🟠 CVE-2026-72984 - High (8.8)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72984/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84375 - High (7.5)

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84375/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84375 - High (7.5)

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2 and 4.3.2, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84375/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84374 - High (7.5)

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84374/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84374 - High (7.5)

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves the caller-controlled $destination supplied through Excel::store(), $...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84374/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84372 - Critical (9.8)

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggrega...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84372 - Critical (9.8)

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggrega...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-83549 - High (7.8)

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enabl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-83549/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-83549 - High (7.8)

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enabl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-83549/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-83548, a critical SonicWall SMA1000 vulnerability, is exploited in the wild. The pre-authentication SSRF flaw scores a maximum 10.0 CVSS.

#SonicWall #SMA1000 #CVE202683548 #SSRF #PreAuth #VPNsecurity #InfoSec #ExploitedInTheWild

https://securityonline.info/sonicwall-sma1000-cve-2026-83548-ssrf/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-83548, a critical SonicWall SMA1000 vulnerability, is exploited in the wild. The pre-authentication SSRF flaw scores a maximum 10.0 CVSS.

#SonicWall #SMA1000 #CVE202683548 #SSRF #PreAuth #VPNsecurity #InfoSec #ExploitedInTheWild

https://securityonline.info/sonicwall-sma1000-cve-2026-83548-ssrf/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-75604 - Critical (9)

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backsl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75604/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75604 - Critical (9)

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backsl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75604/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🏆 New Achievement! Terms and Conditions of Your Own Destruction!

IMPORTANT: By running Next.js on a Windows server, you have agreed to receive one (1) randomized loot drop from our Critical Vulnerability Collection. This month's pull includes CVE-2026-75604, a CVSS 9.0 Windows path traversal enabling unauthenticated remote code execution — congrats, you hit the worst box in the crate. Linux and macOS users received the "nothing" tier, as advertised in the fine print nobody read. (1/2)

Vuln or bugdoor?

https://nvd.nist.gov/vuln/detail/cve-2026-76658

A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

Vuln or bugdoor?

https://nvd.nist.gov/vuln/detail/cve-2026-76658

A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

🟠 CVE-2026-84370 - High (8.2)

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84370/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84370 - High (8.2)

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84370/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical HPE Fabric Composer vulnerabilities, including CVE-2026-76657, allow remote code execution. Update to version 7.4.0 now to secure your network.

#HPE #FabricComposer #Vulnerability #Cybersecurity #CVE202676657

https://securityonline.info/hpe-fabric-composer-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Critical HPE Fabric Composer vulnerabilities, including CVE-2026-76657, allow remote code execution. Update to version 7.4.0 now to secure your network.

#HPE #FabricComposer #Vulnerability #Cybersecurity #CVE202676657

https://securityonline.info/hpe-fabric-composer-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-73782 - High (8.8)

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73782/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73782 - High (8.8)

A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73782/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73773 - High (7.5)

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73773/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73773 - High (7.5)

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the API endpoint of AOS-CX. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73773/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

AshSqlite Vulnerability (CVE-2026-77846) Exposes Hidden JSON Fields

CVE-2026-77846, a newly disclosed AshSqlite vulnerability, can allow attackers to access hidden or sensitive fields stored inside JSON and map

🔗️ [Thecyberexpress] https://link.is.it/jyTNki

CVE-2026-81533 - Memory safety flaw in MongoDB BI Connector ODBC Driver. Buffer overflow via long LIMIT clauses. CVSS 7.1. Disable prefetch now. #CVE #MongoDB #infosec

https://www.valtersit.com/cve/CVE-2026-81533/

🟠 CVE-2026-19806 - High (8.8)

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19806/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19806 - High (8.8)

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19806/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82908 - High (8.8)

A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument count/e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82908/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84268 - High (8.8)

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84268 - High (8.8)

A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58566 - High (8.8)

Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58566/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58566 - High (8.8)

Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58566/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84202 - High (8.8)

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84202/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84202 - High (8.8)

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84202/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks

A critical authentication bypass vulnerability (CVE-2026-62911) affects approximately 22,000 unpatched Microsoft Exchange servers running versions 2016, 2019, and SE. Attackers can hijack all user mailboxes on vulnerable systems. Exploit code is publicly available; active exploitation in the wild h…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

