🟠 CVE-2026-4946 - High (8.8)

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4946/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4946 - High (8.8)

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4946/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0562 - High (8.3)

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function in `backend/routers/friends.py` does not impleme...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0562 - High (8.3)

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function in `backend/routers/friends.py` does not impleme...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0560 - High (7.5)

A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0560/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0560 - High (7.5)

A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0560/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 HIGH severity: CVE-2026-0558 in parisneo/lollms (≤2.2.0) — /api/files/extract-text allows unauthenticated file uploads, risking DoS & info leaks. Restrict access, enforce auth, and monitor activity. No patch yet. https://radar.offseq.com/threat/cve-2026-0558-cwe-287-improper-authentication-in-p-51fddf90 #OffSeq #Vuln #AppSec

🟠 CVE-2026-0558 - High (7.5)

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-relate...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 HIGH severity: CVE-2026-0558 in parisneo/lollms (≤2.2.0) — /api/files/extract-text allows unauthenticated file uploads, risking DoS & info leaks. Restrict access, enforce auth, and monitor activity. No patch yet. https://radar.offseq.com/threat/cve-2026-0558-cwe-287-improper-authentication-in-p-51fddf90 #OffSeq #Vuln #AppSec

🟠 CVE-2026-0558 - High (7.5)

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-relate...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34005 - High (8.8)

In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34005/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34005 - High (8.8)

In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34005/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22744 - High (7.5)

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value directly into the @field:{VALUE} RediSearch TAG block without escaping ch...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22744 - High (7.5)

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value directly into the @field:{VALUE} RediSearch TAG block without escaping ch...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22743 - High (7.5)

Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22743/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22743 - High (7.5)

Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22743/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22738 - Critical (9.8)

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22738/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22738 - Critical (9.8)

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22738/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-22738 in Spring AI SimpleVectorStore allows unauth RCE via SpEL injection (1.0.0 – 1.0.4, 1.1.0 – 1.1.3). Patch to 1.0.5/1.1.4 when released. Validate input now! https://radar.offseq.com/threat/cve-2026-22738-vulnerability-in-spring-spring-ai-473dec2d #OffSeq #SpringAI #infosec #CVE202622738

🟠 CVE-2026-5045 - High (8.8)

A vulnerability was detected in Tenda FH1201 1.2.0.14(408). This impacts the function WrlclientSet of the file /goform/WrlclientSet of the component Parameter Handler. Performing a manipulation of the argument GO results in stack-based buffer over...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5045/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5045 - High (8.8)

A vulnerability was detected in Tenda FH1201 1.2.0.14(408). This impacts the function WrlclientSet of the file /goform/WrlclientSet of the component Parameter Handler. Performing a manipulation of the argument GO results in stack-based buffer over...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5045/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33573 - High (8.8)

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override workspace boundaries by supplying attacker-controlled spawnedBy and wo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33573 - High (8.8)

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override workspace boundaries by supplying attacker-controlled spawnedBy and wo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33573 - High (8.8)

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override workspace boundaries by supplying attacker-controlled spawnedBy and wo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33573 - High (8.8)

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override workspace boundaries by supplying attacker-controlled spawnedBy and wo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32980 - High (7.5)

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32980 - High (7.5)

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32980 - High (7.5)

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32980 - High (7.5)

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5044 - High (8.8)

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. Such manipulation of the argument webpage leads to st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5044 - High (8.8)

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. Such manipulation of the argument webpage leads to st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5044 - High (8.8)

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. Such manipulation of the argument webpage leads to st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5044 - High (8.8)

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. Such manipulation of the argument webpage leads to st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33572 - High (8.4)

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information includ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33572/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33572 - High (8.4)

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information includ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33572/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32987 - Critical (9.8)

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32987/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32987 - Critical (9.8)

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32987/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32922 - Critical (9.9)

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32922 - Critical (9.9)

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32922 - Critical (9.9)

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32922 - Critical (9.9)

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32915 - High (8.8)

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege sandboxed leaf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32915/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32915 - High (8.8)

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege sandboxed leaf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32915/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32914 - High (8.8)

OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner-only surfaces. Attackers with command authorization can read or mo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32914 - High (8.8)

OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner-only surfaces. Attackers with command authorization can read or mo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32924 - Critical (9.8)

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass grou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32924 - Critical (9.8)

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass grou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32918 - High (8.4)

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify sess...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32918/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32918 - High (8.4)

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify sess...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32918/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32978 - High (8)

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32978/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32978 - High (8)

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32978/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34226 - High (7.5)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { crede...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5046 - High (8.8)

A flaw has been found in Tenda FH1201 1.2.0.14(408). Affected is the function formWrlExtraSet of the file /goform/WrlExtraSet of the component Parameter Handler. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5046/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5046 - High (8.8)

A flaw has been found in Tenda FH1201 1.2.0.14(408). Affected is the function formWrlExtraSet of the file /goform/WrlExtraSet of the component Parameter Handler. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5046/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33575 - High (7.5)

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can rec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33575 - High (7.5)

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can rec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33575 - High (7.5)

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can rec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33575 - High (7.5)

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can rec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32975 - Critical (9.8)

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to allowlisted groups t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32975/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32975 - Critical (9.8)

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to allowlisted groups t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32975/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-5041 (MEDIUM): Command injection in Chamber of Commerce Membership Mgmt System v1.0 via admin/pageMail.php. High privileges needed, public exploit exists. Input validation & patching advised. https://radar.offseq.com/threat/cve-2026-5041-command-injection-in-code-projects-c-82c5a99c #OffSeq #Vuln #CommandInjection #InfoSec

⚠️ CVE-2026-5041 (MEDIUM): Command injection in Chamber of Commerce Membership Mgmt System v1.0 via admin/pageMail.php. High privileges needed, public exploit exists. Input validation & patching advised. https://radar.offseq.com/threat/cve-2026-5041-command-injection-in-code-projects-c-82c5a99c #OffSeq #Vuln #CommandInjection #InfoSec

🟠 CVE-2026-5042 - High (8.8)

A security flaw has been discovered in Belkin F9K1122 1.00.33. The affected element is the function formCrossBandSwitch of the file /goform/formCrossBandSwitch of the component Parameter Handler. The manipulation of the argument webpage results in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5042 - High (8.8)

