🔴 CVE-2026-73257 - Critical (9.1)

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_htt...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73257/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73257 - Critical (9.1)

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_htt...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73257/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76641 - High (7.5)

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76641/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76641 - High (7.5)

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76641/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CISA has added two known vulnerabilities to the KEV catalogue.

- CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72529

- CVE-2026-72530: TrueConf Server Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72530 #CISA

Yesterday:

Cisco:

CRITICAL: CVE-2026-20231, CVE-2026-20315, and CVE-2026-20317: Secure Workload Software Security Hardening Release: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP @TalosSecurity #Cisco #infosec #vulnerability

Cisco patches Secure Workload flaws CVE-2026-20315 and CVE-2026-20317, an authentication bypass and privilege escalation pair scoring CVSS 10. Upgrade now.

#Cisco #CVE #AuthenticationBypass #PrivilegeEscalation #Vulnerability #InfoSec #PatchNow

https://securityonline.info/cisco-secure-workload-cve-2026-20315/?utm_source=mastodon&utm_medium=jetpack_social

CISA has added two known vulnerabilities to the KEV catalogue.

- CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72529

- CVE-2026-72530: TrueConf Server Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72530 #CISA

Yesterday:

Cisco:

CRITICAL: CVE-2026-20231, CVE-2026-20315, and CVE-2026-20317: Secure Workload Software Security Hardening Release: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP @TalosSecurity #Cisco #infosec #vulnerability

Cisco patches Secure Workload flaws CVE-2026-20315 and CVE-2026-20317, an authentication bypass and privilege escalation pair scoring CVSS 10. Upgrade now.

#Cisco #CVE #AuthenticationBypass #PrivilegeEscalation #Vulnerability #InfoSec #PatchNow

https://securityonline.info/cisco-secure-workload-cve-2026-20315/?utm_source=mastodon&utm_medium=jetpack_social

CISA has added two known vulnerabilities to the KEV catalogue.

- CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72529

- CVE-2026-72530: TrueConf Server Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72530 #CISA

Yesterday:

Cisco:

CRITICAL: CVE-2026-20231, CVE-2026-20315, and CVE-2026-20317: Secure Workload Software Security Hardening Release: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP @TalosSecurity #Cisco #infosec #vulnerability

CISA has added two known vulnerabilities to the KEV catalogue.

- CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72529

- CVE-2026-72530: TrueConf Server Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72530 #CISA

Yesterday:

Cisco:

CRITICAL: CVE-2026-20231, CVE-2026-20315, and CVE-2026-20317: Secure Workload Software Security Hardening Release: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP @TalosSecurity #Cisco #infosec #vulnerability

CISA has added two known vulnerabilities to the KEV catalogue.

- CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72529

- CVE-2026-72530: TrueConf Server Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72530 #CISA

Yesterday:

Cisco:

CRITICAL: CVE-2026-20231, CVE-2026-20315, and CVE-2026-20317: Secure Workload Software Security Hardening Release: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP @TalosSecurity #Cisco #infosec #vulnerability

🚨 [CISA-2026:0820] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0820)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-72529 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-72529)
- Name: TrueConf Server Missing Authentication for Critical Function Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: TrueConf
- Product: Server
- Notes: https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72529

⚠️ CVE-2026-72530 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-72530)
- Name: TrueConf Server Code Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: TrueConf
- Product: Server
- Notes: https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72530

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260820 #cisa20260820 #cve_2026_72529 #cve_2026_72530 #cve202672529 #cve202672530

CVE ID: CVE-2026-72529
Vendor: TrueConf
Product: Server
Date Added: 2026-08-20
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72529

CISA has added two known vulnerabilities to the KEV catalogue.

- CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72529

- CVE-2026-72530: TrueConf Server Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72530 #CISA

Yesterday:

Cisco:

CRITICAL: CVE-2026-20231, CVE-2026-20315, and CVE-2026-20317: Secure Workload Software Security Hardening Release: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP @TalosSecurity #Cisco #infosec #vulnerability

🚨 [CISA-2026:0820] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0820)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-72529 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-72529)
- Name: TrueConf Server Missing Authentication for Critical Function Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: TrueConf
- Product: Server
- Notes: https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72529

⚠️ CVE-2026-72530 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-72530)
- Name: TrueConf Server Code Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: TrueConf
- Product: Server
- Notes: https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72530

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260820 #cisa20260820 #cve_2026_72529 #cve_2026_72530 #cve202672529 #cve202672530

CVE ID: CVE-2026-72529
Vendor: TrueConf
Product: Server
Date Added: 2026-08-20
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72529

CISA has added two known vulnerabilities to the KEV catalogue.

- CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72529

- CVE-2026-72530: TrueConf Server Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72530 #CISA

Yesterday:

Cisco:

CRITICAL: CVE-2026-20231, CVE-2026-20315, and CVE-2026-20317: Secure Workload Software Security Hardening Release: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP @TalosSecurity #Cisco #infosec #vulnerability

🚨 [CISA-2026:0820] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0820)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-72529 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-72529)
- Name: TrueConf Server Missing Authentication for Critical Function Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: TrueConf
- Product: Server
- Notes: https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72529

⚠️ CVE-2026-72530 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-72530)
- Name: TrueConf Server Code Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: TrueConf
- Product: Server
- Notes: https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72530

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260820 #cisa20260820 #cve_2026_72529 #cve_2026_72530 #cve202672529 #cve202672530

CVE ID: CVE-2026-72530
Vendor: TrueConf
Product: Server
Date Added: 2026-08-20
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72530

🔴 CVE-2026-72530 - Critical (9)

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72530/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CISA has added two known vulnerabilities to the KEV catalogue.

- CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72529

- CVE-2026-72530: TrueConf Server Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72530 #CISA

Yesterday:

Cisco:

CRITICAL: CVE-2026-20231, CVE-2026-20315, and CVE-2026-20317: Secure Workload Software Security Hardening Release: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP @TalosSecurity #Cisco #infosec #vulnerability

🚨 [CISA-2026:0820] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0820)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-72529 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-72529)
- Name: TrueConf Server Missing Authentication for Critical Function Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: TrueConf
- Product: Server
- Notes: https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-missing-authentication-for-critical-function/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72529

⚠️ CVE-2026-72530 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-72530)
- Name: TrueConf Server Code Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: TrueConf
- Product: Server
- Notes: https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72530

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260820 #cisa20260820 #cve_2026_72529 #cve_2026_72530 #cve202672529 #cve202672530

CVE ID: CVE-2026-72530
Vendor: TrueConf
Product: Server
Date Added: 2026-08-20
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72530

🔴 CVE-2026-72530 - Critical (9)

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72530/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-77022 - Critical (9.9)

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component SSID Configuration. The manipulation of the argument ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77022/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-77022 - Critical (9.9)

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component SSID Configuration. The manipulation of the argument ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77022/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75140 - High (7.5)

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75140/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75140 - High (7.5)

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75140/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/9]

Most Impactful Security Incidents ( 2026‑08‑18 → 2026‑08‑19 )

---

PRIORITY 1 – Critical / High‑Severity Flaws (CVSS 7‑10):

CVE‑2026‑60392
• 7.8 (HIGH)
• Oracle Outside In Technology – PDF Export SDK (Fusion Middleware)
• Local‑privilege escalation; requires attacker to have a logon on the host where the SDK runs. Successful exploitation can lead to full takeover of the component.
• 8.5.8
• Easily exploitable (local) – requires user interaction.
• https://cveawg.mitre.org/api/cve/CVE-2026-60392

CVE‑2026‑60782
• 9.8 (CRITICAL)
• Oracle Payments (E‑Business Suite) – File Transmission
• Remote unauthenticated attacker can compromise the Payments module via HTTP. Leads to full takeover of the Payments service.
• 12.2.3‑12.2.15
• Network‑accessible, no authentication required.
• https://cveawg.mitre.org/api/cve/CVE-2026-60782

CVE‑2026‑60730
• 9.9 (CRITICAL)
• Oracle WebCenter Portal – Composer component
• Remote unauthenticated attacker can compromise the portal via HTTP. Full takeover of the portal.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60730

CVE‑2026‑60728
• 9.1 (CRITICAL)
• Oracle WebCenter Portal – Portlet Services
• Remote unauthenticated attacker can cause denial‑of‑service and full compromise of portal data.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60728

CVE‑2026‑60727
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can take over the IAM system via HTTP.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60727

CVE‑2026‑60721
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Same vector as above; full takeover possible.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60721

CVE‑2026‑60720
• 9.9 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can compromise the IAM system.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60720

#infosecnews

CVE-2026-76956 - DoS in libexpat 2.8.2/2.8.3. Insufficient entropy from getentropy handling enables hash flooding via crafted XML. CVSS 7.5. No patch yet, upgrade to 2.8.4. #CVE #libexpat #infosec

https://www.valtersit.com/cve/CVE-2026-76956/

🔴 CVE-2026-73256 - Critical (9.1)

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73256 - Critical (9.1)

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77176 - High (8.1)

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77176/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77176 - High (8.1)

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77176/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76928 - High (7.5)

X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76928 - High (7.5)

X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-71428 - Critical (9.3)

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partitio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-71428 - Critical (9.3)

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partitio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

An Apache InLong SQL injection flaw, CVE-2026-63038, lets attackers inject SQL via multiple parameters. Two more bugs join it. Upgrade to 2.4.0.

#ApacheInLong #SQLInjection #CVE #SSRF #InfoSec #OpenSource

https://securityonline.info/apache-inlong-sql-injection-cve-2026-63038/?utm_source=mastodon&utm_medium=jetpack_social

An Apache InLong SQL injection flaw, CVE-2026-63038, lets attackers inject SQL via multiple parameters. Two more bugs join it. Upgrade to 2.4.0.

#ApacheInLong #SQLInjection #CVE #SSRF #InfoSec #OpenSource

https://securityonline.info/apache-inlong-sql-injection-cve-2026-63038/?utm_source=mastodon&utm_medium=jetpack_social

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

Splunk patches 9.1 CVSS RCE in MCP Server and 9 flaws in AI Toolkit

Splunk이 MCP Server, AI Toolkit, Splunk Connect for Kafka 등에서 발견된 17개 취약점의 보안 업데이트를 배포했다. 가장 심각한 CVE-2026-76404(CVSS 9.1)는 Splunk MCP Server 1.2.1 미만에서 관리자 권한 사용자가 자격 증명 관리 기능의 안전하지 않은 역직렬화를 악용해 호스트 OS 명령을 실행할 수 있는 RCE다. AI Toolkit에도 악성 sparse matrix/pickle 데이터를 포함한 모델 로딩으로 코드 실행이 가능한 CVE-2026-76395(CVSS 8.8)를 포함해...

https://cyberupdates365.com/splunk-mcp-server-rce-patch/

Splunk patches CVE-2026-76404, a critical remote code execution flaw in the MCP Server app, plus 16 more bugs across its apps and add-ons.

#Splunk #CVE #RemoteCodeExecution #RCE #MCPServer #Deserialization #InfoSec #PatchNow

https://securityonline.info/splunk-apps-cve-2026-76404/?utm_source=mastodon&utm_medium=jetpack_social

Splunk MCP Server app v1.2 is impacted by CVE-2026-76404 (CRITICAL, CVSS 9.1) — insecure deserialization lets admin users run arbitrary OS commands. Limit admin access & monitor for misuse until a patch is released. https://radar.offseq.com/threat/cve-2026-76404-the-application-deserializes-untrusted-data-without-sufficiently-verifying-that-the-a0d42d963a9e6a80 #OffSeq #Splunk #Infosec #CVE202676404

🔴 CVE-2026-76404 - Critical (9.1)

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Splunk patches CVE-2026-76404, a critical remote code execution flaw in the MCP Server app, plus 16 more bugs across its apps and add-ons.

#Splunk #CVE #RemoteCodeExecution #RCE #MCPServer #Deserialization #InfoSec #PatchNow

https://securityonline.info/splunk-apps-cve-2026-76404/?utm_source=mastodon&utm_medium=jetpack_social

Splunk MCP Server app v1.2 is impacted by CVE-2026-76404 (CRITICAL, CVSS 9.1) — insecure deserialization lets admin users run arbitrary OS commands. Limit admin access & monitor for misuse until a patch is released. https://radar.offseq.com/threat/cve-2026-76404-the-application-deserializes-untrusted-data-without-sufficiently-verifying-that-the-a0d42d963a9e6a80 #OffSeq #Splunk #Infosec #CVE202676404

🔴 CVE-2026-76404 - Critical (9.1)

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76219 - Arbitrary file overwrite in GitPython before 3.1.58 via IndexFile methods. Inject --index-output to clobber files. CVSS 8.1. Unpatched - update or mitigate now. #CVE #GitPython #infosec

https://www.valtersit.com/cve/CVE-2026-76219/

🟠 CVE-2026-75914 - High (7.5)

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75144 - High (7.8)

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75144/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75144 - High (7.8)

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75144/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75141 - High (7.8)

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap bu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75141 - High (7.8)

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap bu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71961 - High (8.8)

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command inte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71961 - High (8.8)

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command inte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-67364 (CVSS 10): CRITICAL pre-auth PHP code injection in Balbooa Forms for Joomla (v1.0.0 – 2.4.3.1). Exploitable via unescaped query param in custom-PHP handler. Update to 2.4.3.2+ now. https://radar.offseq.com/threat/cve-2026-67364-cwe-94-improper-control-of-generation-of-code-code-injection-in-balbooacom-balbooa-36f88c0efc17ca75 #OffSeq #Joomla #CVE202667364 #WebSecurity

CVE-2026-67364 (CVSS 10): CRITICAL pre-auth PHP code injection in Balbooa Forms for Joomla (v1.0.0 – 2.4.3.1). Exploitable via unescaped query param in custom-PHP handler. Update to 2.4.3.2+ now. https://radar.offseq.com/threat/cve-2026-67364-cwe-94-improper-control-of-generation-of-code-code-injection-in-balbooacom-balbooa-36f88c0efc17ca75 #OffSeq #Joomla #CVE202667364 #WebSecurity

CISA has added two known vulnerabilities to the KEV catalogue.

- CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72529

- CVE-2026-72530: TrueConf Server Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72530 #CISA

Yesterday:

Cisco:

CRITICAL: CVE-2026-20231, CVE-2026-20315, and CVE-2026-20317: Secure Workload Software Security Hardening Release: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP @TalosSecurity #Cisco #infosec #vulnerability

Cisco patches Secure Workload flaws CVE-2026-20315 and CVE-2026-20317, an authentication bypass and privilege escalation pair scoring CVSS 10. Upgrade now.

#Cisco #CVE #AuthenticationBypass #PrivilegeEscalation #Vulnerability #InfoSec #PatchNow

https://securityonline.info/cisco-secure-workload-cve-2026-20315/?utm_source=mastodon&utm_medium=jetpack_social

CISA has added two known vulnerabilities to the KEV catalogue.

- CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72529

- CVE-2026-72530: TrueConf Server Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-72530 #CISA

Yesterday:

Cisco:

CRITICAL: CVE-2026-20231, CVE-2026-20315, and CVE-2026-20317: Secure Workload Software Security Hardening Release: August 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-csw1-shSvndWP @TalosSecurity #Cisco #infosec #vulnerability

Cisco patches Secure Workload flaws CVE-2026-20315 and CVE-2026-20317, an authentication bypass and privilege escalation pair scoring CVSS 10. Upgrade now.

#Cisco #CVE #AuthenticationBypass #PrivilegeEscalation #Vulnerability #InfoSec #PatchNow

https://securityonline.info/cisco-secure-workload-cve-2026-20315/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-19942 - High (8.1)

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (repla...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19942 - High (8.1)

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (repla...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Frauscher FDS102 vulnerabilities include CVE-2026-14950 (CVSS 9.8), a session flaw enabling unauthorized continued access. Update to v2.14.0.

#Frauscher #FDS102 #ICS #RailwaySecurity #CVE #OTSecurity

https://securityonline.info/frauscher-fds102-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Frauscher FDS 102 v2.1.0 hit by CRITICAL vuln (CVE-2026-14950): insufficient session expiration lets remote attackers keep using stolen session tokens. No patch yet — monitor sessions, restrict access. https://radar.offseq.com/threat/cve-2026-14950-cwe-613-insufficient-session-expiration-in-frauscher-sensortechnik-fds-102-0a0f578bbcdd7c33 #OffSeq #ICS #CVE202614950 #Security

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

Frauscher FDS102 vulnerabilities include CVE-2026-14950 (CVSS 9.8), a session flaw enabling unauthorized continued access. Update to v2.14.0.

#Frauscher #FDS102 #ICS #RailwaySecurity #CVE #OTSecurity

https://securityonline.info/frauscher-fds102-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Frauscher FDS 102 v2.1.0 hit by CRITICAL vuln (CVE-2026-14950): insufficient session expiration lets remote attackers keep using stolen session tokens. No patch yet — monitor sessions, restrict access. https://radar.offseq.com/threat/cve-2026-14950-cwe-613-insufficient-session-expiration-in-frauscher-sensortechnik-fds-102-0a0f578bbcdd7c33 #OffSeq #ICS #CVE202614950 #Security

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

🟠 CVE-2026-76633 - High (8.1)

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76633/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76633 - High (8.1)

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76633/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76833 - High (7.8)

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76833 - High (7.8)

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61897 - High (7.8)

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61897/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61897 - High (7.8)

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61897/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-28164: CRITICAL CSRF in HashThemes Easy Elementor Addons ≤2.3.7. Remote attackers can exploit this for full user compromise. No patch yet — track vendor advisories. CVSS 9.6. https://radar.offseq.com/threat/cve-2026-28164-cwe-352-cross-site-request-forgery-csrf-in-hashthemes-easy-elementor-addons-7bfb9b1be22a1e31 #OffSeq #WordPress #CSRF #CVE2026_28164

CVE-2026-28164: CRITICAL CSRF in HashThemes Easy Elementor Addons ≤2.3.7. Remote attackers can exploit this for full user compromise. No patch yet — track vendor advisories. CVSS 9.6. https://radar.offseq.com/threat/cve-2026-28164-cwe-352-cross-site-request-forgery-csrf-in-hashthemes-easy-elementor-addons-7bfb9b1be22a1e31 #OffSeq #WordPress #CSRF #CVE2026_28164

🟠 CVE-2026-76886 - High (8.1)

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76886 - High (8.1)

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75146 - High (8.1)

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negativ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75146/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75146 - High (8.1)

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negativ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75146/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/9]

Most Impactful Security Incidents ( 2026‑08‑18 → 2026‑08‑19 )

---

PRIORITY 1 – Critical / High‑Severity Flaws (CVSS 7‑10):

CVE‑2026‑60392
• 7.8 (HIGH)
• Oracle Outside In Technology – PDF Export SDK (Fusion Middleware)
• Local‑privilege escalation; requires attacker to have a logon on the host where the SDK runs. Successful exploitation can lead to full takeover of the component.
• 8.5.8
• Easily exploitable (local) – requires user interaction.
• https://cveawg.mitre.org/api/cve/CVE-2026-60392

CVE‑2026‑60782
• 9.8 (CRITICAL)
• Oracle Payments (E‑Business Suite) – File Transmission
• Remote unauthenticated attacker can compromise the Payments module via HTTP. Leads to full takeover of the Payments service.
• 12.2.3‑12.2.15
• Network‑accessible, no authentication required.
• https://cveawg.mitre.org/api/cve/CVE-2026-60782

CVE‑2026‑60730
• 9.9 (CRITICAL)
• Oracle WebCenter Portal – Composer component
• Remote unauthenticated attacker can compromise the portal via HTTP. Full takeover of the portal.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60730

CVE‑2026‑60728
• 9.1 (CRITICAL)
• Oracle WebCenter Portal – Portlet Services
• Remote unauthenticated attacker can cause denial‑of‑service and full compromise of portal data.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60728

CVE‑2026‑60727
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can take over the IAM system via HTTP.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60727

CVE‑2026‑60721
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Same vector as above; full takeover possible.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60721

CVE‑2026‑60720
• 9.9 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can compromise the IAM system.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60720

#infosecnews

🟠 CVE-2026-63490 - High (7.5)

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63490/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63490 - High (7.5)

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63490/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76251 - Splunk Enterprise priv-esc. Non-admins can leak Observability Cloud tokens. CVSS 7.1. Patch now. #CVE #Splunk #infosec

https://www.valtersit.com/cve/CVE-2026-76251/

CVE-2026-76262 - Info disclosure in Splunk Enterprise <10.4.2. Unauthenticated access to Prometheus metrics via Edge Processor SPL2 Preview sidecar. CVSS 7.5. Update to 10.4.2. #CVE #Splunk #infosec

https://www.valtersit.com/cve/CVE-2026-76262/

🔴 CVE-2026-76584 - Critical (9.9)

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76584/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76584 - Critical (9.9)

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76584/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Citrix Flaw Exposes Authentication on NetScaler Servers

Citrix has warned of a critical authentication bypass vulnerability, CVE-2026-19490, affecting NetScaler servers, urging customers to review their configurations and prioritize patching based on exposure and deployment role.

https://osintsights.com/citrix-flaw-exposes-authentication-on-netscaler-servers?utm_source=mastodon&utm_medium=social

#Cve202619490 #Citrix #AuthenticationBypass #Netscaler #Gateway

Citrix has released patches for CVE-2026-19490, a CVSS 9.3 authentication bypass in NetScaler ADC and Gateway. An unauthenticated remote attacker can exploit the flaw via an alternative path to bypass authentication on appliances configured as SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA servers.

#CitrixBleb #NetScalerVuln #CVSS9 #RemoteAccessSecurity

https://cyberworldops.eu/en/netscaler-critical-authentication-bypass-citrix-urges-immediate

🚨 #NetScaler bypass exposed

CVE-2026-19490 grants remote unauthenticated access to Gateway and AAA deployments.
🔗 read more: www.securityweek.com...

#ransomNews #cyberthreats #Citrix


Exploitation Expected for Crit...

CVE-2026-19490 (CVSS 9.3) is a critical NetScaler authentication bypass in NetScaler Gateway and ADC. Patch now to block unauthenticated access.

#NetScaler #Citrix #CVE202619490 #AuthBypass #InfoSec

https://securityonline.info/netscaler-authentication-bypass-cve-2026-19490/?utm_source=mastodon&utm_medium=jetpack_social

Citrix has released patches for CVE-2026-19490, a CVSS 9.3 authentication bypass in NetScaler ADC and Gateway. An unauthenticated remote attacker can exploit the flaw via an alternative path to bypass authentication on appliances configured as SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA servers.

#CitrixBleb #NetScalerVuln #CVSS9 #RemoteAccessSecurity

https://cyberworldops.eu/en/netscaler-critical-authentication-bypass-citrix-urges-immediate

CVE-2026-19490 (CVSS 9.3) is a critical NetScaler authentication bypass in NetScaler Gateway and ADC. Patch now to block unauthenticated access.

#NetScaler #Citrix #CVE202619490 #AuthBypass #InfoSec

https://securityonline.info/netscaler-authentication-bypass-cve-2026-19490/?utm_source=mastodon&utm_medium=jetpack_social

Keycloak unauthenticated account takeover via reset-credentials flow bypass

Keycloak의 reset-credentials 플로우에서 이메일 검증 링크 클릭을 우회해, 인증되지 않은 공격자가 임의 사용자 계정의 비밀번호를 재설정하고 탈취할 수 있는 치명적 취약점(CVE-2026-18963)이 공개됐다. 취약점은 keycloak-services의 상태 처리와 액션 토큰 검증 부재가 결합된 문제이며, 커뮤니티 Keycloak에도 영향을 준다. 영향 범위는 26.0.0 이후 일부 릴리스이며, 공개 컨테이너 사용자는 우선 26.7.2로 업그레이드해야 하고, Red Hat Build 사용자는 26.4.15 또는 26.6.6 패치를 적용해...

https://github.com/keycloak/keycloak/issues/51833

Guten Morgen an @univention Kund*innen, die unsere #Keycloak App einsetzen! Wir werden demnächst Version 26.7.2 herausbringen. Von dem Account-Takeover-CVE ist unsere App nicht betroffen.

Details findet Ihr hier: https://help.univention.com/t/keycloak-26-7-2-and-cve-2026-18963-potential-account-takeover-nubus-not-affected/25494

PSA: Critical unauthenticated account takeover vulnerability in #Keycloak - allows resetting arbitrary users‘ passwords. Update to 26.7.2 immediately or disable password reset. Tracked as CVE-2026-18963. https://github.com/keycloak/keycloak/issues/51833

#infosec

Guten Morgen an @univention Kund*innen, die unsere #Keycloak App einsetzen! Wir werden demnächst Version 26.7.2 herausbringen. Von dem Account-Takeover-CVE ist unsere App nicht betroffen.

Details findet Ihr hier: https://help.univention.com/t/keycloak-26-7-2-and-cve-2026-18963-potential-account-takeover-nubus-not-affected/25494

PSA: Critical unauthenticated account takeover vulnerability in #Keycloak - allows resetting arbitrary users‘ passwords. Update to 26.7.2 immediately or disable password reset. Tracked as CVE-2026-18963. https://github.com/keycloak/keycloak/issues/51833

#infosec

Splunk patches three critical embedded report flaws (CVE-2026-76310, CVSS 9.4) that let unauthenticated users affect system integrity.

#Splunk #CVE #AccessControl #SplunkEnterprise #Vulnerability #InfoSec #PatchNow

https://securityonline.info/splunk-enterprise-cve-2026-76310/?utm_source=mastodon&utm_medium=jetpack_social

Splunk patches three critical embedded report flaws (CVE-2026-76310, CVSS 9.4) that let unauthenticated users affect system integrity.

#Splunk #CVE #AccessControl #SplunkEnterprise #Vulnerability #InfoSec #PatchNow

https://securityonline.info/splunk-enterprise-cve-2026-76310/?utm_source=mastodon&utm_medium=jetpack_social

A critical Red Hat vulnerability, CVE-2026-66780 (CVSS 9.9), enables a MITM attack across a cluster mesh. Two more critical flaws also disclosed.

#RedHat #CVE202666780 #MITM #Kubernetes #Keycloak #InfoSec

https://securityonline.info/redhat-vulnerability-cve-2026-66780/?utm_source=mastodon&utm_medium=jetpack_social

A critical Red Hat vulnerability, CVE-2026-66780 (CVSS 9.9), enables a MITM attack across a cluster mesh. Two more critical flaws also disclosed.

#RedHat #CVE202666780 #MITM #Kubernetes #Keycloak #InfoSec

https://securityonline.info/redhat-vulnerability-cve-2026-66780/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-13097 - Critical (9.1)

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13097/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-13097 - Critical (9.1)

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13097/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/9]

Most Impactful Security Incidents ( 2026‑08‑18 → 2026‑08‑19 )

---

PRIORITY 1 – Critical / High‑Severity Flaws (CVSS 7‑10):

CVE‑2026‑60392
• 7.8 (HIGH)
• Oracle Outside In Technology – PDF Export SDK (Fusion Middleware)
• Local‑privilege escalation; requires attacker to have a logon on the host where the SDK runs. Successful exploitation can lead to full takeover of the component.
• 8.5.8
• Easily exploitable (local) – requires user interaction.
• https://cveawg.mitre.org/api/cve/CVE-2026-60392

CVE‑2026‑60782
• 9.8 (CRITICAL)
• Oracle Payments (E‑Business Suite) – File Transmission
• Remote unauthenticated attacker can compromise the Payments module via HTTP. Leads to full takeover of the Payments service.
• 12.2.3‑12.2.15
• Network‑accessible, no authentication required.
• https://cveawg.mitre.org/api/cve/CVE-2026-60782

CVE‑2026‑60730
• 9.9 (CRITICAL)
• Oracle WebCenter Portal – Composer component
• Remote unauthenticated attacker can compromise the portal via HTTP. Full takeover of the portal.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60730

CVE‑2026‑60728
• 9.1 (CRITICAL)
• Oracle WebCenter Portal – Portlet Services
• Remote unauthenticated attacker can cause denial‑of‑service and full compromise of portal data.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60728

CVE‑2026‑60727
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can take over the IAM system via HTTP.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60727

CVE‑2026‑60721
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Same vector as above; full takeover possible.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60721

CVE‑2026‑60720
• 9.9 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can compromise the IAM system.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60720

#infosecnews

🟠 CVE-2026-73925 - High (8.2)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73925 - High (8.2)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73921 - Critical (9.8)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73921/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73921 - Critical (9.8)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73921/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73938 - High (7.5)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73938 - High (7.5)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73939 - High (8.6)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

An Oracle WebLogic vulnerability, CVE-2026-60702 (CVSS 9.9), allows full server takeover. Oracle patched nine flaws, five rated critical. Update now.

#OracleWebLogic #CVE202660702 #RCE #FusionMiddleware #ServerTakeover #InfoSec

https://securityonline.info/oracle-weblogic-vulnerability-cve-2026-60702/?utm_source=mastodon&utm_medium=jetpack_social

An Oracle WebLogic vulnerability, CVE-2026-60702 (CVSS 9.9), allows full server takeover. Oracle patched nine flaws, five rated critical. Update now.

#OracleWebLogic #CVE202660702 #RCE #FusionMiddleware #ServerTakeover #InfoSec

https://securityonline.info/oracle-weblogic-vulnerability-cve-2026-60702/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-73931 - High (8.3)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73930 - Critical (9.9)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73930/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

NVIDIA Triton vulnerability CVE-2026-47627 scores CVSS 9.8. Learn how the denial of service flaw works and why you must update to version 26.06 now.

#NVIDIA #TritonInferenceServer #CVE202647627 #DenialOfService #AIsecurity #CVSS

https://securityonline.info/nvidia-triton-vulnerability-cve-2026-47627/?utm_source=mastodon&utm_medium=jetpack_social

NVIDIA Triton vulnerability CVE-2026-47627 scores CVSS 9.8. Learn how the denial of service flaw works and why you must update to version 26.06 now.

#NVIDIA #TritonInferenceServer #CVE202647627 #DenialOfService #AIsecurity #CVSS

https://securityonline.info/nvidia-triton-vulnerability-cve-2026-47627/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-47627 - Critical (9.8)

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47627/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has new advisories addressing two vulnerabilities:

- NVIDIA Cumulus Linux and NVOS - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5817

- CRITICAL, affecting the following: CVE-2026-47627, CVE-2026-47628, CVE-2026-47629, CVE-2026-47606, CVE-2026-47630

NVIDIA Triton Inference Server - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5865 #Nvidia #infosec #vulnerability #Linux

🟠 CVE-2026-47628 - High (7.5)

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47628/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has new advisories addressing two vulnerabilities:

- NVIDIA Cumulus Linux and NVOS - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5817

- CRITICAL, affecting the following: CVE-2026-47627, CVE-2026-47628, CVE-2026-47629, CVE-2026-47606, CVE-2026-47630

NVIDIA Triton Inference Server - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5865 #Nvidia #infosec #vulnerability #Linux

Nvidia has new advisories addressing two vulnerabilities:

- NVIDIA Cumulus Linux and NVOS - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5817

- CRITICAL, affecting the following: CVE-2026-47627, CVE-2026-47628, CVE-2026-47629, CVE-2026-47606, CVE-2026-47630

NVIDIA Triton Inference Server - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5865 #Nvidia #infosec #vulnerability #Linux

🟠 CVE-2026-76399 - High (8.1)

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language (SPL) using the permissions of the search owner, which could allow access ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76399 - High (8.1)

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language (SPL) using the permissions of the search owner, which could allow access ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76325 - Stored XSS in Splunk Enterprise. Power role can share malicious ui-tour object, executing JS in authenticated users' browsers. CVSS 7.3. Update to fixed versions immediately. #CVE #Splunk #infosec

https://www.valtersit.com/cve/CVE-2026-76325/

Cisco patches a Crosswork SQL injection flaw, CVE-2026-20030, rated CVSS 10.0. A BroadWorks XXE bug (CVE-2026-20320) also gets a fix.

#Cisco #CVE #SQLInjection #Crosswork #BroadWorks #XXE #Vulnerability #InfoSec

https://securityonline.info/cisco-crosswork-cve-2026-20030/?utm_source=mastodon&utm_medium=jetpack_social

Cisco patches a Crosswork SQL injection flaw, CVE-2026-20030, rated CVSS 10.0. A BroadWorks XXE bug (CVE-2026-20320) also gets a fix.

#Cisco #CVE #SQLInjection #Crosswork #BroadWorks #XXE #Vulnerability #InfoSec

https://securityonline.info/cisco-crosswork-cve-2026-20030/?utm_source=mastodon&utm_medium=jetpack_social

Cisco patches a Crosswork SQL injection flaw, CVE-2026-20030, rated CVSS 10.0. A BroadWorks XXE bug (CVE-2026-20320) also gets a fix.

#Cisco #CVE #SQLInjection #Crosswork #BroadWorks #XXE #Vulnerability #InfoSec

https://securityonline.info/cisco-crosswork-cve-2026-20030/?utm_source=mastodon&utm_medium=jetpack_social

Cisco patches a Crosswork SQL injection flaw, CVE-2026-20030, rated CVSS 10.0. A BroadWorks XXE bug (CVE-2026-20320) also gets a fix.

#Cisco #CVE #SQLInjection #Crosswork #BroadWorks #XXE #Vulnerability #InfoSec

https://securityonline.info/cisco-crosswork-cve-2026-20030/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-76003 (CRITICAL): Stack-based buffer overflow in UTT HiPER 1200GW (2.5.3-170306). Remote code execution possible via timestart argument; public exploit exists. No patch yet. Restrict access & monitor. https://radar.offseq.com/threat/cve-2026-76003-stack-based-buffer-overflow-in-utt-hiper-1200gw-f42b168f89ef1ec7 #OffSeq #CVE202676003 #infosec #vuln

🔴 CVE-2026-76003 - Critical (9.9)

A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76003/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76003 (CRITICAL): Stack-based buffer overflow in UTT HiPER 1200GW (2.5.3-170306). Remote code execution possible via timestart argument; public exploit exists. No patch yet. Restrict access & monitor. https://radar.offseq.com/threat/cve-2026-76003-stack-based-buffer-overflow-in-utt-hiper-1200gw-f42b168f89ef1ec7 #OffSeq #CVE202676003 #infosec #vuln

🔴 CVE-2026-76003 - Critical (9.9)

A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76003/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

UTT HiPER 1250GW v3.2.7-210907-180535 hit by CRITICAL stack-based buffer overflow (CVE-2026-76004) in HTTP handler. Exploitable via 'pvid' arg. No patch yet — restrict remote access & monitor traffic. https://radar.offseq.com/threat/cve-2026-76004-stack-based-buffer-overflow-in-utt-hiper-1250gw-976b1783bc5dbe2e #OffSeq #CVE202676004 #Vuln #Infosec

🔴 CVE-2026-76004 - Critical (9.9)

A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argumen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76004/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

UTT HiPER 1250GW v3.2.7-210907-180535 hit by CRITICAL stack-based buffer overflow (CVE-2026-76004) in HTTP handler. Exploitable via 'pvid' arg. No patch yet — restrict remote access & monitor traffic. https://radar.offseq.com/threat/cve-2026-76004-stack-based-buffer-overflow-in-utt-hiper-1250gw-976b1783bc5dbe2e #OffSeq #CVE202676004 #Vuln #Infosec

🔴 CVE-2026-76004 - Critical (9.9)

A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argumen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76004/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75976 - Critical (9.9)

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan_l2tp_password causes stack-based buffer overflow. The attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Stack-based buffer overflow (CVE-2026-75976, CVSS 9.4) in TRENDnet TEW-823DRU 1.1.02b01: remote exploitation possible via /cgi-bin/wan.cgi. Public exploit exists. Assess exposure & monitor for patches: https://radar.offseq.com/threat/cve-2026-75976-stack-based-buffer-overflow-in-trendnet-tew-823dru-3e76dd1e5f15fcab #OffSeq #Vulnerability #Infosec #IoTSecurity

🔴 CVE-2026-75976 - Critical (9.9)

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan_l2tp_password causes stack-based buffer overflow. The attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Stack-based buffer overflow (CVE-2026-75976, CVSS 9.4) in TRENDnet TEW-823DRU 1.1.02b01: remote exploitation possible via /cgi-bin/wan.cgi. Public exploit exists. Assess exposure & monitor for patches: https://radar.offseq.com/threat/cve-2026-75976-stack-based-buffer-overflow-in-trendnet-tew-823dru-3e76dd1e5f15fcab #OffSeq #Vulnerability #Infosec #IoTSecurity

CVE-2026-75094: CRITICAL OS command injection in COMFAST CF-N1-S v2.6.0.1. Exploit code is public, no official patch. Restrict access to /cgi-bin/mbox-config to reduce risk. Details: https://radar.offseq.com/threat/cve-2026-75094-os-command-injection-in-comfast-cf-n1-s-07737fa4c8cac0ee #OffSeq #CVE #IoT #Security

🔴 CVE-2026-75094 - Critical (9.1)

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injectio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75094/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

TRENDnet TEW-755AP is affected by CVE-2026-76589 (CRITICAL, CVSS 9.4): stack-based buffer overflow in /sbin/mycli, exploitable remotely. Public exploit; no patch yet. Restrict device access and monitor. https://radar.offseq.com/threat/cve-2026-76589-stack-based-buffer-overflow-in-trendnet-tew-755ap-b22775c9ba4ec937 #OffSeq #CVE202676589 #IoTSecurity

🔴 CVE-2026-76589 - Critical (9.9)

A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument ssid results in stack-based buffer overflow. The attack may be launched remotely. The exp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76589/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

TRENDnet TEW-755AP is affected by CVE-2026-76589 (CRITICAL, CVSS 9.4): stack-based buffer overflow in /sbin/mycli, exploitable remotely. Public exploit; no patch yet. Restrict device access and monitor. https://radar.offseq.com/threat/cve-2026-76589-stack-based-buffer-overflow-in-trendnet-tew-755ap-b22775c9ba4ec937 #OffSeq #CVE202676589 #IoTSecurity

🔴 CVE-2026-76589 - Critical (9.9)

A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument ssid results in stack-based buffer overflow. The attack may be launched remotely. The exp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76589/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76590: CRITICAL stack buffer overflow in TRENDnet TEW-755AP (/cgi-bin/wan.cgi, CVSS 9.4). Remote code execution possible. No patch — restrict access, monitor endpoints. Exploit code public, no active attacks yet. https://radar.offseq.com/threat/cve-2026-76590-stack-based-buffer-overflow-in-trendnet-tew-755ap-37978d53e46251c0 #OffSeq #Vuln #IoTSec #CVE2026

🔴 CVE-2026-76590 - Critical (9.9)

A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the component ssi. Such manipulation of the argument cameo.wan.wan_pppoe_password_00 leads to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76590: CRITICAL stack buffer overflow in TRENDnet TEW-755AP (/cgi-bin/wan.cgi, CVSS 9.4). Remote code execution possible. No patch — restrict access, monitor endpoints. Exploit code public, no active attacks yet. https://radar.offseq.com/threat/cve-2026-76590-stack-based-buffer-overflow-in-trendnet-tew-755ap-37978d53e46251c0 #OffSeq #Vuln #IoTSec #CVE2026

🔴 CVE-2026-76590 - Critical (9.9)

A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the component ssi. Such manipulation of the argument cameo.wan.wan_pppoe_password_00 leads to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

TRENDnet TEW-WLC100P v12.07b01 impacted by CRITICAL stack-based buffer overflow (CVE-2026-75783, CVSS 9.4) in DHCP blobmsg Handler. Exploit needs local network access. No patch yet — restrict access & monitor logs. https://radar.offseq.com/threat/cve-2026-75783-stack-based-buffer-overflow-in-trendnet-tew-wlc100p-e172681d65344cad #OffSeq #CVE202675783 #Vuln #IoTSecurity

CoSnitch : Copilot a lui-même livré la faille qui permet de voler vos données https://www.it-connect.fr/cosnitch-cve-2026-24301-copilot-personal-faille-un-clic/ #ActuCybersécurité #Cybersécurité #Microsoft #Copilot #IA

Von wegen KI: MS Copilot ist strunzdumm

Das Sicherheitsunternehmen Varonis hat eine Sicherheitslücke in Microsoft (MS) Copilot gefunden. Die hat inzwischen auch einen Namen bekommen und eine CVE-Nummer: CVE-2026-24301 oder CoSnitch. Sie ist mit 8,8 von 10 als kritisch eingestuft. Anscheinend gibt es noch keinen Flicken dagegen. Wer diese Lücke ausnutzt, kann Copilot von Ferne heimlich (ohne Interaktion des Opfers) dazu veranlassen, sensible geheime Daten zu senden. Zwar hat Copilot Schutzvorkehrungen gegen solchen Missbrauch, aber die sind unvollständig. Der Trick der Forscher/innen bestand darin, Copilot sich selbst hacken zu lassen! Immer wenn die KI einen ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/08/19/von-wegen-ki-ms-copilot-ist-strunzdumm/

#cybercrime #datenleck #KI #Microsoft #sicherheit #spionage #unplugMicrosoft #UnplugTrump

CoSnitch : Copilot a lui-même livré la faille qui permet de voler vos données https://www.it-connect.fr/cosnitch-cve-2026-24301-copilot-personal-faille-un-clic/ #ActuCybersécurité #Cybersécurité #Microsoft #Copilot #IA

Von wegen KI: MS Copilot ist strunzdumm

Das Sicherheitsunternehmen Varonis hat eine Sicherheitslücke in Microsoft (MS) Copilot gefunden. Die hat inzwischen auch einen Namen bekommen und eine CVE-Nummer: CVE-2026-24301 oder CoSnitch. Sie ist mit 8,8 von 10 als kritisch eingestuft. Anscheinend gibt es noch keinen Flicken dagegen. Wer diese Lücke ausnutzt, kann Copilot von Ferne heimlich (ohne Interaktion des Opfers) dazu veranlassen, sensible geheime Daten zu senden. Zwar hat Copilot Schutzvorkehrungen gegen solchen Missbrauch, aber die sind unvollständig. Der Trick der Forscher/innen bestand darin, Copilot sich selbst hacken zu lassen! Immer wenn die KI einen ... Weiterlesen:

https://www.pc-fluesterer.info/wordpress/2026/08/19/von-wegen-ki-ms-copilot-ist-strunzdumm/

#cybercrime #datenleck #KI #Microsoft #sicherheit #spionage #unplugMicrosoft #UnplugTrump

Microsoft has an advisory for a new critical Copilot vulnerability.

CRITICAL: CVE-2026-24301: Microsoft Copilot Information Disclosure Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24301

More information:

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') https://cwe.mitre.org/data/definitions/77.html #infosec #Microsoft #Copilot #vulnerability

🟠 CVE-2026-73198 - High (7.5)

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73198/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73198 - High (7.5)

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73198/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73197 - High (7.5)

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73197/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73197 - High (7.5)

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73197/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-75860: CRITICAL privilege escalation in JSON Options ≤0.0.4. Unauthenticated attackers can update WordPress options & gain admin access. Remove or disable plugin until fix is available. Full site takeover risk. https://radar.offseq.com/threat/cve-2026-75860-cwe-269-improper-privilege-management-in-json-options-5e170a19118b89b1 #OffSeq #WordPress #CVE202675860

CVE-2026-75860: CRITICAL privilege escalation in JSON Options ≤0.0.4. Unauthenticated attackers can update WordPress options & gain admin access. Remove or disable plugin until fix is available. Full site takeover risk. https://radar.offseq.com/threat/cve-2026-75860-cwe-269-improper-privilege-management-in-json-options-5e170a19118b89b1 #OffSeq #WordPress #CVE202675860

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

#OT #Advisory VDE-2026-078
Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to Unrestricted Upload of File with Dangerous Type, Path Traversal: '../filedir', Insertion of Sensitive Information into Log File, Incorrect Authorization, Insufficient Session Expiration, Cross-Site Request Forgery (CSRF), Missing Authentication for Critical Function, and Missing Authorization.
#CVE CVE-2026-14950, CVE-2026-14948, CVE-2026-14951, CVE-2026-14952, CVE-2026-14947, CVE-2026-14946, CVE-2026-14949, CVE-2026-14953

https://certvde.com/en/advisories/vde-2026-078/

#CSAF https://frauscher.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-078.json

CVE-2026-76760 - Code injection in chenhg5 cc-connect <=1.4.1 via Authenticate (core/webhook.go). Remote exploit public, CVSS 7.3, no patch yet. Limit access and monitor logs. #CVE #infosec #codeinjection

https://www.valtersit.com/cve/CVE-2026-76760/

CVE-2026-76850 (CRITICAL): InternLM lmdeploy <0.16.0 vulnerable to remote code execution via untrusted pickle deserialization on ZeroMQ endpoints. Enable API keys or disable disaggregated serving to mitigate. https://radar.offseq.com/threat/cve-2026-76850-deserialization-of-untrusted-data-in-internlm-lmdeploy-657fdd1d6177df51 #OffSeq #Infosec #Vuln #CVE202676850

🔴 CVE-2026-76850 - Critical (9.8)

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76850 (CRITICAL): InternLM lmdeploy <0.16.0 vulnerable to remote code execution via untrusted pickle deserialization on ZeroMQ endpoints. Enable API keys or disable disaggregated serving to mitigate. https://radar.offseq.com/threat/cve-2026-76850-deserialization-of-untrusted-data-in-internlm-lmdeploy-657fdd1d6177df51 #OffSeq #Infosec #Vuln #CVE202676850

🔴 CVE-2026-76850 - Critical (9.8)

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76880 - High (7.5)

RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76880/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76880 - High (7.5)

RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76880/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76879 - High (7.5)

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76879/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76879 - High (7.5)

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76879/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76832 - High (8.8)

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument passed to rea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76832 - High (8.8)

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument passed to rea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Splunk patches 9.1 CVSS RCE in MCP Server and 9 flaws in AI Toolkit

Splunk이 MCP Server, AI Toolkit, Splunk Connect for Kafka 등에서 발견된 17개 취약점의 보안 업데이트를 배포했다. 가장 심각한 CVE-2026-76404(CVSS 9.1)는 Splunk MCP Server 1.2.1 미만에서 관리자 권한 사용자가 자격 증명 관리 기능의 안전하지 않은 역직렬화를 악용해 호스트 OS 명령을 실행할 수 있는 RCE다. AI Toolkit에도 악성 sparse matrix/pickle 데이터를 포함한 모델 로딩으로 코드 실행이 가능한 CVE-2026-76395(CVSS 8.8)를 포함해...

https://cyberupdates365.com/splunk-mcp-server-rce-patch/

🟠 CVE-2026-76395 - High (8.8)

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76395/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76395 - High (8.8)

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76395/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76397 - High (8.1)

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolki...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76397/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76397 - High (8.1)

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolki...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76397/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack