FediSecfeeds

CVE	CVSS	EPSS	Posts	Repos	Updated	Description
CVE-2026-87112	8.8	0.00%	2	0	2026-11-07T07:17:05.243000	The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Obj
CVE-2026-19128	7.5	0.00%	2	0	2026-11-07T06:31:24	IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker
CVE-2026-18836	9.3	0.00%	2	0	2026-11-07T06:31:23	IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could a
CVE-2026-19803	9.8	0.00%	2	0	2026-11-07T06:31:19	The Printcart Store – Web to Print Product Designer for WooCommerce plugin for W
CVE-2026-19868	7.5	0.00%	3	0	2026-11-07T05:19:01.300000	An authentication enforcement vulnerability in SonicOS SSLVPN service may allow
CVE-2026-19121	8.3	0.00%	2	0	2026-11-07T05:19:00.093000	IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker
CVE-2026-18838	9.4	0.00%	4	0	2026-11-07T05:18:59.920000	IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtai
CVE-2026-18535	9.6	0.00%	4	0	2026-11-07T05:18:59.300000	IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vul
CVE-2026-17409	9.4	0.00%	2	0	2026-11-07T05:18:58.353000	IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could a
CVE-2026-17362	9.8	0.00%	3	0	2026-11-07T05:18:48.580000	IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to creat
CVE-2026-123218	9.8	0.00%	4	0	2026-11-07T04:17:29.027000	IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a
CVE-2024-27834	5.5	1.50%	1	0	2026-11-05T12:56:20.313000	The issue was addressed with improved checks. This issue is fixed in Safari 17.5
CVE-2026-93742	9.9	2.27%	1	0	2026-09-21T19:17:17.273000	A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected b
CVE-2026-84750	6.5	0.45%	1	0	2026-09-21T13:34:57.127000	The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not vali
CVE-2026-2278	4.3	0.34%	1	1	2026-09-21T13:33:33.387000	The VW Writer Blog theme for WordPress is vulnerable to unauthorized modificatio
CVE-2026-87917	6.1	0.38%	1	0	2026-09-21T13:33:33.387000	The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflect
CVE-2026-86814	8.1	0.38%	1	0	2026-09-19T15:32:25	The UsersWP WordPress plugin before 1.5.10 does not verify that a social login
CVE-2026-1984	5.3	0.39%	1	1	2026-09-19T09:32:13	The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unau
CVE-2019-6988	6.5	1.72%	2	0	2026-06-17T02:39:52.953000	An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a
CVE-2016-4622	8.8	20.37%	1	2	2026-06-17T00:47:54.770000	WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 all
CVE-2026-121720	0	0.00%	2	1		N/A
CVE-2026-115342	0	0.00%	2	0		N/A
CVE-2026-65960	0	0.00%	2	0		N/A
CVE-2026-102657	0	0.00%	2	0		N/A
CVE-2026-102344	0	0.00%	2	0		N/A

CVE-2026-87112
(8.8 HIGH)

EPSS: 0.00%

updated 2026-11-07T07:17:05.243000

2 posts

The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_static() calling unserialize() without an allowed_classes restriction, combined with serialize_escape() failing to sanitize path traversal sequences in the raw_

thehackerwire@mastodon.social at 2026-11-07T08:17:13.000Z ##

🟠 CVE-2026-87112 - High (8.8)

The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_stati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87112/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-11-07T08:17:13.000Z ##

🟠 CVE-2026-87112 - High (8.8)

The QA Assistants – Driven by data plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.3.0 via the 'dlevent_ver' parameter. This is due to unrestricted PHP deserialization via wrap_unserialize_stati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87112/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-19128
(7.5 HIGH)

EPSS: 0.00%

updated 2026-11-07T06:31:24

2 posts

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.

thehackerwire@mastodon.social at 2026-11-07T05:20:17.000Z ##

🟠 CVE-2026-19128 - High (7.5)

