⚠️ CVE-2026-2628: CRITICAL auth bypass in All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin (≤2.2.5). Attackers can access WP admin accounts with no credentials. Disable plugin or restrict logins until patched! https://radar.offseq.com/threat/cve-2026-2628-cwe-288-authentication-bypass-using--3ce6682b #OffSeq #WordPress #AzureAD

⚠️ CVE-2026-2628: CRITICAL auth bypass in All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin (≤2.2.5). Attackers can access WP admin accounts with no credentials. Disable plugin or restrict logins until patched! https://radar.offseq.com/threat/cve-2026-2628-cwe-288-authentication-bypass-using--3ce6682b #OffSeq #WordPress #AzureAD

🚩 CVE-2026-1566 (HIGH): LatePoint WordPress plugin lets Agent users reset admin passwords — leads to full privilege escalation. All versions up to 5.2.7 affected. Restrict Agent roles & monitor now. https://radar.offseq.com/threat/cve-2026-1566-cwe-269-improper-privilege-managemen-02d5d7d7 #OffSeq #WordPress #Vuln #Infosec

🚩 CVE-2026-1566 (HIGH): LatePoint WordPress plugin lets Agent users reset admin passwords — leads to full privilege escalation. All versions up to 5.2.7 affected. Restrict Agent roles & monitor now. https://radar.offseq.com/threat/cve-2026-1566-cwe-269-improper-privilege-managemen-02d5d7d7 #OffSeq #WordPress #Vuln #Infosec

Issue with AWS-LC: an open-source, general-purpose cryptographic library (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338)

Bulletin ID: 2026-005-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/02 14:30 PM PST
Description:
AWS-LC is an open-source, general-purpose cryptographic library. We identified three distin...

https://aws.amazon.com/security/security-bulletins/rss/2026-005-aws/

#aws #security

🟠 CVE-2026-3338 - High (7.5)

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.

Customers of AWS services do not need to take action. Applica...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3338/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Issue with AWS-LC: an open-source, general-purpose cryptographic library (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338)

Bulletin ID: 2026-005-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/02 14:30 PM PST
Description:
AWS-LC is an open-source, general-purpose cryptographic library. We identified three distin...

https://aws.amazon.com/security/security-bulletins/rss/2026-005-aws/

#aws #security

🟠 CVE-2026-3338 - High (7.5)

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes.

Customers of AWS services do not need to take action. Applica...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3338/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Issue with AWS-LC: an open-source, general-purpose cryptographic library (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338)

Bulletin ID: 2026-005-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/02 14:30 PM PST
Description:
AWS-LC is an open-source, general-purpose cryptographic library. We identified three distin...

https://aws.amazon.com/security/security-bulletins/rss/2026-005-aws/

#aws #security

Issue with AWS-LC: an open-source, general-purpose cryptographic library (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338)

Bulletin ID: 2026-005-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/02 14:30 PM PST
Description:
AWS-LC is an open-source, general-purpose cryptographic library. We identified three distin...

https://aws.amazon.com/security/security-bulletins/rss/2026-005-aws/

#aws #security

Issue with AWS-LC: an open-source, general-purpose cryptographic library (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338)

Bulletin ID: 2026-005-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/02 14:30 PM PST
Description:
AWS-LC is an open-source, general-purpose cryptographic library. We identified three distin...

https://aws.amazon.com/security/security-bulletins/rss/2026-005-aws/

#aws #security

🟠 CVE-2026-3336 - High (7.5)

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.

Customers of AWS services do not nee...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3336/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Issue with AWS-LC: an open-source, general-purpose cryptographic library (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338)

Bulletin ID: 2026-005-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/02 14:30 PM PST
Description:
AWS-LC is an open-source, general-purpose cryptographic library. We identified three distin...

https://aws.amazon.com/security/security-bulletins/rss/2026-005-aws/

#aws #security

🟠 CVE-2026-3336 - High (7.5)

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.