Microsoft Exchange Faces Another Critical Wake-Up Call as Nearly 22,000 Servers Remain Exposed + Video

Introduction: A Familiar Risk That Refuses to Disappear Microsoft Exchange Server has once again become the center of a serious cybersecurity warning, and this time the concern is not merely theoretical. Nearly 22,000 internet-exposed Exchange servers reportedly remain vulnerable to CVE-2026-62911, a high-severity authentication-bypass flaw that could allow an…

https://undercodenews.com/microsoft-exchange-faces-another-critical-wake-up-call-as-nearly-22000-servers-remain-exposed-video/?utm_source=mastodon&utm_medium=jetpack_social

Unpatched Microsoft Exchange Servers Exposed to Hijack Attacks

Thousands of Microsoft Exchange servers remain vulnerable to a high-severity flaw, leaving 21,899 internet-facing systems open to hijack attacks that could give attackers control of every mailbox. This unpatched authentication-bypass vulnerability, CVE-2026-62911, was fixed by Microsoft in August, but many servers…

https://osintsights.com/unpatched-microsoft-exchange-servers-exposed-to-hijack-attacks?utm_source=mastodon&utm_medium=social

#Cve202662911 #MicrosoftExchange #AuthenticationBypass #MailboxHijacking #UnpatchedServers

⚠️ CRITICAL: Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks

A critical authentication bypass vulnerability (CVE-2026-62911) affects approximately 22,000 unpatched Microsoft Exchange servers running versions 2016, 2019, and SE. Attackers can hijack all user mailboxes on vulnerable systems. Exploit code is publicly available; active exploitation in the wild h…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

Security researchers released technical details and PoC code for CVE-2026-62911, a critical Exchange Server pre-auth RCE flaw.

#ExchangeServer #CVE202662911 #CyberSecurity #RCE #Pwn2Own

https://securityonline.info/cve-2026-62911-exchange-server-pre-auth-rce-poc/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-82593 - Critical (9.9)

A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Upgrade. This manipulation of the argument fota_url causes stack-based buffer o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82593/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82542 - Critical (10)

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer over...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82542/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

https://www.cve.org/CVERecord?id=CVE-2026-82542

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

🟠 CVE-2026-79746 - High (8.1)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' (or 'custom') is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79746/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

sev:CRIT LPE in Plesk. Gotta love that shared infra and the inherited risk that comes with it.

https://nvd.nist.gov/vuln/detail/cve-2026-67394

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.

sev:CRIT LPE in Plesk. Gotta love that shared infra and the inherited risk that comes with it.

https://nvd.nist.gov/vuln/detail/cve-2026-67394

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access (or allowed to change their own shell access) to elevate privileges to the root account on the hosting server.

🟠 CVE-2026-84195 - High (7.7)

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84195/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84195 - High (7.7)

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mode without explicit authorization headers. Attackers can exfiltrate the token by directing apiCall requests...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84195/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84199 - High (7.7)

Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84199/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84199 - High (7.7)

Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84199/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84196 - High (7.7)

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can targe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84196/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84196 - High (7.7)

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can targe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84196/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📰 Critical RCE Flaw in SAUTER Building Controllers Threatens Physical Systems

Critical 9.8 CVSS RCE flaw (CVE-2026-78319) disclosed in SAUTER building automation controllers. Attackers could control HVAC & other physical systems. Patch immediately! #ICS #OTsecurity #CyberSecurity #CVE #BuildingAutomation

🔗 https://cyber.netsecops.io/articles/critical-rce-flaw-in-sauter-building-automation-controllers/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Public advisory details CVE-2026-78319, a critical SAUTER building controller vulnerability enabling unauthenticated remote code execution via a TOCTOU flaw.

#SAUTER #ICS #CVE202678319 #TOCTOU #RCE #BuildingAutomation #OTSecurity #InfoSec

https://securityonline.info/sauter-cve-2026-78319-rce-disclosed/?utm_source=mastodon&utm_medium=jetpack_social

🔒 New CSAF advisory published

VDE-2026-093
SAUTER: modulo 6 and EY-modulo 5 Vulnerability in Firmware update mechanism allowing remote code execution
CVE-2026-78319

A vulnerability has been found in the firmware update process of SAUTER Building Controllers. The identified vulnerability could allow unauthorized code execution on affec…

HTML: https://certvde.com/en/advisories/VDE-2026-093
CSAF JSON: https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-093.json

#OT #Advisory

🔴 CVE-2026-83772 - Critical (9.9)

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-83772/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-83772 - Critical (9.9)

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-83772/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19952 - High (7.5)

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19952/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19952 - High (7.5)

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19952/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19295 - Critical (9.9)

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19295/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75865 - Critical (9.8)

The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the saas_upload_logo() function combined with an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75865/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Discover the details of the critical CVE-2026-65643 vulnerability in cPanel & WHM, allowing attackers to gain full root access on shared hosting servers.

#cPanel #Cybersecurity #Vulnerability #SharedHosting #InfoSec

https://securityexpress.info/cpanel-rce-vulnerability-shared-hosting/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-65643 is a critical flaw in cPanel and WHM that lets an authenticated user with parked-domain privileges write arbitrary files and escalate to root. One shared-hosting account can compromise every tenant on the server. Patch immediately and audit who holds domain-creation rights.

#CVE202665643 #cPanel #WHM #PrivilegeEscalation

https://cyberworldops.eu/en/from-a-parked-domain-to-server-root-the-critical-flaw-in-cpanelwhm

cPanel Patches Root Escalation Flaw in Domain Management

cPanel fixed a vulnerability (CVE-2026-65643) that allows authenticated users to gain root access by exploiting domain parking features. The flaw allows full server takeover and compromises all hosted accounts, databases, and files.

**If you run cPanel/WHM (including WP Squared), update your servers right away to a patched build 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, or 11.138.1.7 or later using the `upcp` script or the WHM interface. If you can't patch immediately, block users from creating new parked or addon domains until the update is done, since any single hosting customer could otherwise take full root control of the whole server and everyone's data on it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/cpanel-patches-root-escalation-flaw-in-domain-management-s-9-x-p-b/gD2P6Ple2L

🟠 CVE-2026-82447 - High (8.8)

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syn...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55065 - High (8.1)

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55065/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82954 - Critical (9.9)

A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82954/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82882 - High (8.8)

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18891 - High (8.2)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-83596 - High (8.8)

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-83596/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82226 - Critical (9.8)

Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Frisch geschlossene Sicherheitslücken in PaperCut NG und MF (CVE-2026-81578 & CVE-2026-82078) dienen Angreifern aktuell aktiv als Einfallstor für massiven Datendiebstahl. Die Kombination aus Authentifizierungs-Bypasses und Remote Code Execution erlaubt vollständige Systemübernahmen im Netz exponierter Printserver. Administratoren müssen ausstehende Patches zwingend einspielen und den Zugriff sofort einschränken.

#PaperCut #Infosec #Vulnerability #CyberSecurity #DataTheft #SysAdmin

T-Suite Technical Brief: CVE-2026-82078 active exploitation targets PaperCut NG/MF with unsafe reflection & arbitrary Java execution. Read our engineering runbook for CrowdStrike CQL detection rules, ATT&CK mapping, and hardening controls.
https://thecybermind.co/zqkw

URGENT C-Suite Brief: CVE-2026-82078 active exploitation targets PaperCut NG/MF with unsafe reflection and arbitrary Java execution. Read our executive brief for rapid EDR tuning, least privilege controls, and asset integrity protection. https://thecybermind.co/pzil

URGENT C-Suite Brief: CVE-2026-82078 active exploitation targets PaperCut NG/MF with unsafe reflection and arbitrary Java execution. Read our executive brief for rapid EDR tuning, least privilege controls, and asset integrity protection. https://thecybermind.co/4im9

🚨 [CISA-2026:0831] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0831)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-81578 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-81578)
- Name: PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PaperCut
- Product: NG/MF
- Notes: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-81578

⚠️ CVE-2026-82078 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82078)
- Name: PaperCut NG/MF Unsafe Reflection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PaperCut
- Product: NG/MF
- Notes: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82078

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260831 #cisa20260831 #cve_2026_81578 #cve_2026_82078 #cve202681578 #cve202682078

PaperCut has made the cut. Two vulnerabilities have been added to the KEV catalogue.

CISA: CVE-2026-81578: PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82078 #CISA #infosec #vulnerability

CVE ID: CVE-2026-82078
Vendor: PaperCut
Product: NG/MF
Date Added: 2026-08-31
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-82078

A PaperCut zero-day (CVE-2026-81578, CVE-2026-82078) is exploited in the wild. Attackers run malicious SQL for RCE, and a Metasploit PoC is now public.

#PaperCut #CVE202682078 #ZeroDay #RCE #InfoSec #Metasploit #SQLi

https://securityonline.info/papercut-zero-day-cve-2026-82078/?utm_source=mastodon&utm_medium=jetpack_social

Frisch geschlossene Sicherheitslücken in PaperCut NG und MF (CVE-2026-81578 & CVE-2026-82078) dienen Angreifern aktuell aktiv als Einfallstor für massiven Datendiebstahl. Die Kombination aus Authentifizierungs-Bypasses und Remote Code Execution erlaubt vollständige Systemübernahmen im Netz exponierter Printserver. Administratoren müssen ausstehende Patches zwingend einspielen und den Zugriff sofort einschränken.

#PaperCut #Infosec #Vulnerability #CyberSecurity #DataTheft #SysAdmin

🚨 [CISA-2026:0831] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0831)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-81578 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-81578)
- Name: PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PaperCut
- Product: NG/MF
- Notes: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-81578

⚠️ CVE-2026-82078 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-82078)
- Name: PaperCut NG/MF Unsafe Reflection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: PaperCut
- Product: NG/MF
- Notes: https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/?lid=2oneu2wt0ct4 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-82078

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260831 #cisa20260831 #cve_2026_81578 #cve_2026_82078 #cve202681578 #cve202682078

PaperCut has made the cut. Two vulnerabilities have been added to the KEV catalogue.

CISA: CVE-2026-81578: PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

CVE-2026-82078: PaperCut NG/MF Unsafe Reflection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82078 #CISA #infosec #vulnerability

CVE ID: CVE-2026-81578
Vendor: PaperCut
Product: NG/MF
Date Added: 2026-08-31
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-81578

URGENT C-Suite Brief: CVE-2026-81578 active exploitation targets PaperCut NG/MF authentication flaws. Read our executive brief for rapid patch deployment, EDR monitoring, and access controls to safeguard your enterprise perimeter. http://thecybermind.co/4im9

PaperCut NG/MF : deux failles exploitées et un premier correctif contourné https://www.it-connect.fr/papercut-ng-mf-cve-2026-81578-82078-deuxieme-correctif-urgence/ #ActuCybersécurité #Vulnérabilités #Cybersécurité

A PaperCut zero-day (CVE-2026-81578, CVE-2026-82078) is exploited in the wild. Attackers run malicious SQL for RCE, and a Metasploit PoC is now public.

#PaperCut #CVE202682078 #ZeroDay #RCE #InfoSec #Metasploit #SQLi

https://securityonline.info/papercut-zero-day-cve-2026-82078/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-82655 - High (7.5)

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dum...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82655/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82285 - High (8.2)

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-81934, a critical Redis RCE flaw (CVSS 9.2), now has public exploit details and PoC code. Patch your TLS-enabled servers now.

#Redis #CVE202681934 #RCE #Vulnerability #InfoSec #UseAfterFree #TLS

https://securityonline.info/redis-cve-2026-81934-rce/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-81934, a critical Redis RCE flaw (CVSS 9.2), now has public exploit details and PoC code. Patch your TLS-enabled servers now.

#Redis #CVE202681934 #RCE #Vulnerability #InfoSec #UseAfterFree #TLS

https://securityonline.info/redis-cve-2026-81934-rce/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-16947 - Critical (9.1)

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unau...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16947/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77007 - High (7.5)

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77007/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76586 - High (7.5)

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated us...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76586/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82472 - High (7.5)

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82472/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82460 - Critical (9.8)

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82460/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82454 - Critical (9.1)

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82454/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical JFrog Artifactory Flaw Is Already Under Attack, Putting Software Supply Chains in the Crosshairs + Video

A Dangerous Race Against Time A critical vulnerability in JFrog Artifactory has moved from public disclosure to real-world exploitation with startling speed. CVE-2026-82329, rated CVSS 9.8, allows an unauthenticated attacker to bypass authentication on vulnerable self-hosted Artifactory deployments and potentially obtain administrator-level access. That…

https://undercodenews.com/critical-jfrog-artifactory-flaw-is-already-under-attack-putting-software-supply-chains-in-the-crosshairs-video/?utm_source=mastodon&utm_medium=jetpack_social

Attackers Exploit JFrog Artifactory Flaw to Mint Admin Tokens

A critical flaw in JFrog Artifactory, known as CVE-2026-82329, allows attackers to easily gain admin access without needing authentication or user interaction, posing a huge risk to affected instances. This near-maximum-score vulnerability has already been patched in Artifactory version 7.161.20.

https://osintsights.com/attackers-exploit-jfrog-artifactory-flaw-to-mint-admin-tokens?utm_source=mastodon&utm_medium=social

#JfrogArtifactory #Cve202682329 #AuthenticationBypass #SupplyChain #EmergingThreats

📰 Critical JFrog Artifactory Auth Bypass Flaw Under Active Exploit

Critical auth bypass flaw (CVE-2026-82329) in self-hosted JFrog Artifactory is actively exploited. Attackers can gain admin access, posing a severe software supply chain risk. Patch immediately! #JFrog #Artifactory #CyberSecurity #CVE

🔗 https://cyber.netsecops.io/articles/critical-jfrog-artifactory-flaw-under-active-exploitation/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

New.

WatchTower, on X:

"WatchTowr Intel is already seeing exploitation of the JFrog Artifactory Auth Bypass (CVE-2026-82329), with attackers minting themselves admin tokens."

More:

Security Week: Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/ @SecurityWeek #vulnerability #infosec

🏆 New Achievement! Admin Tokens: A Self-Service Experience!

The System, acting in its capacity as counsel for the prosecution, hereby submits Exhibit A: CVE-2026-82329, a CVSS 9.8 authentication bypass in JFrog Artifactory, patched August 28. Per WatchTowr's testimony, unknown attackers were, within days of public disclosure, "minting themselves admin tokens" via default configurations — no credentials required. Your Honor, the defendant did knowingly operate an unpatched instance. (1/2)

JFrog Artifactory is affected by critical CVE-2026-82329 (CVSS 9.8) allowing unauthenticated remote attackers to create administrative tokens via default configurations. With reports of active exploitation, this enables full system takeover and severe software supply chain compromise. Immediate patching is essential. #JFrog #SupplyChainSecurity #VulnerabilityManagement

https://cyberworldops.eu/en/jfrog-artifactory-critical-flaw-allows-unauthenticated-creation-of

New.

WatchTower, on X:

"WatchTowr Intel is already seeing exploitation of the JFrog Artifactory Auth Bypass (CVE-2026-82329), with attackers minting themselves admin tokens."

More:

Security Week: Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild https://www.securityweek.com/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in-the-wild/ @SecurityWeek #vulnerability #infosec

🏆 New Achievement! Admin Tokens: A Self-Service Experience!

The System, acting in its capacity as counsel for the prosecution, hereby submits Exhibit A: CVE-2026-82329, a CVSS 9.8 authentication bypass in JFrog Artifactory, patched August 28. Per WatchTowr's testimony, unknown attackers were, within days of public disclosure, "minting themselves admin tokens" via default configurations — no credentials required. Your Honor, the defendant did knowingly operate an unpatched instance. (1/2)

JFrog Artifactory is affected by critical CVE-2026-82329 (CVSS 9.8) allowing unauthenticated remote attackers to create administrative tokens via default configurations. With reports of active exploitation, this enables full system takeover and severe software supply chain compromise. Immediate patching is essential. #JFrog #SupplyChainSecurity #VulnerabilityManagement

https://cyberworldops.eu/en/jfrog-artifactory-critical-flaw-allows-unauthenticated-creation-of

A critical Artifactory authentication bypass flaw (CVE-2026-82329) is exploited in the wild, letting attackers obtain administrative privileges.

#Artifactory #CVE202682329 #CyberSecurity #AuthenticationBypass #Exploit

https://securityonline.info/cve-2026-82329-exploited-admin-privileges/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-82282 - High (8)

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82270 - High (7.5)

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82270/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77586 - High (8)

In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permissio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77586/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-55565 - Critical (9.9)

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55565/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55552 - High (7.5)

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configure...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55552/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55485 - High (8.8)

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55485/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-55247 - Critical (9.1)

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55247/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-54788 - High (7.5)

dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54788/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-54754 - Critical (9.6)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage li...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54754/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-17615 - High (7.5)

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17615/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New. This is CVE-2026-83492, meduim severity.

Tenable Research Advisories: WordPress - Kubio AI Website Builder DoS https://www.tenable.com/security/research/tra-2026-58 @tenable #infosec #WordPress #vulnerability

🟠 CVE-2026-82641 - High (8.6)

keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82641/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82636 - High (7.9)

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metachara...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82636/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56854 - High (7.5)

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the Passwor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56854/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82616 - Critical (9.9)

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82616/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82592 - Critical (9.9)

A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler Endpoint. The manipulation of the argument partition results in stack-based buf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82592/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56718 - High (7.5)

AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82549 - High (8.3)

A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulation leads to improper validation of integrity check value. The attack may be launched rem...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82549/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82645 - High (8.6)

AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82644 - High (7.5)

WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlob...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82644/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82639 - High (7.5)

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82639/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82638 - High (7.5)

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82638/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82642 - High (8.8)

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transfo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82642/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82657 - High (7.5)

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82654 - High (8.9)

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents ref...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82654/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82653 - High (8.9)

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82653/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82635 - High (8.8)

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82635/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82539 - Critical (9.1)

A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MAC Filtering. Executing a manipulation of the argument desc can lead to memory corruption...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-15980 - Critical Auth Bypass in WordPress MyHome Core plugin (<= 4.4.5) allows unauthenticated admin account takeover. CVSS 9.8. Mitigate now. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-15980/

🔴 CVE-2026-15980 - Critical (9.8)

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-16259 - Critical (9.8)

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16259/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16061 - High (8.6)

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16061/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-77012 - Critical (9.3)

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77012/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16600 - High (7.7)

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16600/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76548 - High (8.2)

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76548/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-15369 - Critical (9.8)

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15369/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82463 - High (8.1)

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger pro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82463/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82474 - High (7.8)

Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82474/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82473 - High (8.2)

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82473/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75807 - High (7.5)

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82475 - High (8.1)

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82475/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82466 - High (8.7)

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82466/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82461 - Auth bypass in pac4j-oidc. Unverified access tokens allow forging admin roles. CVSS 8.1. Update to v6.5.6 now. #CVE #infosec #cybersecurity

https://www.valtersit.com/cve/CVE-2026-82461/

🟠 CVE-2026-82461 - High (8.1)

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass autho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82461/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82450 - RCE vulnerability in BookStack portable ZIP import via PHP polyglot file upload. CVSS 8.8. Update immediately. #CVE #BookStack #cybersecurity

https://www.valtersit.com/cve/CVE-2026-82450/

🟠 CVE-2026-82450 - High (8.8)

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82450/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82457 - High (7.8)

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to ro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82456 - Critical (10)

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82456/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82452 - Critical (9.8)

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82452/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82453 - High (7.5)

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82448 - Critical (9.8)

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during W...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82448/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-14494 - Critical (9.8)

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Debian LPE PoC (CVE-2026-80714) https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-80714-Debian-6.12.101

🟠 CVE-2026-38638 - High (7.5)

An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-38638/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56854 - High (7.5)

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the Passwor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56854/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18729 - High (8.8)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18729/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19286 - Critical (9.8)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-18527 - Critical (9.9)

IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18527/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-17203 - High (7.5)

IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17203/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82278 - High (8.8)

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-55634 - Critical (9.9)

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field na...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55634/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-55248 - Critical (9.1)

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portle...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55248/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-37237 - High (7.5)

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-37237/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-50979 - High (8.1)

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50979/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

RE: https://infosec.exchange/@cR0w/117169327022091327

Update:

Update - September 1st, 2026

Due to additional analysis provided by the security researcher who discovered CVE-2026-6875, we have upgraded the severity rating of CVE-2026-6876 from High to Critical. This change affects only the severity rating for CVE-2026-6876; it does not change the other information shared in our August 27th advisory. Based on our monitoring to date, we have not observed evidence of malicious exploitation of this issue.

RE: https://infosec.exchange/@cR0w/117169327022091327

Update:

Update - September 1st, 2026

Due to additional analysis provided by the security researcher who discovered CVE-2026-6875, we have upgraded the severity rating of CVE-2026-6876 from High to Critical. This change affects only the severity rating for CVE-2026-6876; it does not change the other information shared in our August 27th advisory. Based on our monitoring to date, we have not observed evidence of malicious exploitation of this issue.

🏆 New Achievement! Maximum Severity, Minimum Fuss!

Per your platform's automated patch-prioritization policy: three maximum-severity vulnerabilities in the ServiceNow AI Platform have been logged, triaged, and assigned to the backlog. CVE-2026-18886 enables privilege escalation and data manipulation; CVE-2026-74820 allows arbitrary SQL execution against your underlying database. No user interaction required for exploitation. (1/3)

🟠 CVE-2026-82284 - High (8.1)

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories inc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82275 - High (7.5)

Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82283 - High (8.1)

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82277 - Critical (9.8)

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82269 - High (8.1)

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82269/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82268 - High (7.5)

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio int...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75124 - High (7.5)

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75486 - High (8)

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original br...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75486/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82266 - Critical (9.8)

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82266/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82021 - High (8.3)

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82021/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56100 - High (8.1)

SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feig...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-37736 - High (7.5)

An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-37736/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🏆 New Achievement! Maximum Severity, Minimum Fuss!

Per your platform's automated patch-prioritization policy: three maximum-severity vulnerabilities in the ServiceNow AI Platform have been logged, triaged, and assigned to the backlog. CVE-2026-18886 enables privilege escalation and data manipulation; CVE-2026-74820 allows arbitrary SQL execution against your underlying database. No user interaction required for exploitation. (1/3)

Two independent root RCE chains were disclosed on the Unitree G1 EDU humanoid robot. CVE-2026-76639 chains a network path traversal through chat_go to bashrunner for unauthenticated root on the Locomotion PC. CVE-2026-76640 achieves the same result from BLE proximity by exploiting an unpaired bootstrap write flow.

#UnitreeG1 #RootRCE #BLE #RoboticsSecurity

https://cyberworldops.eu/en/two-root-attack-chains-on-unitree-g1-edu-one-via-network-one-via

📈 CVE Published in last 7 days (2026-08-24 - 2026-08-24)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 344
- High: 991
- Medium: 799
- Low: 122
- None: 461

Status:
- : 20
- Analyzed: 271
- Awaiting Analysis: 296
- Deferred: 627
- Received: 1129
- Rejected: 180
- Undergoing Analysis: 194

CISA KEVs:
- CISA-2026:0825 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0825)
- CISA-2026:0824 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0824)
- CISA-2026:0826 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0826)
- CISA-2026:0827 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0827)

Top CNAs:
- VulnCheck: 424
- Chrome: 328
- MITRE: 228
- kernel.org: 228
- GitHub, Inc.: 216
- Intel Corporation: 147
- WPScan: 94
- Patchstack: 94
- VMware: 90
- VulDB: 90

Top Affected Products:
- UNKNOWN: 2182
- Google Chrome: 218
- Draytek Vigorswitch G2100 Firmware: 29
- Draytek Vigorswitch G2540xs Firmware: 29
- Draytek Vigorswitch Q2121x Firmware: 29
- Draytek Vigorswitch Pq2121x Firmware: 29
- Draytek Vigorswitch Q2200x Firmware: 29
- Draytek Vigorswitch G2280x Firmware: 29
- Draytek Vigorswitch Pq2200xb Firmware: 29
- Draytek Vigorswitch P1282 Firmware: 29

Top EPSS Score:
- CVE-2026-60004 - 84.55 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-60004)
- CVE-2026-47864 - 3.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47864)
- CVE-2026-71921 - 3.25 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71921)
- CVE-2026-71914 - 3.07 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71914)
- CVE-2026-71905 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71905)
- CVE-2026-71906 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71906)
- CVE-2026-71907 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71907)
- CVE-2026-71908 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71908)
- CVE-2026-71909 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71909)
- CVE-2026-71910 - 3.05 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-71910)

#ZEN #SecDB #InfoSec

🟠 CVE-2026-55484 - High (7.5)

ALOS HTTP is a Linux-first Go web framework and application server built around a custom networking stack. Prior to 0.0.0-20260617230736-314b6783e196, core/utils.go::sanitizeRequestPath calls splitPathQuery on a request path beginning with a quest...