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-11-07T05:20:17.000Z ##

🟠 CVE-2026-19128 - High (7.5)

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-18836
(9.3 CRITICAL)

EPSS: 0.00%

updated 2026-11-07T06:31:23

2 posts

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker.

thehackerwire@mastodon.social at 2026-11-07T05:20:37.000Z ##

🔴 CVE-2026-18836 - Critical (9.3)

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinatio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-11-07T05:20:37.000Z ##

🔴 CVE-2026-18836 - Critical (9.3)

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinatio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-19803
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-11-07T06:31:19

2 posts

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-supplied `url` parameter that `Nbdesigner_IO::convert_url_to_path()` concatenates onto the uploads base directory without normalizing or stripping `../` sequenc

thehackerwire@mastodon.social at 2026-11-07T05:18:15.000Z ##

🔴 CVE-2026-19803 - Critical (9.8)

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-suppl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19803/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-11-07T05:18:15.000Z ##

🔴 CVE-2026-19803 - Critical (9.8)

The Printcart Store – Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.13.2. This is due to the `nbu_crop_image` AJAX handler accepting a user-suppl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19803/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-19868
(7.5 HIGH)

EPSS: 0.00%

updated 2026-11-07T05:19:01.300000

3 posts

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

allaboutsecurity@mastodon.social at 2026-11-07T08:27:16.000Z ##

SonicWall SonicOS: Angreifer umgehen MFA im SSLVPN

In SonicWall SonicOS wird derzeit eine Schwachstelle im SSLVPN-Dienst ausgenutzt, mit der sich die Mehrfaktor-Authentifizierung umgehen lässt. Die Lücke CVE-2026-19868 ist Teil eines Sicherheitshinweises zu insgesamt sieben Schwachstellen. Workarounds gibt es nicht, Administratoren von Gen7- und Gen8-Firewalls sollten daher aktualisieren.

https://www.all-about-security.de/sonicwall-sonicos-angreifer-umgehen-mfa-im-sslvpn/

#ssl #sslvpn #sicherheitsupdates #sicherheitslucken #patch #security

##

security_crawler_carl at 2026-11-07T03:37:42.659Z ##

🏆 New Achievement! Skip the MFA, Skip the Fun!

Allow me to explain what has transpired, in the voice of someone who finds your authentication stack simply adorable. SonicWall's SonicOS SSLVPN is presently suffering CVE-2026-19868, a SAML authentication bypass that doubles as an MFA bypass — meaning that multi-factor defense you were so proud of is currently decorative. (1/3)

##

security_crawler_carl@infosec.exchange at 2026-11-07T03:37:42.000Z ##

🏆 New Achievement! Skip the MFA, Skip the Fun!

Allow me to explain what has transpired, in the voice of someone who finds your authentication stack simply adorable. SonicWall's SonicOS SSLVPN is presently suffering CVE-2026-19868, a SAML authentication bypass that doubles as an MFA bypass — meaning that multi-factor defense you were so proud of is currently decorative. (1/3)

##

CVE-2026-19121
(8.3 HIGH)

EPSS: 0.00%

updated 2026-11-07T05:19:00.093000

2 posts

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to another tenant's resources.

thehackerwire@mastodon.social at 2026-11-07T08:18:25.000Z ##

🟠 CVE-2026-19121 - High (8.3)

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to anot...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19121/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-11-07T08:18:25.000Z ##

🟠 CVE-2026-19121 - High (8.3)

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated attacker to gain unauthorized access due to improper authorization. Tenant context is not sufficiently verified against the authenticated user, which could allow access to anot...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19121/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-18838
(9.4 CRITICAL)

EPSS: 0.00%

updated 2026-11-07T05:18:59.920000

4 posts

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which could allow a caller to impersonate another user.

thehackerwire@mastodon.social at 2026-11-07T08:18:16.000Z ##

🔴 CVE-2026-18838 - Critical (9.4)

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which cou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq at 2026-11-07T07:30:36.503Z ##

IBM API Connect (12.1.0.0 – 12.1.1.2) faces a CRITICAL CWE-290 auth bypass (CVE-2026-18838, CVSS 9.4). Remote attackers can impersonate users & alter configs. Restrict access, monitor logs, and check IBM advisories for fixes. https://radar.offseq.com/threat/cve-2026-18838-cwe-290-authentication-bypass-by-spoofing-in-ibm-api-connect-abea562ffc91e896 #OffSeq #InfoSec #API

##

thehackerwire@mastodon.social at 2026-11-07T08:18:16.000Z ##

🔴 CVE-2026-18838 - Critical (9.4)

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and modify API configurations due to improper authentication. Identity information supplied in requests is not sufficiently verified, which cou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-11-07T07:30:36.000Z ##

IBM API Connect (12.1.0.0 – 12.1.1.2) faces a CRITICAL CWE-290 auth bypass (CVE-2026-18838, CVSS 9.4). Remote attackers can impersonate users & alter configs. Restrict access, monitor logs, and check IBM advisories for fixes. https://radar.offseq.com/threat/cve-2026-18838-cwe-290-authentication-bypass-by-spoofing-in-ibm-api-connect-abea562ffc91e896 #OffSeq #InfoSec #API

##

CVE-2026-18535
(9.6 CRITICAL)

EPSS: 0.00%

updated 2026-11-07T05:18:59.300000

4 posts

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.

offseq at 2026-11-07T06:00:33.125Z ##

IBM API Connect has a CRITICAL ReDoS flaw (CVE-2026-18535, CVSS 9.6) affecting 10.0.8.0 – 10.0.8.12 & 12.1.0.0 – 12.1.1.2. Exploitation leads to DoS via regex complexity. Restrict access & monitor for abuse. Patch status unconfirmed. https://radar.offseq.com/threat/cve-2026-18535-cwe-1333-inefficient-regular-expression-complexity-in-ibm-api-connect-bd685576100468ea #OffSeq #IBM #CVE202618535 #infosec

##

thehackerwire@mastodon.social at 2026-11-07T05:20:27.000Z ##

🔴 CVE-2026-18535 - Critical (9.6)

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18535/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-11-07T06:00:33.000Z ##

IBM API Connect has a CRITICAL ReDoS flaw (CVE-2026-18535, CVSS 9.6) affecting 10.0.8.0 – 10.0.8.12 & 12.1.0.0 – 12.1.1.2. Exploitation leads to DoS via regex complexity. Restrict access & monitor for abuse. Patch status unconfirmed. https://radar.offseq.com/threat/cve-2026-18535-cwe-1333-inefficient-regular-expression-complexity-in-ibm-api-connect-bd685576100468ea #OffSeq #IBM #CVE202618535 #infosec

##

thehackerwire@mastodon.social at 2026-11-07T05:20:27.000Z ##

🔴 CVE-2026-18535 - Critical (9.6)

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack and to improper neutralisation of wildcard query operators.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18535/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-17409
(9.4 CRITICAL)

EPSS: 0.00%

updated 2026-11-07T05:18:58.353000

2 posts

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls are not applied consistently to all variations of a request, which could allow restricted operations to be reached.

thehackerwire@mastodon.social at 2026-11-07T08:18:35.000Z ##

🔴 CVE-2026-17409 - Critical (9.4)

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17409/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-11-07T08:18:35.000Z ##

🔴 CVE-2026-17409 - Critical (9.4)

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute unauthorized administrative operations and obtain sensitive information due to improper handling of case sensitivity. Access controls...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17409/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-17362
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-11-07T05:18:48.580000

3 posts

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.

killbait@mastodon.social at 2026-11-07T06:28:39.000Z ##

IBM API Connect Vulnerability Allows Remote Tenant Management Without Authorization

📰 Original title: CVE-2026-17362

🤖 IA: It's not clickbait ✅
👥 Users: It's not clickbait ✅

👇👇👇 https://en.killbait.com/ibm-api-connect-vulnerability-allows-remote-tenant-management-without-authorization.html?utm_source=mastodon_social&utm_medium=social&utm_campaign=killbait.mastodon_social

#cybersecurity #vulnerability #ibmapiconnect #authorization

##

thehackerwire@mastodon.social at 2026-11-07T05:18:02.000Z ##

🔴 CVE-2026-17362 - Critical (9.8)

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-11-07T05:18:02.000Z ##

🔴 CVE-2026-17362 - Critical (9.8)

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-123218
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-11-07T04:17:29.027000

4 posts

IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

thehackerwire@mastodon.social at 2026-11-07T05:18:34.000Z ##

🔴 CVE-2026-123218 - Critical (9.8)

IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-123218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq at 2026-11-07T04:30:33.714Z ##

IBM Aspera Faspex (5.0.0 – 5.0.19) hit by CRITICAL CVE-2026-123218 (CVSS 9.8) – incorrect authorization lets users escalate to admin rights. Restrict access & monitor for abuse. No patch confirmed yet. https://radar.offseq.com/threat/cve-2026-123218-cwe-863-incorrect-authorization-in-ibm-aspera-faspex-91aff355928be3da #OffSeq #Vulnerability #IBM #PrivilegeEscalation

##

thehackerwire@mastodon.social at 2026-11-07T05:18:34.000Z ##

🔴 CVE-2026-123218 - Critical (9.8)

IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-123218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-11-07T04:30:33.000Z ##

IBM Aspera Faspex (5.0.0 – 5.0.19) hit by CRITICAL CVE-2026-123218 (CVSS 9.8) – incorrect authorization lets users escalate to admin rights. Restrict access & monitor for abuse. No patch confirmed yet. https://radar.offseq.com/threat/cve-2026-123218-cwe-863-incorrect-authorization-in-ibm-aspera-faspex-91aff355928be3da #OffSeq #Vulnerability #IBM #PrivilegeEscalation

##

CVE-2024-27834
(5.5 MEDIUM)

EPSS: 1.50%

updated 2026-11-05T12:56:20.313000

1 posts

The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, watchOS 10.5. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.

ninjaintelgroup@mastodon.social at 2026-11-07T08:00:02.000Z ##

New in the known-exploited catalogue: CVE-2024-27834 in safari. Exploited in the wild — the only phrase in this field that still means exactly what it says.

Patch the edge appliance. It is always the edge appliance.

#KEV #vulnerability

##

CVE-2026-93742
(9.9 CRITICAL)

EPSS: 2.27%

updated 2026-09-21T19:17:17.273000

1 posts

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

hugovalters@mastodon.social at 2026-11-07T08:40:01.000Z ##

CVE-2026-93742: command injection in Totolink A3002MU (formWsc, localPin arg), CVSS 9.9, remote and public exploit, no patch info. Update firmware or block the device from the internet now: #CVE #infosec #Totolink https://www.valtersit.com/cve/CVE-2026-93742/

##

CVE-2026-84750
(6.5 MEDIUM)

EPSS: 0.45%

updated 2026-09-21T13:34:57.127000

1 posts

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary files. The PHP handler shipped by default with the Debian and Ubuntu Apache packages maps .phar to PHP a

hugovalters@mastodon.social at 2026-11-07T05:30:19.000Z ##

CVE-2026-84750: unauthenticated file upload in Ultra Addons for Contact Form 7 (before 3.5.51) can become RCE on Debian/Ubuntu Apache via .phar handling. CVSS 6.5, no patch confirmed. Update immediately. #CVE #infosec #WordPress https://www.valtersit.com/cve/CVE-2026-84750/

##

CVE-2026-2278
(4.3 MEDIUM)

EPSS: 0.34%

updated 2026-09-21T13:33:33.387000

1 posts

The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_settings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all theme customizer settings to their defaults.

1 repos

https://github.com/langbyyi/CVE-2026-22785

hugovalters@mastodon.social at 2026-11-07T07:00:20.000Z ##

CVE-2026-2278: missing capability check in VW Writer Blog WordPress theme lets Subscriber-level users reset all customizer settings. CVSS 4.3, unpatched. Update or disable the theme. #CVE #WordPress #infosec https://www.valtersit.com/cve/CVE-2026-2278/

##

CVE-2026-87917
(6.1 MEDIUM)

EPSS: 0.38%

updated 2026-09-21T13:33:33.387000

1 posts

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing

hugovalters@mastodon.social at 2026-11-07T05:30:01.000Z ##

CVE-2026-87917: reflected XSS in MC4WP Mailchimp for WordPress, all versions through 4.14.0. CVSS 6.1, unauthenticated attackers can inject scripts via the data tag. No patch yet, so disable the plugin or apply mitigations now. #CVE #WordPress #infosec https://www.valtersit.com/cve/CVE-2026-87917/

##

CVE-2026-86814
(8.1 HIGH)

EPSS: 0.38%

updated 2026-09-19T15:32:25

1 posts

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.

hugovalters@mastodon.social at 2026-11-07T03:50:01.000Z ##

CVE-2026-86814: UsersWP WordPress plugin before 1.5.10 lets unauthenticated attackers log in as any user, including admins, via unverified social login email. CVSS 8.1, no patch confirmed. Update immediately. #CVE #infosec #WordPress https://www.valtersit.com/cve/CVE-2026-86814/

##

CVE-2026-1984
(5.3 MEDIUM)

EPSS: 0.39%

updated 2026-09-19T09:32:13

1 posts

The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepa_builder' meta

1 repos

https://github.com/gduma-phData/patch-CVE-2026-19843

hugovalters@mastodon.social at 2026-11-07T05:00:41.000Z ##

CVE-2026-1984: Ibtana WordPress plugin up to 0.4.7.7 lets Subscriber-level users modify arbitrary post meta via missing capability check on iepa_use_gt_editor AJAX. CVSS 5.3, unpatched. Audit your sites and restrict access now. #CVE #infosec #WordPress https://www.valtersit.com/cve/CVE-2026-1984/

##

CVE-2019-6988
(6.5 MEDIUM)

EPSS: 1.72%

updated 2026-06-17T02:39:52.953000

2 posts

An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.

EUVD_Bot@mastodon.social at 2026-11-07T06:02:07.000Z ##

🚨 EUVD-2023-43059

📊 Score: 5.5/10 (CVSS v3.1)
📅 Published: 2024-07-09 | Updated: 2026-11-07

📝 A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-43059

#cybersecurity #infosec #euvd #cve #vulnerability

##

EUVD_Bot@mastodon.social at 2026-11-07T06:02:07.000Z ##

🚨 EUVD-2023-43059

📊 Score: 5.5/10 (CVSS v3.1)
📅 Published: 2024-07-09 | Updated: 2026-11-07

📝 A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-43059

#cybersecurity #infosec #euvd #cve #vulnerability

##

CVE-2016-4622
(8.8 HIGH)

EPSS: 20.37%

updated 2026-06-17T00:47:54.770000

1 posts

WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4589, CVE-2016-4623, and CVE-2016-4624.

2 repos

https://github.com/hdbreaker/WebKit-CVE-2016-4622

https://github.com/saelo/jscpwn

thegrugq@mastox.eu at 2026-11-07T05:59:05.000Z ##

RT: @5aelo Fun coincidence: the blog post was published exactly ten years after https://phrack.org/issues/70/attacking-javascript-engines-a-case-study-of-javascriptcore-and-cve-2016-4622 (first appeared on Oct 27, 2016 in the Phrack paper feed). Still doing JS engines a decade later it seems 😅

##

CVE-2026-121720
(0 None)

EPSS: 0.00%

2 posts

N/A

1 repos

https://github.com/refiaa/CVE-2026-121720

linuxmint_hun@mastodon.social at 2026-11-07T04:52:12.000Z ##

OpenVPN 2.7.9 megjelent. Javítások: CVE-2026-121720 (Windows: env var injection) és CVE-2026-115342 (Windows: parancssori argumentumok). Plugin DLL-ek korlátozva, interaktív service magas integritás, Linuxon IFF_BACKPRESSURE támogatás, auth-user-pass túl hosszú felhasználónév javítva. Részletek: https://linuxmint.hu/hir/2026/11/openvpn-279-ket-biztonsagi-hibat-javit-es-tovabb-csiszolja-a-linux-halozatkezelest
#OpenVPN #CVE-2026-121720 #CVE-2026-115342 #Linux #Security

##

linuxmint_hun@mastodon.social at 2026-11-07T04:52:12.000Z ##

OpenVPN 2.7.9 megjelent. Javítások: CVE-2026-121720 (Windows: env var injection) és CVE-2026-115342 (Windows: parancssori argumentumok). Plugin DLL-ek korlátozva, interaktív service magas integritás, Linuxon IFF_BACKPRESSURE támogatás, auth-user-pass túl hosszú felhasználónév javítva. Részletek: https://linuxmint.hu/hir/2026/11/openvpn-279-ket-biztonsagi-hibat-javit-es-tovabb-csiszolja-a-linux-halozatkezelest
#OpenVPN #CVE-2026-121720 #CVE-2026-115342 #Linux #Security

##

CVE-2026-115342
(0 None)

EPSS: 0.00%

2 posts

N/A

linuxmint_hun@mastodon.social at 2026-11-07T04:52:12.000Z ##

OpenVPN 2.7.9 megjelent. Javítások: CVE-2026-121720 (Windows: env var injection) és CVE-2026-115342 (Windows: parancssori argumentumok). Plugin DLL-ek korlátozva, interaktív service magas integritás, Linuxon IFF_BACKPRESSURE támogatás, auth-user-pass túl hosszú felhasználónév javítva. Részletek: https://linuxmint.hu/hir/2026/11/openvpn-279-ket-biztonsagi-hibat-javit-es-tovabb-csiszolja-a-linux-halozatkezelest
#OpenVPN #CVE-2026-121720 #CVE-2026-115342 #Linux #Security

##

linuxmint_hun@mastodon.social at 2026-11-07T04:52:12.000Z ##

OpenVPN 2.7.9 megjelent. Javítások: CVE-2026-121720 (Windows: env var injection) és CVE-2026-115342 (Windows: parancssori argumentumok). Plugin DLL-ek korlátozva, interaktív service magas integritás, Linuxon IFF_BACKPRESSURE támogatás, auth-user-pass túl hosszú felhasználónév javítva. Részletek: https://linuxmint.hu/hir/2026/11/openvpn-279-ket-biztonsagi-hibat-javit-es-tovabb-csiszolja-a-linux-halozatkezelest
#OpenVPN #CVE-2026-121720 #CVE-2026-115342 #Linux #Security

##

CVE-2026-65960
(0 None)

EPSS: 0.00%

2 posts

N/A

thehackerwire@mastodon.social at 2026-11-07T03:17:13.000Z ##

🟠 CVE-2026-65960 - High (8.8)

Tetragon is an eBPF-based security observability and runtime enforcement project. Versions before 1.7.0 can use a Helm default that exposes the privileged Tetragon gRPC API through an unauthenticated TCP listener on localhost:54321. An attacker wh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65960/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-11-07T03:17:13.000Z ##

🟠 CVE-2026-65960 - High (8.8)

Tetragon is an eBPF-based security observability and runtime enforcement project. Versions before 1.7.0 can use a Helm default that exposes the privileged Tetragon gRPC API through an unauthenticated TCP listener on localhost:54321. An attacker wh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65960/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-102657
(0 None)

EPSS: 0.00%

2 posts

N/A

thehackerwire@mastodon.social at 2026-11-07T03:17:04.000Z ##

🟠 CVE-2026-102657 - High (7.5)

esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-11-07T03:17:04.000Z ##

🟠 CVE-2026-102657 - High (7.5)

esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-102344
(0 None)

EPSS: 0.00%

2 posts

N/A

thehackerwire@mastodon.social at 2026-11-07T03:16:54.000Z ##

🟠 CVE-2026-102344 - High (8.1)

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102344/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-11-07T03:16:54.000Z ##

🟠 CVE-2026-102344 - High (8.1)

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102344/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-87112(8.8 HIGH)

EPSS: 0.00%

CVE-2026-19128(7.5 HIGH)

EPSS: 0.00%

CVE-2026-18836(9.3 CRITICAL)

EPSS: 0.00%

CVE-2026-19803(9.8 CRITICAL)

EPSS: 0.00%

CVE-2026-19868(7.5 HIGH)

EPSS: 0.00%

CVE-2026-19121(8.3 HIGH)

EPSS: 0.00%

CVE-2026-18838(9.4 CRITICAL)

EPSS: 0.00%

CVE-2026-18535(9.6 CRITICAL)

EPSS: 0.00%

CVE-2026-17409(9.4 CRITICAL)

EPSS: 0.00%

CVE-2026-17362(9.8 CRITICAL)

EPSS: 0.00%

CVE-2026-123218(9.8 CRITICAL)

EPSS: 0.00%

CVE-2024-27834(5.5 MEDIUM)

EPSS: 1.50%

CVE-2026-93742(9.9 CRITICAL)

EPSS: 2.27%

CVE-2026-84750(6.5 MEDIUM)

EPSS: 0.45%

CVE-2026-2278(4.3 MEDIUM)

EPSS: 0.34%

CVE-2026-87917(6.1 MEDIUM)

EPSS: 0.38%

CVE-2026-86814(8.1 HIGH)

EPSS: 0.38%

CVE-2026-1984(5.3 MEDIUM)

EPSS: 0.39%

CVE-2019-6988(6.5 MEDIUM)

EPSS: 1.72%

CVE-2016-4622(8.8 HIGH)

EPSS: 20.37%

CVE-2026-121720(0 None)

EPSS: 0.00%

CVE-2026-115342(0 None)

EPSS: 0.00%

CVE-2026-65960(0 None)

EPSS: 0.00%

CVE-2026-102657(0 None)

EPSS: 0.00%

CVE-2026-102344(0 None)

EPSS: 0.00%

CVE-2026-87112
(8.8 HIGH)

CVE-2026-19128
(7.5 HIGH)

CVE-2026-18836
(9.3 CRITICAL)

CVE-2026-19803
(9.8 CRITICAL)

CVE-2026-19868
(7.5 HIGH)

CVE-2026-19121
(8.3 HIGH)

CVE-2026-18838
(9.4 CRITICAL)

CVE-2026-18535
(9.6 CRITICAL)

CVE-2026-17409
(9.4 CRITICAL)

CVE-2026-17362
(9.8 CRITICAL)

CVE-2026-123218
(9.8 CRITICAL)

CVE-2024-27834
(5.5 MEDIUM)

CVE-2026-93742
(9.9 CRITICAL)

CVE-2026-84750
(6.5 MEDIUM)

CVE-2026-2278
(4.3 MEDIUM)

CVE-2026-87917
(6.1 MEDIUM)

CVE-2026-86814
(8.1 HIGH)

CVE-2026-1984
(5.3 MEDIUM)

CVE-2019-6988
(6.5 MEDIUM)

CVE-2016-4622
(8.8 HIGH)

CVE-2026-121720
(0 None)

CVE-2026-115342
(0 None)

CVE-2026-65960
(0 None)

CVE-2026-102657
(0 None)

CVE-2026-102344
(0 None)