A security flaw has been discovered in Belkin F9K1122 1.00.33. The affected element is the function formCrossBandSwitch of the file /goform/formCrossBandSwitch of the component Parameter Handler. The manipulation of the argument webpage results in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5043 - High (8.8)

A weakness has been identified in Belkin F9K1122 1.00.33. The impacted element is the function formSetPassword of the file /goform/formSetPassword of the component Parameter Handler. This manipulation of the argument webpage causes stack-based buf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5043/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5043 - High (8.8)

A weakness has been identified in Belkin F9K1122 1.00.33. The impacted element is the function formSetPassword of the file /goform/formSetPassword of the component Parameter Handler. This manipulation of the argument webpage causes stack-based buf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5043/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ MEDIUM severity SQL Injection (CVE-2026-5035) found in code-projects Accounting System 1.0 (/view_work.php, Parameter Handler). Public exploit available — review your systems and restrict access if possible. https://radar.offseq.com/threat/cve-2026-5035-sql-injection-in-code-projects-accou-b844fbad #OffSeq #SQLInjection #Vuln

⚠️ MEDIUM severity SQL Injection (CVE-2026-5035) found in code-projects Accounting System 1.0 (/view_work.php, Parameter Handler). Public exploit available — review your systems and restrict access if possible. https://radar.offseq.com/threat/cve-2026-5035-sql-injection-in-code-projects-accou-b844fbad #OffSeq #SQLInjection #Vuln

🚨 CVE-2026-5036: HIGH severity stack buffer overflow in Tenda 4G06 (04.06.01.29) enables remote code execution. Exploit code is public — patch or mitigate now. Watch for attacks on /goform/DhcpListClient. https://radar.offseq.com/threat/cve-2026-5036-stack-based-buffer-overflow-in-tenda-210df5d9 #OffSeq #CVE20265036 #RouterSecurity

🟠 CVE-2026-5036 - High (8.8)

A vulnerability was found in Tenda 4G06 04.06.01.29. This vulnerability affects the function fromDhcpListClient of the file /goform/DhcpListClient of the component Endpoint. Performing a manipulation of the argument page results in stack-based buf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5036/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-5036: HIGH severity stack buffer overflow in Tenda 4G06 (04.06.01.29) enables remote code execution. Exploit code is public — patch or mitigate now. Watch for attacks on /goform/DhcpListClient. https://radar.offseq.com/threat/cve-2026-5036-stack-based-buffer-overflow-in-tenda-210df5d9 #OffSeq #CVE20265036 #RouterSecurity

🟠 CVE-2026-5036 - High (8.8)

A vulnerability was found in Tenda 4G06 04.06.01.29. This vulnerability affects the function fromDhcpListClient of the file /goform/DhcpListClient of the component Endpoint. Performing a manipulation of the argument page results in stack-based buf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5036/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-5033 (MEDIUM): SQL injection in code-projects Accounting System 1.0 (/view_costumer.php, cos_id) is being actively exploited. Remote risk — monitor and patch as soon as fixes arrive. More: https://radar.offseq.com/threat/cve-2026-5033-sql-injection-in-code-projects-accou-9e1a8bbd #OffSeq #SQLInjection #VulnResearch

🚨 CVE-2026-5033 (MEDIUM): SQL injection in code-projects Accounting System 1.0 (/view_costumer.php, cos_id) is being actively exploited. Remote risk — monitor and patch as soon as fixes arrive. More: https://radar.offseq.com/threat/cve-2026-5033-sql-injection-in-code-projects-accou-9e1a8bbd #OffSeq #SQLInjection #VulnResearch

🔴 CVE-2026-5024: HIGH-severity stack buffer overflow in D-Link DIR-513 (v1.10). Remote, no auth needed, public exploit released. Replace ASAP or isolate device & restrict access. No patch from vendor. https://radar.offseq.com/threat/cve-2026-5024-stack-based-buffer-overflow-in-d-lin-e70f155a #OffSeq #Vulnerability #RouterSecurity

🟠 CVE-2026-5024 - High (8.8)

A vulnerability was found in D-Link DIR-513 1.10. This issue affects the function formSetEmail of the file /goform/formSetEmail. Performing a manipulation of the argument curTime results in stack-based buffer overflow. The attack is possible to be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5024/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5024: HIGH-severity stack buffer overflow in D-Link DIR-513 (v1.10). Remote, no auth needed, public exploit released. Replace ASAP or isolate device & restrict access. No patch from vendor. https://radar.offseq.com/threat/cve-2026-5024-stack-based-buffer-overflow-in-d-lin-e70f155a #OffSeq #Vulnerability #RouterSecurity

🟠 CVE-2026-5024 - High (8.8)

A vulnerability was found in D-Link DIR-513 1.10. This issue affects the function formSetEmail of the file /goform/formSetEmail. Performing a manipulation of the argument curTime results in stack-based buffer overflow. The attack is possible to be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5024/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 HIGH: CVE-2026-5021 in Tenda F453 v1.0.0.3 enables remote stack buffer overflow via /goform/PPTPUserSetting — no auth needed! PoC is public; patch/mitigate now to block total device compromise. https://radar.offseq.com/threat/cve-2026-5021-stack-based-buffer-overflow-in-tenda-f1fb8811 #OffSeq #CVE20265021 #Infosec #Router

🟠 CVE-2026-5021 - High (8.8)

A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. This manipulation of the argument delno causes stack-based buffer overflow. Remote exploitation ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5021/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 HIGH: CVE-2026-5021 in Tenda F453 v1.0.0.3 enables remote stack buffer overflow via /goform/PPTPUserSetting — no auth needed! PoC is public; patch/mitigate now to block total device compromise. https://radar.offseq.com/threat/cve-2026-5021-stack-based-buffer-overflow-in-tenda-f1fb8811 #OffSeq #CVE20265021 #Infosec #Router

🟠 CVE-2026-5021 - High (8.8)

A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. This manipulation of the argument delno causes stack-based buffer overflow. Remote exploitation ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5021/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

@offseq

CRITICAL: CVE-2026-4851 affects CASIANO GRID::Machine

... which is abandonware last updated in 2011.