Customers of AWS services do not nee...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3336/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0021 - High (8.4)

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0021/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0021 - High (8.4)

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0021/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0020 - High (8.4)

In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0020/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0020 - High (8.4)

In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0020/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-0006: CRITICAL RCE in Android 16 via heap buffer overflows. No user action or privileges needed — remote attackers can fully compromise devices. Patch urgently when available! https://radar.offseq.com/threat/cve-2026-0006-remote-code-execution-in-google-andr-79236030 #OffSeq #Android #RCE #Vulnerability

🔴 CVE-2026-0006: CRITICAL RCE in Android 16 via heap buffer overflows. No user action or privileges needed — remote attackers can fully compromise devices. Patch urgently when available! https://radar.offseq.com/threat/cve-2026-0006-remote-code-execution-in-google-andr-79236030 #OffSeq #Android #RCE #Vulnerability

🟠 CVE-2026-20434 - High (7.5)

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20434/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21882 - High (8.4)

theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21882 - High (8.4)

theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0035 - High (8.4)

In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0035/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0035 - High (8.4)

In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0035/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0047 - High (8.4)

In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0047/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0047 - High (8.4)

In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0047/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0031 - High (8.4)

In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0031/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0031 - High (8.4)

In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0031/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0030 - High (8.4)

In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0030/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0030 - High (8.4)

In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0030/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0034 - High (8.4)

In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0034/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0034 - High (8.4)

In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0034/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48636 - High (8.4)

In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48636/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48636 - High (8.4)

In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48636/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48636 - High (8.4)

In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48636/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48636 - High (8.4)

In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48636/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22207 - Critical (9.8)

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0038 - High (8.4)

In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0038/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0038 - High (8.4)

In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0038/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0037 - High (8.4)

In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0037/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0037 - High (8.4)

In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0037/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0028 - High (8.4)

In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0028/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0028 - High (8.4)

In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0028/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-32313 - High (8.4)

In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-32313/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-32313 - High (8.4)

In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-32313/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New.

Tenable has added three vulnerabilities to its threat advisories:

- Critical: CVE-2026-3432: Sim Studio AI - Unauthenticated OAuth Token Theft https://www.tenable.com/security/research/tra-2026-13

- Critical: CVE-2026-3431: Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion https://www.tenable.com/security/research/tra-2026-12

- Medium: CVE-2026-27167: Gradio - Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret https://www.tenable.com/security/research/tra-2026-11 @tenable #vulnerability #infosec

New.

Tenable has added three vulnerabilities to its threat advisories:

- Critical: CVE-2026-3432: Sim Studio AI - Unauthenticated OAuth Token Theft https://www.tenable.com/security/research/tra-2026-13

- Critical: CVE-2026-3431: Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion https://www.tenable.com/security/research/tra-2026-12

- Medium: CVE-2026-27167: Gradio - Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret https://www.tenable.com/security/research/tra-2026-11 @tenable #vulnerability #infosec

🔎 CVE-2026-3408 (MEDIUM): Open Babel 3.1.0/3.1.1 vulnerable to DoS via null pointer dereference in CDXML handler. Exploit public, patch available (commit e23a224b8fd9…). Update now to prevent app crashes! https://radar.offseq.com/threat/cve-2026-3408-null-pointer-dereference-in-open-bab-da0da361 #OffSeq #OpenBabel #VulnAlert

🔎 HIGH severity: Tenda F453 v1.0.0.3 vulnerable to remote buffer overflow (CVE-2026-3398) via /goform/AdvSetWan. Exploit public, RCE possible with no auth. Disable remote admin & monitor for exploits. Patch ASAP. https://radar.offseq.com/threat/cve-2026-3398-buffer-overflow-in-tenda-f453-735bc013 #OffSeq #Vuln #RouterSec

🟠 CVE-2026-3398 - High (8.8)

A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromAdvSetWan of the file /goform/AdvSetWan of the component httpd. Executing a manipulation of the argument wanmode/PPPOEPassword can lead to buffer overflow. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ HIGH severity: CVE-2026-28562 in wpForo Forum 2.4.14 (WordPress) — unauthenticated SQL injection via wpfob, enabling blind credential extraction. Apply WAF rules & monitor logs until a fix is released. https://radar.offseq.com/threat/cve-2026-28562-improper-neutralization-of-special--22c35314 #OffSeq #WordPress #SQLInjection #Infosec

🟠 CVE-2026-28562 - High (8.2)

wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 CVE-2026-3376: HIGH severity buffer overflow in Tenda F453 v1.0.0.3 (/goform/SafeMacFilter). Public exploit enables remote code execution — no auth needed. Isolate devices & restrict access until patched. https://radar.offseq.com/threat/cve-2026-3376-buffer-overflow-in-tenda-f453-d5150655 #OffSeq #RouterVuln #InfoSec

🟠 CVE-2026-3376 - High (8.8)

A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromSafeMacFilter of the file /goform/SafeMacFilter. Such manipulation of the argument page leads to buffer overflow. It is possible t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3376/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-3377 (HIGH): Buffer overflow in Tenda F453 v1.0.0.3 via /goform/SafeUrlFilter. Public exploit available, no patch yet. Restrict device access & monitor traffic. Details: https://radar.offseq.com/threat/cve-2026-3377-buffer-overflow-in-tenda-f453-c140c206 #OffSeq #Vulnerability #Tenda #Infosec

🟠 CVE-2026-3377 - High (8.8)

A vulnerability was detected in Tenda F453 1.0.0.3. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Performing a manipulation of the argument page results in buffer overflow. The attack can be initiated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3377/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-3380: HIGH-severity buffer overflow in Tenda F453 (v1.0.0.3). Remotely exploitable, no auth needed — PoC public. Isolate devices, restrict WAN, monitor for /goform/L7Im traffic. Patch pending. https://radar.offseq.com/threat/cve-2026-3380-buffer-overflow-in-tenda-f453-54481f34 #OffSeq #Vulnerability #Tenda #InfoSec

🟠 CVE-2026-3380 - High (8.8)

A vulnerability was found in Tenda F453 1.0.0.3. This issue affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page results in buffer overflow. The attack may be launched remotely. The exploit has been made...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3380/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3379 - High (8.8)

A vulnerability has been found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page leads to buffer overflow. The attack may be initiated remotely. The ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3379/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 HIGH severity: Tenda F453 v1.0.0.3 has a buffer overflow (CVE-2026-3379) in /goform/SetIpBind. Remotely exploitable with no auth. Restrict access, monitor for exploit attempts, and patch ASAP. https://radar.offseq.com/threat/cve-2026-3379-buffer-overflow-in-tenda-f453-63a79945 #OffSeq #Cybersecurity #Vulnerability #CVE20263379

🔐 CVE-2026-27751 (CRITICAL): SODOLA SL902-SWTGW124AS gateways (≤200.1.20) use default creds, enabling remote admin takeover. Change all passwords or restrict access ASAP! No patch yet. https://radar.offseq.com/threat/cve-2026-27751-cwe-1392-use-of-default-credentials-706a3fb0 #OffSeq #Vuln #IoTSecurity #NetworkSecurity

🔴 CVE-2026-27751 - Critical (9.8)

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management interface. Attackers can authenticate using the hardcoded default...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2471 - High (7.5)

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the `BaseModel` class constructor c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2751 - High (8.3)

Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26861 - High (8.3)

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27836 - High (7.5)

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27939 - High (8.8)

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-28408 - Critical (9.8)

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and does not have its own authentication and permission checks. A malic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28408/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-28408 in WeGIA (<3.6.5) lets unauthenticated attackers inject massive unauthorized data via adicionar_tipo_docs_atendido.php. Upgrade to 3.6.5 ASAP. Monitor & restrict access now. https://radar.offseq.com/threat/cve-2026-28408-cwe-862-missing-authorization-in-la-ddacfcff #OffSeq #Vulnerability #WeGIA #CVE202628408

🟠 CVE-2026-28406 - High (8.2)

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28406/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28414 - High (7.5)

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28414/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28426 - High (8.7)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious Jav...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-58107 - High (7.5)

In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base6...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-58107/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-58107 - High (7.5)

In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base6...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-58107/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21853 - High (8.8)

AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution vulnerability. This vulnerability can be exploited by embedding a specially crafted affine: URL on a websit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21853/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21853 - High (8.8)

AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution vulnerability. This vulnerability can be exploited by embedding a specially crafted affine: URL on a websit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21853/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3180 - High (7.5)

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3180 - High (7.5)

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47373 - High (7.8)

Memory Corruption when accessing buffers with invalid length during TA invocation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47373 - High (7.8)

Memory Corruption when accessing buffers with invalid length during TA invocation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47377 - High (7.8)

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47377/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47377 - High (7.8)

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47377/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47381 - High (7.8)

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47381/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47381 - High (7.8)

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47381/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47386 - High (7.8)

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47386/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47386 - High (7.8)

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47386/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-59600 - High (7.8)

Memory Corruption when adding user-supplied data without checking available buffer space.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-59600/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-59600 - High (7.8)

Memory Corruption when adding user-supplied data without checking available buffer space.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-59600/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21385 - High (7.8)

Memory corruption while using alignments for memory allocation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21385/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21385 - High (7.8)

Memory corruption while using alignments for memory allocation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21385/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-52468 - High (8.8)

Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-52468/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-52468 - High (8.8)

Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-52468/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28403 - High (7.6)

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server (`ws://127.0.0.1:`) accepts connections from any origin without validating the HTTP `Origin` header during the WebSocket handshake. A maliciou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28403/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28403 - High (7.6)

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server (`ws://127.0.0.1:`) accepts connections from any origin without validating the HTTP `Origin` header during the WebSocket handshake. A maliciou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28403/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New.

Tenable has added three vulnerabilities to its threat advisories:

- Critical: CVE-2026-3432: Sim Studio AI - Unauthenticated OAuth Token Theft https://www.tenable.com/security/research/tra-2026-13

- Critical: CVE-2026-3431: Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion https://www.tenable.com/security/research/tra-2026-12

- Medium: CVE-2026-27167: Gradio - Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret https://www.tenable.com/security/research/tra-2026-11 @tenable #vulnerability #infosec

New.

Tenable has added three vulnerabilities to its threat advisories:

- Critical: CVE-2026-3432: Sim Studio AI - Unauthenticated OAuth Token Theft https://www.tenable.com/security/research/tra-2026-13

- Critical: CVE-2026-3431: Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion https://www.tenable.com/security/research/tra-2026-12

- Medium: CVE-2026-27167: Gradio - Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret https://www.tenable.com/security/research/tra-2026-11 @tenable #vulnerability #infosec

🔴 CVE-2026-2999 - Critical (9.8)

IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21660 - Critical (9.8)

Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21660/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21660 - Critical (9.8)

Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21660/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3132 - High (8.8)

The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_Widget_Admin::render_preview'. This is due to missing capability check. This makes it po...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3132/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3132 - High (8.8)

The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_Widget_Admin::render_preview'. This is due to missing capability check. This makes it po...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3132/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-59603 - High (7.8)

Memory Corruption when processing invalid user address with nonstandard buffer address.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-59603/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-59603 - High (7.8)

Memory Corruption when processing invalid user address with nonstandard buffer address.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-59603/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26720 - Critical (9.8)

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26720 - Critical (9.8)

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26720 - Critical (9.8)

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26720 - Critical (9.8)

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47376 - High (7.8)

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47376/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47376 - High (7.8)

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47376/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24110 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret = sscanf(pRule, " %d\t%[^\t]\t%[^\n\r\t]", &dhcpsIndex, dhcpsI...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24110/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24110 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret = sscanf(pRule, " %d\t%[^\t]\t%[^\n\r\t]", &dhcpsIndex, dhcpsI...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24110/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24110 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret = sscanf(pRule, " %d\t%[^\t]\t%[^\n\r\t]", &dhcpsIndex, dhcpsI...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24110/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24110 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret = sscanf(pRule, " %d\t%[^\t]\t%[^\n\r\t]", &dhcpsIndex, dhcpsI...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24110/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47375 - High (7.8)

Memory corruption while handling different IOCTL calls from the user-space simultaneously.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47375/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47375 - High (7.8)

Memory corruption while handling different IOCTL calls from the user-space simultaneously.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47375/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47379 - High (7.8)

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47379/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47379 - High (7.8)

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and deallocation of buffer resources.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47379/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47385 - High (7.8)

Memory Corruption when accessing trusted execution environment without proper privilege check.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47385/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47385 - High (7.8)

Memory Corruption when accessing trusted execution environment without proper privilege check.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47385/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-20781 - Critical (9.4)

WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent to the backend. An unauthenticated attacker can connect to the
OCPP WebSocket endpoint using a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20781/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24101 - Critical (9.8)

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenated into `doSystemCmd`. The value of s1_1 is not validated, potentially leading to a comm...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24101 - Critical (9.8)

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenated into `doSystemCmd`. The value of s1_1 is not validated, potentially leading to a comm...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24101 - Critical (9.8)

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenated into `doSystemCmd`. The value of s1_1 is not validated, potentially leading to a comm...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24101 - Critical (9.8)

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenated into `doSystemCmd`. The value of s1_1 is not validated, potentially leading to a comm...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21657 - Critical (9.8)

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21657 - Critical (9.8)

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21656 - Critical (9.8)

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21656/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21656 - Critical (9.8)

Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21656/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20792 - High (7.5)

The WebSocket Application Programming Interface lacks restrictions on
the number of authentication requests. This absence of rate limiting may
allow an attacker to conduct denial-of-service attacks by suppressing
or misrouting legitimate charge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20792/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Vulnerabilities in SWITCH EV Charging Platform Allow Station Impersonation

SWITCH EV's charging platform contains four vulnerabilities, including a critical authentication bypass (CVE-2026-27767), that allow attackers to impersonate charging stations and hijack sessions.

**Make sure your SWITCH EV station management is isolated from the internet and behind a firewall or VPN. Since the vendor has not released a patch that's your only defense until the vendor does something or you replace these systems.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-vulnerabilities-in-switch-ev-charging-platform-allow-station-impersonation-e-g-h-5-x/gD2P6Ple2L

🔴 CVE-2026-27767 - Critical (9.4)

WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent to the backend. An unauthenticated attacker can connect to the
OCPP WebSocket endpoint using a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27767/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21654 - Critical (9.8)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21654/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21654 - Critical (9.8)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21654/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21658 - Critical (9.8)

Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21658/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21658 - Critical (9.8)

Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21658/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-02-23 - 2026-03-02)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 974

Severity:
- Critical: 145
- High: 315
- Medium: 431
- Low: 49
- None: 34

Status:
- : 10
- Analyzed: 435
- Awaiting Analysis: 257
- Modified: 60
- Received: 119
- Rejected: 17
- Undergoing Analysis: 76

Top CNAs:
- GitHub, Inc.: 354
- VulDB: 131
- VulnCheck: 70
- Mozilla Corporation: 52
- ICS-CERT: 51
- MITRE: 34
- Wordfence: 34
- Red Hat, Inc.: 15
- Cisco Systems, Inc.: 15
- GitLab Inc.: 13

Top Affected Products:
- UNKNOWN: 459
- Mozilla Firefox: 52
- Mozilla Thunderbird: 50
- Imagemagick: 34
- Open-emr Openemr: 25
- Copeland Xweb 300d Pro Firmware: 15
- Freerdp: 15
- Copeland Xweb 500b Pro Firmware: 15
- Copeland Xweb 500d Pro Firmware: 15
- Tenda F453 Firmware: 10

Top EPSS Score:
- CVE-2026-3301 - 2.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3301)
- CVE-2025-70328 - 2.51 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70328)
- CVE-2026-20127 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20127)
- CVE-2025-70327 - 1.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70327)
- CVE-2026-24663 - 1.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24663)
- CVE-2026-22553 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22553)
- CVE-2026-26222 - 0.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26222)
- CVE-2026-26331 - 0.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26331)
- CVE-2026-27498 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27498)
- CVE-2026-21658 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21658)

🔴 CVE-2026-21659 - Critical (9.8)

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to
execute arbitrary code on the affected device, lea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21659/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21659 - Critical (9.8)

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to
execute arbitrary code on the affected device, lea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21659/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Multiple Vulnerabilities Reported in EV Energy Charging Platform

EV Energy's charging platform contains four vulnerabilities, including a critical authentication bypass (CVE-2026-27772), that allow attackers to hijack electric vehicle charging stations and disrupt energy infrastructure.

**Make sure to isolate EV Energy systems from the public internet and use a VPN for any required remote management. Since the vendor hasn't released a patch, this is your only defense until you replace these systems.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-vulnerabilities-in-ev-energy-charging-platform-allow-remote-hijacking-b-x-t-d-l/gD2P6Ple2L

🔴 CVE-2026-27772 - Critical (9.4)

WebSocket endpoints lack proper authentication mechanisms, enabling
attackers to perform unauthorized station impersonation and manipulate
data sent to the backend. An unauthenticated attacker can connect to the
OCPP WebSocket endpoint using a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27772/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New.

Tenable has added three vulnerabilities to its threat advisories:

- Critical: CVE-2026-3432: Sim Studio AI - Unauthenticated OAuth Token Theft https://www.tenable.com/security/research/tra-2026-13

- Critical: CVE-2026-3431: Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion https://www.tenable.com/security/research/tra-2026-12

- Medium: CVE-2026-27167: Gradio - Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret https://www.tenable.com/security/research/tra-2026-11 @tenable #vulnerability #infosec

New.

Tenable has added three vulnerabilities to its threat advisories:

- Critical: CVE-2026-3432: Sim Studio AI - Unauthenticated OAuth Token Theft https://www.tenable.com/security/research/tra-2026-13

- Critical: CVE-2026-3431: Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion https://www.tenable.com/security/research/tra-2026-12

- Medium: CVE-2026-27167: Gradio - Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret https://www.tenable.com/security/research/tra-2026-11 @tenable #vulnerability #infosec

🔴 CVE-2026-3431 - Critical (9.8)

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB insta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3431/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20430 - High (8.8)

In wlan AP FW, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20430/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27942 - High (7.5)

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-2584 in Ciser CSIP firmware 3.0 – 5.1 enables unauthenticated SQL injection via login interface. Config data at risk — patch not yet released. Restrict access & monitor now. https://radar.offseq.com/threat/cve-2026-2584-cwe-89-improper-neutralization-of-sp-3951e11b #OffSeq #CVE20262584 #SQLi #FirmwareSecurity

🚨 CVE-2026-3000 (CRITICAL): IDExpert Windows Logon Agent v2.7.3.230719 allows unauthenticated remote code execution via malicious DLL download. Disable agent, monitor for unusual activity, restrict outbound traffic. https://radar.offseq.com/threat/cve-2026-3000-cwe-494-download-of-code-without-int-6f96a540 #OffSeq #Cybersecurity #RCE #CVE

🔴 CVE-2026-3000 - Critical (9.8)

IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute them.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3000/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-3422 in e-Excellence U-Office Force enables unauthenticated remote code execution via insecure deserialization (CWE-502). No patch — restrict access, monitor traffic, use WAF/RASP. https://radar.offseq.com/threat/cve-2026-3422-cwe-502-deserialization-of-untrusted-c53bebca #OffSeq #Vulnerability #Infosec #CVE20263422

🔴 CVE-2026-3422 - Critical (9.8)

U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-3412: Medium XSS in itsourcecode University Management System v1.0. 'dt' param in /att_single_view.php is vulnerable. Public exploit available — patch or mitigate to prevent session hijack & data theft. Details: https://radar.offseq.com/threat/cve-2026-3412-cross-site-scripting-in-itsourcecode-e5baf82a #OffSeq #XSS #Vuln

🚨 HIGH severity: CVE-2026-3399 impacts Tenda F453 (v1.0.0.3) via buffer overflow in httpd's fromGstDhcpSetSer. Remotely exploitable, public exploit available. Patch or mitigate now to prevent device takeover! https://radar.offseq.com/threat/cve-2026-3399-buffer-overflow-in-tenda-f453-2372f90c #OffSeq #Vuln #Infosec #Router

🟠 CVE-2026-3399 - High (8.8)

A vulnerability was identified in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer of the component httpd. The manipulation of the argument dips leads to buffer overflow. The at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3400 - High (8.8)

A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goform/TextEditingConversion. The manipulation of the argument wpapsk_crypto2_4g results in stack-based buffer o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3400/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ CVE-2026-3400 (HIGH, CVSS 8.7): Stack-based buffer overflow in Tenda AC15 routers (≤v15.13.07.13) allows unauthenticated remote code execution. PoC code is public. Restrict access & monitor for patches! https://radar.offseq.com/threat/cve-2026-3400-stack-based-buffer-overflow-in-tenda-c665b93a #OffSeq #Infosec #CVE #Vulnerability

🔥 CVE-2026-3378 (HIGH, CVSS 8.7): Buffer overflow in Tenda F453 (FW 1.0.0.3) lets remote attackers execute code or cause DoS — no authentication needed. PoC exploit published. Patch or restrict access now! https://radar.offseq.com/threat/cve-2026-3378-buffer-overflow-in-tenda-f453-0b5023a3 #OffSeq #Vulnerability #Tenda #RouterSecurity

🟠 CVE-2026-3378 - High (8.8)

A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromqossetting of the file /goform/qossetting. Executing a manipulation of the argument qos can lead to buffer overflow. The attack can be launched remotely. The exploit has be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28425 - High (8)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28425/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28416 - High (8.2)

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a mal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28416/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26862 - High (8.3)

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26862/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL vuln in Microchip TimePictra (11.0 – 11.3 SP2): CVE-2026-2844 lets remote, unauthenticated attackers manipulate configs. No patch yet — restrict access & monitor logs! https://radar.offseq.com/threat/cve-2026-2844-cwe-306-missing-authentication-for-c-aa868998 #OffSeq #TimePictra #Vulnerability #OTSecurity

🚨 CVE-2026-3010: CRITICAL XSS in Microchip TimePictra v11.0 – 11.3 SP2. Remote, unauthenticated attackers can inject scripts via web UI. Restrict access, enable WAF, monitor logs. Patch awaited. Full info: https://radar.offseq.com/threat/cve-2026-3010-cwe-79-improper-neutralization-of-in-f593f595 #OffSeq #XSS #ICS #Vuln

🟠 CVE-2025-13673 - High (7.5)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-28370 in OpenStack Vitrage (CVSS 9.1) enables authenticated RCE via eval injection in query parser. Upgrade to fixed versions, restrict API access, and monitor logs. Affects 0, 13.0.0, 14.0.0, 15.0.0. Details: https://radar.offseq.com/threat/cve-2026-28370-cwe-95-improper-neutralization-of-d-e403f347 #OffSeq #OpenStack #Vuln

🔴 CVE-2026-28370 - Critical (9.1)

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unau...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28370/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

another day another critical vulnerability in openclaw 🥲🤡

"In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval."

🔐 CVE-2026-28363

📊 CVSS: 9.9 · Critical
📅 02/27/2026, 04:16 AM
🛡️ CWE: CWE-184
📦 Affected: OpenClaw OpenClaw (< 2026.2.23)

🔗 https://hecate.pw/vulnerability/CVE-2026-28363

#cve #vulnerability #hecate

🔴 CVE-2026-28268 - Critical (9.8)

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL vuln in go-vikunja vikunja (<2.1.0): Password reset tokens never expire due to logic flaw, enabling persistent account takeover. Patch to v2.1.0+ now! CVE-2026-28268 https://radar.offseq.com/threat/cve-2026-28268-cwe-459-incomplete-cleanup-in-go-vi-0517b158 #OffSeq #Vuln #Security #FOSS

🔴 CVE-2026-28213 - Critical (9.8)

EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password" functionality. When specifying a target email address, the API response returns the password reset token. This allows an attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-11252 - Critical (9.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm allows SQL Injection.This issue affects windesk.Fm: through 27022026.

NOTE: The vendor ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11252/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27630 - High (7.5)

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27630/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20902 - High (8)

An OS command injection

vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into the map filename field during the map
upl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20902/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21718 - Critical (10)

An authentication bypass vulnerability exists in Copeland XWEB Pro
version 1.12.1 and prior, enabling any attackers to bypass the
authentication requirement and achieve pre-authenticated code execution
on the system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2597 - High (7.5)

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes().

The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2597/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69437 - High (8.7)

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69437/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27141 - High (7.5)

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27755 in SODOLA SL902-SWTGW124AS (≤200.1.20) lets attackers forge MD5-based session IDs, bypassing auth remotely. No patch yet — segment, restrict, monitor! https://radar.offseq.com/threat/cve-2026-27755-cwe-330-use-of-insufficiently-rando-27c7bdab #OffSeq #CVE202627755 #IoTSecurity #Infosec

🔴 CVE-2026-27755 - Critical (9.8)

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess val...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22206 - High (8.8)

SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw comb...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22205 - High (7.5)

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22205/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-02-23 - 2026-03-02)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 974

Severity:
- Critical: 145
- High: 315
- Medium: 431
- Low: 49
- None: 34

Status:
- : 10
- Analyzed: 435
- Awaiting Analysis: 257
- Modified: 60
- Received: 119
- Rejected: 17
- Undergoing Analysis: 76

Top CNAs:
- GitHub, Inc.: 354
- VulDB: 131
- VulnCheck: 70
- Mozilla Corporation: 52
- ICS-CERT: 51
- MITRE: 34
- Wordfence: 34
- Red Hat, Inc.: 15
- Cisco Systems, Inc.: 15
- GitLab Inc.: 13

Top Affected Products:
- UNKNOWN: 459
- Mozilla Firefox: 52
- Mozilla Thunderbird: 50
- Imagemagick: 34
- Open-emr Openemr: 25
- Copeland Xweb 300d Pro Firmware: 15
- Freerdp: 15
- Copeland Xweb 500b Pro Firmware: 15
- Copeland Xweb 500d Pro Firmware: 15
- Tenda F453 Firmware: 10

Top EPSS Score:
- CVE-2026-3301 - 2.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3301)
- CVE-2025-70328 - 2.51 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70328)
- CVE-2026-20127 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20127)
- CVE-2025-70327 - 1.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70327)
- CVE-2026-24663 - 1.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24663)
- CVE-2026-22553 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22553)
- CVE-2026-26222 - 0.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26222)
- CVE-2026-26331 - 0.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26331)
- CVE-2026-27498 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27498)
- CVE-2026-21658 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21658)

📢 Robots Unitree Go2 : deux failles RCE (CVE-2026-27509, CVE-2026-27510) via DDS et base Android
📝 Selon un billet technique publié par Olivier Laflamme (26 février 2026), deux vulnérabilités critiques de type RCE affectent les robots Uni...
📖 cyberveille : https://cyberveille.ch/posts/2026-03-02-robots-unitree-go2-deux-failles-rce-cve-2026-27509-cve-2026-27510-via-dds-et-base-android/
🌐 source : https://boschko.ca/unitree-go2-rce/
#CVE_2026_27509 #CVE_2026_27510 #Cyberveille

From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510) https://boschko.ca/unitree-go2-rce/

From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510) https://boschko.ca/unitree-go2-rce/

🔴 CVE-2026-27510 - Critical (9.6)

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📢 Robots Unitree Go2 : deux failles RCE (CVE-2026-27509, CVE-2026-27510) via DDS et base Android
📝 Selon un billet technique publié par Olivier Laflamme (26 février 2026), deux vulnérabilités critiques de type RCE affectent les robots Uni...
📖 cyberveille : https://cyberveille.ch/posts/2026-03-02-robots-unitree-go2-deux-failles-rce-cve-2026-27509-cve-2026-27510-via-dds-et-base-android/
🌐 source : https://boschko.ca/unitree-go2-rce/
#CVE_2026_27509 #CVE_2026_27510 #Cyberveille