_source=mastodon&utm_medium=jetpack_social

@froge seeing this in my feed https://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/ I also could say the network timings don't matter just find an RCE and run the attack locally

22-Year-Old PostgreSQL Bug Turned into Remote Code Execution

Link: https://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/
Discussion: https://news.ycombinator.com/item?id=50471761

PostgreSQL security update 18.7 fixes 52 CVEs, including CVE-2026-6460 and 31 other code execution flaws. PostgreSQL 14 reaches end of life.

#PostgreSQL #Postgres #DatabaseSecurity #CVE #PatchNow #RCE #CyberSecurity #InfoSec

https://securityonline.info/postgresql-security-update-52-cves/?utm_source=mastodon&utm_medium=jetpack_social

@froge seeing this in my feed https://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/ I also could say the network timings don't matter just find an RCE and run the attack locally

22-Year-Old PostgreSQL Bug Turned into Remote Code Execution

Link: https://mehmetince.net/part-3-6-how-i-ended-up-turning-a-22-year-old-postgresql-type-confusion-primitive-into-rce-cve-2026-6460/
Discussion: https://news.ycombinator.com/item?id=50471761

CVE-2026-91202 Cockpit: low-priv local user abuses symlink with "Paste as owner" to change file ownership outside intended dir, compromising integrity (CVSS 6.1, unpatched). Restrict cockpit-files access until a fix lands. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-91202/

Global Microsoft services, including Outlook and Teams, experienced outages, coinciding with active exploitation of an Outlook vulnerability (CVE-2026-124194). Critical patches are also urged for exploited GPUStack AI cluster flaws. Geopolitically, US diplomats met with Ukraine and Russia to discuss peace, achieving an agreement on a prisoner exchange but no major breakthrough on lasting peace. In tech news, NVIDIA CEO Jensen Huang resigned, with Colette Kress appointed interim CEO. Additionally, AI-assisted research identified 66 new flaws in critical infrastructure TCP/IP stacks. (Nov 12-13, 2026)

#AnonNews_irc #Cybersecurity #News

Global Microsoft services, including Outlook and Teams, experienced outages, coinciding with active exploitation of an Outlook vulnerability (CVE-2026-124194). Critical patches are also urged for exploited GPUStack AI cluster flaws. Geopolitically, US diplomats met with Ukraine and Russia to discuss peace, achieving an agreement on a prisoner exchange but no major breakthrough on lasting peace. In tech news, NVIDIA CEO Jensen Huang resigned, with Colette Kress appointed interim CEO. Additionally, AI-assisted research identified 66 new flaws in critical infrastructure TCP/IP stacks. (Nov 12-13, 2026)

#AnonNews_irc #Cybersecurity #News

SANS Stormcast Friday, November 13th, 2026: GPUStack Auth Bypass Scans (CVE-2026-102895); ConnectWise ScreenConnect Advisory; N-able N-central Exploits; Microsoft 365 Outage
https://isc.sans.edu/podcastdetail/10178

SANS Stormcast Friday, November 13th, 2026: GPUStack Auth Bypass Scans (CVE-2026-102895); ConnectWise ScreenConnect Advisory; N-able N-central Exploits; Microsoft 365 Outage
https://isc.sans.edu/podcastdetail/10178

🔵 THREAT INTELLIGENCE

CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws

Vulnerability | CRITICAL
CVEs: CVE-2026-123218

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch...

Full analysis:
https://www.yazoul.net/news/article/cisa-warns-of-active-exploitation-of-openssh-gpustack-freeswitch-and-ibm-flaws/?utm_source=mastodon&utm_medium=social

by Yazoul AI

#ThreatIntel #SecurityNews #IncidentResponse

wso2am <4.7.0-r4 has a CRITICAL flaw (CVE-2026-71575): max_age auth-freshness check is broken due to logic/units errors. Token reuse risk — upgrade to 4.7.0-r4 ASAP. https://radar.offseq.com/threat/wso2am-maxage-authentication-freshness-check-in-oidcclientcoderequestfilter-was-inoperative-due-to-a-8d9e736e38fa1b52 #OffSeq #wso2am #CVE202671575 #security

wso2am <4.7.0-r4 has a CRITICAL flaw (CVE-2026-71575): max_age auth-freshness check is broken due to logic/units errors. Token reuse risk — upgrade to 4.7.0-r4 ASAP. https://radar.offseq.com/threat/wso2am-maxage-authentication-freshness-check-in-oidcclientcoderequestfilter-was-inoperative-due-to-a-8d9e736e38fa1b52 #OffSeq #wso2am #CVE202671575 #security

CW: sebezhetőség

Nyilvánosak a ForgePtr (CVE-2026-47501) és NvRoot (CVE-2026-47591) hibák az NVIDIA nyílt kernel moduljaiban. ForgePtr: nem-privilegizált processz GPU-konténerből host rootot szerezhet. NvRoot: GPU felülírhat OS-sel csak olvasható fájlokat más bérlőknél. CVSS 7.8. Javítva: NvRoot — 610.57.04 / 595.91.07 / 580.178.04; ForgePtr — 615.71.09. Részletek: https://linuxmint.hu/hir/2026/11/nyilvanosak-az-nvidia-nvroot-es-forgeptr-sebezhetosegek-a-linux-meghajtoban-tovabbi-25

#NVIDIA #Linux #CVE #OpenSource #Security

CW: sebezhetőség

Nyilvánosak a ForgePtr (CVE-2026-47501) és NvRoot (CVE-2026-47591) hibák az NVIDIA nyílt kernel moduljaiban. ForgePtr: nem-privilegizált processz GPU-konténerből host rootot szerezhet. NvRoot: GPU felülírhat OS-sel csak olvasható fájlokat más bérlőknél. CVSS 7.8. Javítva: NvRoot — 610.57.04 / 595.91.07 / 580.178.04; ForgePtr — 615.71.09. Részletek: https://linuxmint.hu/hir/2026/11/nyilvanosak-az-nvidia-nvroot-es-forgeptr-sebezhetosegek-a-linux-meghajtoban-tovabbi-25

#NVIDIA #Linux #CVE #OpenSource #Security

CVE-2026-63405 AnyCable CVSS 5.9: signed Pusher API requests can be tampered with since body_md5 is never verified, letting an attacker swap the body and still pass auth. Patch is under review, so track it and update as soon as 1.6.15 lands. https://www.valtersit.com/cve/CVE-2026-63405/

CVE-2026-77609 Open Redirect in Semantic MediaWiki before 7.2.0, CVSS 6.1. Crafted URIResolver subpages can bounce users off-host via interwiki. Patch still under review, so track status and update as soon as it ships. #CVE #infosec https://www.valtersit.com/cve/CVE-2026-77609/

CVE-2026-77616: reflected XSS in Semantic MediaWiki 7.0.0-7.1.0 via unsigned cursors in Special:Ask. CVSS 6.1. Patch under review, so limit exposure until it ships. #CVE #infosec #MediaWiki https://www.valtersit.com/cve/CVE-2026-77616/

CVE-2026-93338 Grandstream GWN7660ELR info disclosure via default SNMP community string public. CVSS 5.3, unpatched. Restrict SNMP access and change the community string now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93338/

CVE-2026-93764 MongoDB Mongoid: encryption rules for embedded model fields can be silently omitted, leaving data stored in plaintext for anyone with DB or backup read access. CVSS 6.5. Patch under review - track status and audit encrypted fields now. https://www.valtersit.com/cve/CVE-2026-93764/