⚠️ CRITICAL: CVE-2026-4851 affects CASIANO GRID::Machine (≤0.127). Malicious remote hosts can trigger client-side RCE via unsafe eval() deserialization. Only connect to trusted hosts & review code paths. Details: https://radar.offseq.com/threat/cve-2026-4851-cwe-502-deserialization-of-untrusted-4ee6eb90 #OffSeq #CVE20264851 #Perl #Security

@offseq

CRITICAL: CVE-2026-4851 affects CASIANO GRID::Machine

... which is abandonware last updated in 2011.

⚠️ CRITICAL: CVE-2026-4851 affects CASIANO GRID::Machine (≤0.127). Malicious remote hosts can trigger client-side RCE via unsafe eval() deserialization. Only connect to trusted hosts & review code paths. Details: https://radar.offseq.com/threat/cve-2026-4851-cwe-502-deserialization-of-untrusted-4ee6eb90 #OffSeq #CVE20264851 #Perl #Security

⚠️ CVE-2026-5019: SQL injection in code-projects Simple Food Order System 1.0 (all-orders.php, Status param). MEDIUM severity, public exploit available — remote attackers at risk. Monitor and restrict exposure. https://radar.offseq.com/threat/cve-2026-5019-sql-injection-in-code-projects-simpl-bb8230db #OffSeq #SQLi #Vuln

⚠️ CVE-2026-5019: SQL injection in code-projects Simple Food Order System 1.0 (all-orders.php, Status param). MEDIUM severity, public exploit available — remote attackers at risk. Monitor and restrict exposure. https://radar.offseq.com/threat/cve-2026-5019-sql-injection-in-code-projects-simpl-bb8230db #OffSeq #SQLi #Vuln

🚨 HIGH severity buffer overflow in Wavlink WL-WN579X3-C (231124): Remote attackers can exploit UPnP Handler to run code. No patch from vendor. Disable UPnP & block remote access immediately. CVE-2026-5004 https://radar.offseq.com/threat/cve-2026-5004-stack-based-buffer-overflow-in-wavli-7ae39014 #OffSeq #Infosec #RouterSecurity #CVE20265004

🟠 CVE-2026-5004 - High (8.8)

A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This impacts the function sub_4019FC of the file /cgi-bin/firewall.cgi of the component UPNP Handler. Executing a manipulation of the argument UpnpEnabled can lead to stack-based buffe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5004/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 HIGH severity buffer overflow in Wavlink WL-WN579X3-C (231124): Remote attackers can exploit UPnP Handler to run code. No patch from vendor. Disable UPnP & block remote access immediately. CVE-2026-5004 https://radar.offseq.com/threat/cve-2026-5004-stack-based-buffer-overflow-in-wavli-7ae39014 #OffSeq #Infosec #RouterSecurity #CVE20265004

🟠 CVE-2026-5004 - High (8.8)

A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This impacts the function sub_4019FC of the file /cgi-bin/firewall.cgi of the component UPNP Handler. Executing a manipulation of the argument UpnpEnabled can lead to stack-based buffe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5004/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 New security advisory:

CVE-2017-20225 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2017-20225-tiemu-stack-buffer-overflow

#Cybersecurity #SecurityPatching #HackerNews

🔴 New security advisory:

CVE-2017-20227 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2017-20227-jad-java-decompiler-buffer-overflow-update-now

#Cybersecurity #SecurityPatching #HackerNews

🔴 CVE-2026-30457 - Critical (9.8)

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30457 - Critical (9.8)

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-4987 (HIGH): SureForms plugin for WordPress lets attackers bypass payment amount validation by setting form_id to 0 — no auth needed, all versions <=2.5.2 at risk. Patch or mitigate now! https://radar.offseq.com/threat/cve-2026-4987-cwe-20-improper-input-validation-in--6438ea07 #OffSeq #WordPress #Vuln #PaymentSecurity

🟠 CVE-2026-4987 - High (7.5)

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a paym...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4987/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-4987 (HIGH): SureForms for WordPress lets unauthenticated attackers bypass payment validation via form_id=0. All versions vulnerable — financial loss risk. Patch when available or apply server-side validation. https://radar.offseq.com/threat/cve-2026-4987-cwe-20-improper-input-validation-in--6438ea07 #OffSeq #WordPress #Vuln

⚠️ CVE-2026-4987 (HIGH): SureForms plugin for WordPress lets attackers bypass payment amount validation by setting form_id to 0 — no auth needed, all versions <=2.5.2 at risk. Patch or mitigate now! https://radar.offseq.com/threat/cve-2026-4987-cwe-20-improper-input-validation-in--6438ea07 #OffSeq #WordPress #Vuln #PaymentSecurity

🟠 CVE-2026-4987 - High (7.5)

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a paym...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4987/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-4987 (HIGH): SureForms for WordPress lets unauthenticated attackers bypass payment validation via form_id=0. All versions vulnerable — financial loss risk. Patch when available or apply server-side validation. https://radar.offseq.com/threat/cve-2026-4987-cwe-20-improper-input-validation-in--6438ea07 #OffSeq #WordPress #Vuln

🔴 CVE-2026-30458 - Critical (9.1)

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30458/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30458 - Critical (9.1)

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30458/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 HIGH severity: CVE-2026-4248 in Ultimate Member plugin (≤2.11.2) lets Contributor users trigger admin password resets via malicious post preview — risking full site takeover. Restrict access & monitor now! https://radar.offseq.com/threat/cve-2026-4248-cwe-285-improper-authorization-in-ul-0446e863 #OffSeq #WordPress #CVE20264248 #Vuln

🟠 CVE-2026-4248 - High (8)

The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.2. This is due to the '{usermeta:password_reset_link}' template tag being processed within post content via the '[u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4248/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 HIGH severity: CVE-2026-4248 in Ultimate Member plugin (≤2.11.2) lets Contributor users trigger admin password resets via malicious post preview — risking full site takeover. Restrict access & monitor now! https://radar.offseq.com/threat/cve-2026-4248-cwe-285-improper-authorization-in-ul-0446e863 #OffSeq #WordPress #CVE20264248 #Vuln

🟠 CVE-2026-4248 - High (8)

The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.2. This is due to the '{usermeta:password_reset_link}' template tag being processed within post content via the '[u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4248/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27309 - High (7.8)

Substance3D - Stager versions 3.1.7 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27309/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-1679: HIGH severity buffer overflow in Zephyr RTOS (all versions). Local attackers can trigger kernel memory corruption via eswifi socket offload driver. Patch ASAP, enforce access controls. Details: https://radar.offseq.com/threat/cve-2026-1679-buffer-copy-without-checking-size-of-5ca8f17f #OffSeq #ZephyrRTOS #IoTSecurity #CVE

CVE-2026-1679: HIGH severity buffer overflow in Zephyr RTOS (all versions). Local attackers can trigger kernel memory corruption via eswifi socket offload driver. Patch ASAP, enforce access controls. Details: https://radar.offseq.com/threat/cve-2026-1679-buffer-copy-without-checking-size-of-5ca8f17f #OffSeq #ZephyrRTOS #IoTSecurity #CVE

🟠 CVE-2026-4961 - High (8.8)

A vulnerability was identified in Tenda AC6 15.03.05.16. Affected by this vulnerability is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. The manipulation of the argument PPPOEPassword leads to st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4960 - High (8.8)

A vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4960/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-33976 (CRITICAL, CVSS 9.7): Notesnook Web/Desktop <3.3.11 vulnerable to stored XSS → RCE via Web Clipper. Patch ASAP & review Electron settings. Details: https://radar.offseq.com/threat/cve-2026-33976-cwe-79-improper-neutralization-of-i-cedece5d #OffSeq #Cybersecurity #Infosec #Vulnerability

🚨 CVE-2026-33976 (CRITICAL, CVSS 9.7): Notesnook Web/Desktop <3.3.11 vulnerable to stored XSS → RCE via Web Clipper. Patch ASAP & review Electron settings. Details: https://radar.offseq.com/threat/cve-2026-33976-cwe-79-improper-neutralization-of-i-cedece5d #OffSeq #Cybersecurity #Infosec #Vulnerability

🔴 CVE-2026-33976 - Critical (9.6)

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper prese...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33976 - Critical (9.6)

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper prese...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨CRITICAL: CVE-2026-33976 in Notesnook Web/Desktop <3.3.11 — stored XSS in Web Clipper leads to RCE via Electron misconfig. Patch ASAP & review Electron security settings. More: https://radar.offseq.com/threat/cve-2026-33976-cwe-79-improper-neutralization-of-i-cedece5d #OffSeq #XSS #CyberSecurity #RCE

🟠 CVE-2026-33955 - High (8.6)

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33955/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33940 - High (8.1)

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in `resolvePartial()` and cause `invokePartial()` to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33939 - High (7.5)

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33661 - High (8.6)

Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33661/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33938 - High (8.1)

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the `@partial-block` special variable is stored in the template data context and is reachable and mutable from within a template via he...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33894 - High (7.5)

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can fo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33894/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33894 - High (7.5)

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can fo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33894/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL vuln in langflow-ai langflow < 1.9.0 (CVE-2026-33873): Agentic Assistant allows remote code injection via LLM-generated Python. Patch to 1.9.0+ or restrict feature access immediately. Details: https://radar.offseq.com/threat/cve-2026-33873-cwe-94-improper-control-of-generati-cafbe4ee #OffSeq #CVE202633873 #AIsecurity

⚠️ CRITICAL vuln in langflow-ai langflow < 1.9.0 (CVE-2026-33873): Agentic Assistant allows remote code injection via LLM-generated Python. Patch to 1.9.0+ or restrict feature access immediately. Details: https://radar.offseq.com/threat/cve-2026-33873-cwe-94-improper-control-of-generati-cafbe4ee #OffSeq #CVE202633873 #AIsecurity

🟠 CVE-2026-33744 - High (7.8)

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Docker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33744 - High (7.8)

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the `docker.system_packages` field in `bentofile.yaml` accepts arbitrary strings that are interpolated directly into Docker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33718 - High (7.6)

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33718 - High (7.6)

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33687 - High (8.8)

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33687/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33673 - High (7.6)

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33673 - High (7.6)

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30637 - High (7.5)

Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before. The vulnerability allows remote attackers to craft HTTP requests, without authentication, containing a URL pointing to i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30637/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30689 - High (7.5)

A blog.admin v.8.0 and before system's getinfobytoken API interface contains an improper access control which leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threaten...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30689/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30302 - Critical (10)

The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser (the Unix-b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30302/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4976 - High (8.8)

A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid results in buffer overflow. The attack can be launch...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4974 - High (8.8)

A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based bu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33757 - Critical (9.6)

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to star...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33757/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-33670 in SiYuan (<3.6.2) lets remote attackers exploit /api/file/readDir for path traversal, exposing sensitive files. Patch to 3.6.2+ ASAP! Details: https://radar.offseq.com/threat/cve-2026-33670-cwe-22-improper-limitation-of-a-pat-0880f67a #OffSeq #vuln #infosec #SiYuan

🔴 CVE-2026-33670 - Critical (9.8)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook. Version 3.6.2 patches the issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33670/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-33669: SiYuan (<3.6.2) has a CRITICAL out-of-bounds read flaw (CVSS 9.8). No auth/user interaction needed — remote attackers can leak sensitive memory. Upgrade to 3.6.2 ASAP! https://radar.offseq.com/threat/cve-2026-33669-cwe-125-out-of-bounds-read-in-siyua-064aace2 #OffSeq #Vulnerability #SiYuan #Cybersecurity

🔴 CVE-2026-33669 - Critical (9.8)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33669/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 New security advisory:

CVE-2026-33937 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-33937-handlebars-remote-code-execution

#Cybersecurity #SecurityPatching #HackerNews

⚠️ CRITICAL: handlebars.js v4.0.0 – 4.7.8 vulnerable (CVE-2026-33937). Type confusion in compile() lets attackers inject JS & gain RCE via crafted AST. Upgrade to 4.7.9+, validate inputs, use runtime-only build if possible. https://radar.offseq.com/threat/cve-2026-33937-cwe-843-access-of-resource-using-in-5708b559 #OffSeq #CVE202633937 #infosec

⚠️ CRITICAL: handlebars.js v4.0.0 – 4.7.8 vulnerable (CVE-2026-33937). Type confusion in compile() lets attackers inject JS & gain RCE via crafted AST. Upgrade to 4.7.9+, validate inputs, use runtime-only build if possible. https://radar.offseq.com/threat/cve-2026-33937-cwe-843-access-of-resource-using-in-5708b559 #OffSeq #CVE202633937 #infosec

🔴 CVE-2026-33937 - Critical (9.8)

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST nod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33937/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33895 - High (7.5)

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the grou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33895/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33895 - High (7.5)

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the grou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33895/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33891 - High (7.5)

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modIn...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29871 - High (7.5)

A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19) in the Beifong AI News and Podcast Agent backend in FastAPI backend, stream-audio endpoint, in file routers/podca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29871/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29871 - High (7.5)

A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19) in the Beifong AI News and Podcast Agent backend in FastAPI backend, stream-audio endpoint, in file routers/podca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29871/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33413 - High (8.8)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, unauthorized users may bypass authentication or authorization checks and call certain etcd functions in clusters that expose t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33413/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

March 28, 2026

Cyber Operations

European Commission confirms breach of cloud infrastructure. The European Commission disclosed on March 27 that attackers compromised its AWS account hosting the Europa.eu web platform, potentially exfiltrating over 350 GB of data including databases. The Commission stated its internal systems were not affected and that it detected and contained the intrusion on March 24. An investigation is underway to determine the full scope of the breach and affected Union entities are being notified.

FDD analysis warns Iranian cyber operations exploit weakened U.S. defenses. A March 27 report from the Foundation for Defense of Democracies highlights that CISA is operating at roughly 60 percent furlough even as Iranian threat actors escalate attacks on U.S. critical infrastructure. The analysis cites two healthcare-sector incidents in two weeks: a late-February ransomware attack on an unnamed U.S. healthcare provider and the March 11 Handala wiper attack on medical device firm Stryker, which disrupted emergency medical services and hospitals in Maryland.

CISA adds critical F5 BIG-IP vulnerability to exploited catalog. CISA flagged a critical flaw in F5 BIG-IP Access Policy Manager (CVE-2025-53521, CVSS 9.3) as actively exploited, reclassifying it from denial-of-service to remote code execution after new intelligence obtained in March 2026. Separately, a critical Citrix NetScaler vulnerability (CVE-2026-3055, CVSS 9.3) is seeing active reconnaissance activity in the wild.

Handala reconstitutes after FBI domain seizure. On March 20, the DOJ and FBI seized four domains tied to Iran-linked Handala Hack Team, which had been used for psychological operations, extortion messaging, and doxxing. Within approximately one day, Handala restored its online presence and resumed publishing. The group remains one of several Iranian state-aligned collectives operating under the Electronic Operations Room established on February 28, 2026.

Information Operations & Foreign Influence

DNI Gabbard's 2026 Annual Threat Assessment omits foreign election interference. The ODNI released its 2026 Annual Threat Assessment on March 18. Notably, the report omits a section on foreign election interference that had been a consistent feature in prior years. The assessment identifies China, Russia, Iran, and North Korea as persistent cyber and intelligence threats to U.S. government and private-sector networks, and flags AI and quantum computing as critical emerging technology challenges.

Kremlin-aligned Matryoshka network targeted 2026 Winter Olympics. A Russian-linked influence network seeded at least 28 fabricated reports during the 2026 Winter Olympics, impersonating outlets such as CBC and Reuters. AI-enhanced clips falsely portrayed Ukrainian athletes as criminals and cheaters, continuing Moscow's pattern of weaponizing sporting events for narrative advantage.

Iran deploys AI-generated imagery in wartime messaging. Iranian state-affiliated channels have circulated AI-generated imagery to amplify wartime narratives, including a fabricated image of a bloody children's backpack posted by the Iranian embassy in Austria, falsely linked to a strike on a girls' school in Minab.

Espionage

UK espionage trial underway at Old Bailey. Chung Biu "Bill" Yuen and Chi Leung "Peter" Wai are currently on trial in London under the National Security Act 2023, charged with assisting a foreign intelligence service and foreign interference. The trial commenced in early March and is expected to conclude in April.

Three men arrested in UK on suspicion of spying for China. London Metropolitan Police counter-terrorism officers arrested three men on March 4 under the National Security Act 2023. Among those detained was David Taylor, 39, husband of Labour MP Joani Reid and director at Asia House, a London-based think tank. The arrests followed an MI5 espionage alert issued to UK parliamentarians in November warning that Chinese intelligence services were actively recruiting individuals with access to government.

U.S. charges individuals in AI technology diversion and North Korean sanctions evasion. In March 2026, the DOJ charged three individuals with conspiring to unlawfully divert U.S. artificial intelligence technology to China, and separately sentenced three others for facilitating computer access in a North Korean sanctions evasion scheme. The 2026 threat assessment noted that North Korea stole approximately $2 billion via a cryptocurrency heist in 2025 to fund weapons programs.

Confused by the recent F5 BIG-IP vulnerability alerts? 🚨 We broke down exactly what this legacy appliance is, why its centralized architecture is a massive single point of failure, and how to replace it with sovereign, zero-trust hardware. Read the plain breakdown.
#Ransier_Sentinel

https://thecybermind.co/2026/03/29/threat-intelligence-cve-2025-53521/?utm_source=mastodon&utm_medium=jetpack_social

F5 Warns of Critical BIG-IP APM Zero-Day Exploited by Nation-State Actors

F5 re-categorized a BIG-IP APM vulnerability (CVE-2025-53521) from a DoS to a critical 9.8 RCE after discovering active exploitation by a nation-state actor using memory-only webshells and lateral movement tools. The flaw allows unauthenticated attackers to execute code and gain full control over network access infrastructure.

**If you have F5 BIG-IP APM devices, if possible make sure they are isolated from the internet and accessible from trusted networks only. Then immediately update to the fixed firmware versions (17.5.1.3, 17.1.3, 16.1.6.1, or 15.1.10.8). If you suspect a device has already been compromised, rebuild it from scratch - don't restore from backups, as they may contain persistent malware. Also, audit for disabled SELinux and unauthorized webshells.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/f5-warns-of-critical-big-ip-apm-zero-day-exploited-by-nation-state-actors-4-j-u-k-9/gD2P6Ple2L

Critical F5 Vulnerability Sparks Alarm as Active Exploitation Forces Urgent Global Patching

Introduction: A New Cybersecurity Emergency Unfolds A newly disclosed cybersecurity threat has quickly escalated into a global concern after authorities confirmed active exploitation in the wild. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a high-severity vulnerability—CVE-2025-53521—affecting F5 BIG-IP Access Policy Manager (APM)…

https://undercodenews.com/critical-f5-vulnerability-sparks-alarm-as-active-exploitation-forces-urgent-global-patching/

🚨 [CISA-2026:0327] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0327)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-53521 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-53521)
- Name: F5 BIG-IP Unspecified Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: F5
- Product: BIG-IP
- Notes: Please adhere to F5’s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible F5 products affected by this vulnerability. For more information please see: https://my.f5.com/manage/s/article/K000156741 ; https://my.f5.com/manage/s/article/K000160486 ; https://my.f5.com/manage/s/article/K11438344 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53521

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260327 #cisa20260327 #cve_2025_53521 #cve202553521

March 28, 2026

Cyber Operations

European Commission confirms breach of cloud infrastructure. The European Commission disclosed on March 27 that attackers compromised its AWS account hosting the Europa.eu web platform, potentially exfiltrating over 350 GB of data including databases. The Commission stated its internal systems were not affected and that it detected and contained the intrusion on March 24. An investigation is underway to determine the full scope of the breach and affected Union entities are being notified.

FDD analysis warns Iranian cyber operations exploit weakened U.S. defenses. A March 27 report from the Foundation for Defense of Democracies highlights that CISA is operating at roughly 60 percent furlough even as Iranian threat actors escalate attacks on U.S. critical infrastructure. The analysis cites two healthcare-sector incidents in two weeks: a late-February ransomware attack on an unnamed U.S. healthcare provider and the March 11 Handala wiper attack on medical device firm Stryker, which disrupted emergency medical services and hospitals in Maryland.

CISA adds critical F5 BIG-IP vulnerability to exploited catalog. CISA flagged a critical flaw in F5 BIG-IP Access Policy Manager (CVE-2025-53521, CVSS 9.3) as actively exploited, reclassifying it from denial-of-service to remote code execution after new intelligence obtained in March 2026. Separately, a critical Citrix NetScaler vulnerability (CVE-2026-3055, CVSS 9.3) is seeing active reconnaissance activity in the wild.

Handala reconstitutes after FBI domain seizure. On March 20, the DOJ and FBI seized four domains tied to Iran-linked Handala Hack Team, which had been used for psychological operations, extortion messaging, and doxxing. Within approximately one day, Handala restored its online presence and resumed publishing. The group remains one of several Iranian state-aligned collectives operating under the Electronic Operations Room established on February 28, 2026.

Information Operations & Foreign Influence

DNI Gabbard's 2026 Annual Threat Assessment omits foreign election interference. The ODNI released its 2026 Annual Threat Assessment on March 18. Notably, the report omits a section on foreign election interference that had been a consistent feature in prior years. The assessment identifies China, Russia, Iran, and North Korea as persistent cyber and intelligence threats to U.S. government and private-sector networks, and flags AI and quantum computing as critical emerging technology challenges.

Kremlin-aligned Matryoshka network targeted 2026 Winter Olympics. A Russian-linked influence network seeded at least 28 fabricated reports during the 2026 Winter Olympics, impersonating outlets such as CBC and Reuters. AI-enhanced clips falsely portrayed Ukrainian athletes as criminals and cheaters, continuing Moscow's pattern of weaponizing sporting events for narrative advantage.

Iran deploys AI-generated imagery in wartime messaging. Iranian state-affiliated channels have circulated AI-generated imagery to amplify wartime narratives, including a fabricated image of a bloody children's backpack posted by the Iranian embassy in Austria, falsely linked to a strike on a girls' school in Minab.

Espionage

UK espionage trial underway at Old Bailey. Chung Biu "Bill" Yuen and Chi Leung "Peter" Wai are currently on trial in London under the National Security Act 2023, charged with assisting a foreign intelligence service and foreign interference. The trial commenced in early March and is expected to conclude in April.

Three men arrested in UK on suspicion of spying for China. London Metropolitan Police counter-terrorism officers arrested three men on March 4 under the National Security Act 2023. Among those detained was David Taylor, 39, husband of Labour MP Joani Reid and director at Asia House, a London-based think tank. The arrests followed an MI5 espionage alert issued to UK parliamentarians in November warning that Chinese intelligence services were actively recruiting individuals with access to government.

U.S. charges individuals in AI technology diversion and North Korean sanctions evasion. In March 2026, the DOJ charged three individuals with conspiring to unlawfully divert U.S. artificial intelligence technology to China, and separately sentenced three others for facilitating computer access in a North Korean sanctions evasion scheme. The 2026 threat assessment noted that North Korea stole approximately $2 billion via a cryptocurrency heist in 2025 to fund weapons programs.

Confused by the recent F5 BIG-IP vulnerability alerts? 🚨 We broke down exactly what this legacy appliance is, why its centralized architecture is a massive single point of failure, and how to replace it with sovereign, zero-trust hardware. Read the plain breakdown.
#Ransier_Sentinel

https://thecybermind.co/2026/03/29/threat-intelligence-cve-2025-53521/?utm_source=mastodon&utm_medium=jetpack_social

F5 Warns of Critical BIG-IP APM Zero-Day Exploited by Nation-State Actors

F5 re-categorized a BIG-IP APM vulnerability (CVE-2025-53521) from a DoS to a critical 9.8 RCE after discovering active exploitation by a nation-state actor using memory-only webshells and lateral movement tools. The flaw allows unauthenticated attackers to execute code and gain full control over network access infrastructure.

**If you have F5 BIG-IP APM devices, if possible make sure they are isolated from the internet and accessible from trusted networks only. Then immediately update to the fixed firmware versions (17.5.1.3, 17.1.3, 16.1.6.1, or 15.1.10.8). If you suspect a device has already been compromised, rebuild it from scratch - don't restore from backups, as they may contain persistent malware. Also, audit for disabled SELinux and unauthorized webshells.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/f5-warns-of-critical-big-ip-apm-zero-day-exploited-by-nation-state-actors-4-j-u-k-9/gD2P6Ple2L

🚨 [CISA-2026:0327] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0327)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-53521 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-53521)
- Name: F5 BIG-IP Unspecified Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: F5
- Product: BIG-IP
- Notes: Please adhere to F5’s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible F5 products affected by this vulnerability. For more information please see: https://my.f5.com/manage/s/article/K000156741 ; https://my.f5.com/manage/s/article/K000160486 ; https://my.f5.com/manage/s/article/K11438344 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53521

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260327 #cisa20260327 #cve_2025_53521 #cve202553521

For F5 BIG-IP APM customers, CVE-2025-53521 is being exploited in the wild by a nation state threat actor

It allows unauth RCE and applies to the data plane (not the management interface) - the one available over the internet.

https://my.f5.com/manage/s/article/K000156741

Attackers have been deploying webshells, so boxes are still vuln post patching if already exploited prior.

CVE ID: CVE-2025-53521
Vendor: F5
Product: BIG-IP
Date Added: 2026-03-27
Notes: Please adhere to F5’s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible F5 products affected by this vulnerability. For more information please see: https://my.f5.com/manage/s/article/K000156741 ; https://my.f5.com/manage/s/article/K000160486 ; https://my.f5.com/manage/s/article/K11438344 ; https://nvd.nist.gov/vuln/detail/CVE-2025-53521
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-53521

🟠 CVE-2026-4975 - High (8.8)

A vulnerability has been found in Tenda AC15 15.03.05.19. This affects the function formSetCfm of the file /goform/setcfm of the component POST Request Handler. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4975/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-34205 (CRITICAL): Home Assistant OS ≤17.1 apps in host network mode expose unauthenticated endpoints to local networks. Upgrade to Supervisor 2026.03.02, segment networks, and review configs now! https://radar.offseq.com/threat/cve-2026-34205-cwe-923-improper-restriction-of-com-dfad0bbb #OffSeq #HomeAssistant #IoTSecurity

🚨 CVE-2026-34205 (CRITICAL): Home Assistant OS ≤17.1 apps in host network mode expose unauthenticated endpoints to local networks. Upgrade to Supervisor 2026.03.02, segment networks, and review configs now! https://radar.offseq.com/threat/cve-2026-34205-cwe-923-improper-restriction-of-com-dfad0bbb #OffSeq #HomeAssistant #IoTSecurity

🔴 CVE-2026-34205 - Critical (9.6)

Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interfa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34205/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33870 - High (7.5)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33870/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33870 - High (7.5)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33870/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32241 - High (7.5)

Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension bac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32241/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32241 - High (7.5)

Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension bac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32241/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30463 - High (7.7)

Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30463/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30463 - High (7.7)

Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30463/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30304 - Critical (9.6)

In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute all commands. The description for the former states that commands determined by the model to be safe will be automatically execut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30304/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 New security advisory:

CVE-2026-30303 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-30303-axon-code-os-command-injection

#Cybersecurity #SecurityPatching #HackerNews

🔴 CVE-2026-30303 - Critical (9.8)

The command auto-approval module in Axon Code contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser (the Unix-based ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30303/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30303 - Critical (9.8)

The command auto-approval module in Axon Code contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser (the Unix-based ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30303/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

n8n Patches Critical Remote Code Execution and Credential Theft Vulnerabilities

n8n patched multiple vulnerabilities, including two critical RCE flaws (CVE-2026-33660 and CVE-2026-33696) and a credential theft issue that allow authenticated users to take over host systems or steal plaintext secrets.

**If you use n8n, update immediately to version 1.123.27, 2.13.3, or 2.14.1. These patches fix critical flaws that let anyone with workflow permissions take over your server and steal all stored credentials. If you can't update right away, restrict workflow creation permissions to only fully trusted users and disable the Merge and XML nodes via the NODES_EXCLUDE environment variable until you can patch.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/n8n-patches-critical-remote-code-execution-and-credential-theft-vulnerabilities-7-b-1-2-9/gD2P6Ple2L

🚨 CRITICAL: CVE-2026-34374 in WWBN AVideo ≤26.0 allows unauthenticated SQL injection via stream key lookup during RTMP authentication. No patch out yet. Restrict access, use WAFs, & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-34374-cwe-89-improper-neutralization-of-s-171f2208 #OffSeq #SQLInjection #WWBN #VideoSecurity

🚨 CRITICAL: CVE-2026-34374 in WWBN AVideo ≤26.0 allows unauthenticated SQL injection via stream key lookup during RTMP authentication. No patch out yet. Restrict access, use WAFs, & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-34374-cwe-89-improper-neutralization-of-s-171f2208 #OffSeq #SQLInjection #WWBN #VideoSecurity

🔴 CVE-2026-34374 - Critical (9.1)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` method constructs a SQL query by interpolating a stream key directly into the query string without parameterization. This method i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34374/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33989 - High (8.1)

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33989 - High (8.1)

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33980 - High (8.3)

Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 con...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1961 - High (8)

A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource provid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28368 - High (8.7)

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28368/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28367 - High (8.7)

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28367/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-15381 - High (8.1)

In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15381/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

- Syncthing got a 2.0 release and switched from LevelDB to SQLite https://github.com/syncthing/syncthing/releases
- macOS did that weird (a) Upgrade https://support.apple.com/de-de/126604 and is now at 2.6.4 with 8 (eight!) new emojis https://support.apple.com/en-us/122868
- Grafana security fix 12.4.1 -> 12.4.2 https://grafana.com/blog/grafana-security-release-critical-and-high-severity-security-fixes-for-cve-2026-27876-and-cve-2026-27880/
- TandoorRecipes got shared shopping lists and pantry inventory with 2.6.0 and an security update to 2.6.1 https://github.com/TandoorRecipes/recipes/releases
- Grist, qbittorrent and smokeping got updates for their containers. I haven't figured out what changed. https://hub.docker.com/r/gristlabs/grist https://github.com/linuxserver/docker-qbittorrent/releases https://github.com/linuxserver/docker-smokeping/releases
- Redis 8.6.2 with some bugfixes https://github.com/redis/redis/releases
- Home Assistant 2026.3.3 -> 2026.3.4. Nothing interesting. https://github.com/home-assistant/core/releases
- oh-my-zsh with tiny changes https://github.com/ohmyzsh/ohmyzsh/commits/master/
- Next section is done by homebrew. I don't even know what half of the stuff is used for. Don't judge for having fish and zsh.
ffmpeg 8.0.1_4 -> 8.1
pandoc 3.9 -> 3.9.0.2
nghttp2 1.68.0_1 -> 1.68.1
simdjson 4.4.0 -> 4.4.2
freetype 2.14.2 -> 2.14.3
cryptography 46.0.5 -> 46.0.6
ipython 9.11.0 -> 9.12.0
libavif 1.4.0 -> 1.4.1
harfbuzz 13.1.1 -> 13.2.1
glib 2.86.4 -> 2.88.0
aom 3.13.1 -> 3.13.2
svt-av1 4.0.1 -> 4.1.0
libnghttp2 1.68.0 -> 1.68.1
openexr 3.4.6 -> 3.4.8
ca-certificates 2025-12-02 -> 2026-03-19
esphome 2026.2.4 -> 2026.3.1
jupyterlab 4.5.6 -> 4.5.6_1
ada-url 3.4.3 -> 3.4.4
node 25.8.1_1 -> 25.8.2
fish 4.5.0 -> 4.6.0
icu4c@78 78.2 -> 78.3
jpeg-turbo 3.1.3 -> 3.1.4
- tailscale 1.96.2 now with easy file transfers "taildrop" https://tailscale.com/changelog
- Xcode 26.4 https://developer.apple.com/documentation/xcode-release-notes/xcode-26_4-release-notes

I haven't touched my desktop yet and probably won't.

Edit 1
I missed the Nextcloud update because I use that weird Nextcloud All-In-One container. nextcloud.com/changelog/

Edit 2
How did I miss the Mastodon upgrade from 4.5.7 to 4.5.8. I may be gone for a moment. https://github.com/mastodon/mastodon/releases

Edit 3
Why do I run a server in the garage?
evcc 0.209.6 -> 0.303.2 https://github.com/evcc-io/evcc/releases

🔴 CVE-2026-27876 - Critical (9.1)

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack ve...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27876/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

- Syncthing got a 2.0 release and switched from LevelDB to SQLite https://github.com/syncthing/syncthing/releases
- macOS did that weird (a) Upgrade https://support.apple.com/de-de/126604 and is now at 2.6.4 with 8 (eight!) new emojis https://support.apple.com/en-us/122868
- Grafana security fix 12.4.1 -> 12.4.2 https://grafana.com/blog/grafana-security-release-critical-and-high-severity-security-fixes-for-cve-2026-27876-and-cve-2026-27880/
- TandoorRecipes got shared shopping lists and pantry inventory with 2.6.0 and an security update to 2.6.1 https://github.com/TandoorRecipes/recipes/releases
- Grist, qbittorrent and smokeping got updates for their containers. I haven't figured out what changed. https://hub.docker.com/r/gristlabs/grist https://github.com/linuxserver/docker-qbittorrent/releases https://github.com/linuxserver/docker-smokeping/releases
- Redis 8.6.2 with some bugfixes https://github.com/redis/redis/releases
- Home Assistant 2026.3.3 -> 2026.3.4. Nothing interesting. https://github.com/home-assistant/core/releases
- oh-my-zsh with tiny changes https://github.com/ohmyzsh/ohmyzsh/commits/master/
- Next section is done by homebrew. I don't even know what half of the stuff is used for. Don't judge for having fish and zsh.
ffmpeg 8.0.1_4 -> 8.1
pandoc 3.9 -> 3.9.0.2
nghttp2 1.68.0_1 -> 1.68.1
simdjson 4.4.0 -> 4.4.2
freetype 2.14.2 -> 2.14.3
cryptography 46.0.5 -> 46.0.6
ipython 9.11.0 -> 9.12.0
libavif 1.4.0 -> 1.4.1
harfbuzz 13.1.1 -> 13.2.1
glib 2.86.4 -> 2.88.0
aom 3.13.1 -> 3.13.2
svt-av1 4.0.1 -> 4.1.0
libnghttp2 1.68.0 -> 1.68.1
openexr 3.4.6 -> 3.4.8
ca-certificates 2025-12-02 -> 2026-03-19
esphome 2026.2.4 -> 2026.3.1
jupyterlab 4.5.6 -> 4.5.6_1
ada-url 3.4.3 -> 3.4.4
node 25.8.1_1 -> 25.8.2
fish 4.5.0 -> 4.6.0
icu4c@78 78.2 -> 78.3
jpeg-turbo 3.1.3 -> 3.1.4
- tailscale 1.96.2 now with easy file transfers "taildrop" https://tailscale.com/changelog
- Xcode 26.4 https://developer.apple.com/documentation/xcode-release-notes/xcode-26_4-release-notes

I haven't touched my desktop yet and probably won't.

Edit 1
I missed the Nextcloud update because I use that weird Nextcloud All-In-One container. nextcloud.com/changelog/

Edit 2
How did I miss the Mastodon upgrade from 4.5.7 to 4.5.8. I may be gone for a moment. https://github.com/mastodon/mastodon/releases

Edit 3
Why do I run a server in the garage?
evcc 0.209.6 -> 0.303.2 https://github.com/evcc-io/evcc/releases

🔴 CVE-2026-27876 - Critical (9.1)

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack ve...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27876/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33941 - High (8.2)

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, the Handlebars CLI precompiler (`bin/handlebars` / `lib/precompiler.js`) concatenates user-controlled strings — template file names a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33979 - High (8.2)

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33979/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33979 - High (8.2)

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33979/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33945 - Critical (9.9)

Incus is a system container and virtual machine manager. Incus instances have an option to provide credentials to systemd in the guest. For containers, this is handled through a shared directory. Prior to version 6.23.0, an attacker can set a conf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33945/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack