## Updated at UTC 2026-09-13T22:58:35.752595

Access data as JSON

CVE CVSS EPSS Posts Repos Nuclei Updated Description
CVE-2026-29811 7.7 0.00% 2 0 2026-09-13T20:16:51.020000 CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second dom
CVE-2026-90783 7.8 0.00% 2 0 2026-09-13T15:30:28 MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib l
CVE-2026-90510 8.3 0.00% 2 0 2026-09-13T12:31:19 A security vulnerability has been detected in dromara orion-visor up to 2.5.7. T
CVE-2026-90775 6.5 0.00% 2 0 2026-09-13T12:31:19 PostGIS address_standardizer through 3.7.0 fails to validate the Weight paramete
CVE-2026-90778 7.5 0.00% 2 0 2026-09-13T12:31:19 SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() fu
CVE-2026-90776 7.5 0.00% 2 0 2026-09-13T12:31:19 Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vul
CVE-2026-90772 7.6 0.00% 2 0 2026-09-13T12:31:19 Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptio
CVE-2026-90770 8.8 0.00% 2 0 2026-09-13T12:31:12 Spug through 3.4.0 contains a remote code execution vulnerability in the ping_ch
CVE-2026-90768 8.1 0.00% 2 0 2026-09-13T12:31:12 CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpo
CVE-2026-90562 8.1 0.00% 4 0 2026-09-13T12:31:11 LangBot before 4.10.11 generates password recovery keys with only 24 bits of ent
CVE-2026-90780 7.5 0.00% 2 0 2026-09-13T12:17:17.093000 SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header()
CVE-2026-90779 7.5 0.00% 2 0 2026-09-13T12:17:16.960000 SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthH
CVE-2026-90777 8.8 0.00% 2 0 2026-09-13T12:17:16.690000 ESPnet before 202609 deserializes pretrained model checkpoints using torch.load
CVE-2026-90774 7.5 0.00% 2 0 2026-09-13T11:17:02.163000 rustypaste before 0.18.1 validates the destination path before applying the opti
CVE-2026-90769 7.7 0.00% 2 0 2026-09-13T11:17:01.270000 Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sou
CVE-2026-90561 8.7 0.00% 2 0 2026-09-13T11:17:00.613000 Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-
CVE-2026-89080 7.5 0.00% 2 0 2026-09-13T11:16:59.650000 The Really Simple Security WordPress plugin before 9.8.1 does not prevent an un
CVE-2026-86406 7.5 0.00% 2 0 2026-09-13T11:16:58.793000 The User Registration & Membership WordPress plugin before 5.2.8 does not check
CVE-2026-89767 7.8 0.15% 2 0 2026-09-13T09:33:34 In the Linux kernel, the following vulnerability has been resolved: ovl: fix do
CVE-2026-89763 7.8 0.11% 2 0 2026-09-13T09:33:34 In the Linux kernel, the following vulnerability has been resolved: KEYS: trust
CVE-2026-89771 7.8 0.12% 2 0 2026-09-13T09:32:31 In the Linux kernel, the following vulnerability has been resolved: ring-buffer
CVE-2026-89750 7.8 0.16% 2 0 2026-09-13T09:32:30 In the Linux kernel, the following vulnerability has been resolved: tracing/use
CVE-2026-89748 7.8 0.15% 2 0 2026-09-13T09:32:30 In the Linux kernel, the following vulnerability has been resolved: tracing: Fi
CVE-2026-89747 7.8 0.16% 2 0 2026-09-13T09:32:30 In the Linux kernel, the following vulnerability has been resolved: tracing: Fi
CVE-2026-89746 7.8 0.16% 2 0 2026-09-13T09:32:30 In the Linux kernel, the following vulnerability has been resolved: tracing: Fi
CVE-2026-89754 7.8 0.12% 2 0 2026-09-13T09:32:30 In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk
CVE-2026-89762 7.8 0.12% 2 0 2026-09-13T09:32:30 In the Linux kernel, the following vulnerability has been resolved: apparmor: f
CVE-2026-89761 7.8 0.12% 2 0 2026-09-13T09:32:30 In the Linux kernel, the following vulnerability has been resolved: apparmor: f
CVE-2026-89736 7.8 0.12% 2 0 2026-09-13T09:32:29 In the Linux kernel, the following vulnerability has been resolved: usb: gadget
CVE-2026-89764 7.8 0.14% 2 0 2026-09-13T07:17:40.843000 In the Linux kernel, the following vulnerability has been resolved: rust: devre
CVE-2026-89760 7.8 0.11% 2 0 2026-09-13T07:17:40.307000 In the Linux kernel, the following vulnerability has been resolved: mm, swap: d
CVE-2026-89758 7.8 0.14% 2 0 2026-09-13T07:17:40.190000 In the Linux kernel, the following vulnerability has been resolved: mm/mempolic
CVE-2026-89755 7.8 0.14% 2 0 2026-09-13T07:17:39.983000 In the Linux kernel, the following vulnerability has been resolved: mm/migrate_
CVE-2026-89744 8.4 0.14% 2 0 2026-09-13T07:17:39.073000 In the Linux kernel, the following vulnerability has been resolved: device prop
CVE-2026-89706 7.5 0.44% 2 0 2026-09-13T07:17:36.240000 In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset
CVE-2026-89704 7.5 0.44% 2 0 2026-09-13T07:17:35.990000 In the Linux kernel, the following vulnerability has been resolved: nfsd: sampl
CVE-2026-89697 9.1 0.60% 2 0 2026-09-13T07:17:35.480000 In the Linux kernel, the following vulnerability has been resolved: nfsd: add f
CVE-2026-89696 7.5 0.67% 2 0 2026-09-13T07:17:35.343000 In the Linux kernel, the following vulnerability has been resolved: nfsd: block
CVE-2026-89695 7.5 0.49% 2 0 2026-09-13T07:17:35.230000 In the Linux kernel, the following vulnerability has been resolved: nfsd: cap d
CVE-2026-89692 7.5 0.43% 2 0 2026-09-13T07:17:35.107000 In the Linux kernel, the following vulnerability has been resolved: nfsd: clear
CVE-2026-89690 7.8 0.16% 2 0 2026-09-13T07:17:34.850000 In the Linux kernel, the following vulnerability has been resolved: nfsd: defer
CVE-2026-89684 7.5 0.45% 2 0 2026-09-13T07:17:34.130000 In the Linux kernel, the following vulnerability has been resolved: nfsd: fix c
CVE-2026-89682 8.1 0.40% 2 0 2026-09-13T07:17:34.003000 In the Linux kernel, the following vulnerability has been resolved: nfsd: fix f
CVE-2026-81000 7.8 0.16% 2 0 2026-09-13T07:17:06.600000 In the Linux kernel, the following vulnerability has been resolved: net: tun: b
CVE-2026-80995 7.8 0.12% 2 0 2026-09-13T07:17:06.230000 In the Linux kernel, the following vulnerability has been resolved: net: mctp:
CVE-2026-80981 9.8 0.59% 2 0 2026-09-13T07:17:05 In the Linux kernel, the following vulnerability has been resolved: net/smc: fi
CVE-2026-90678 7.5 0.00% 2 0 2026-09-13T04:17:25.227000 An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3
CVE-2026-90668 7.5 0.00% 3 0 2026-09-13T03:30:22 The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the
CVE-2026-90493 8.8 0.00% 4 0 2026-09-13T03:30:22 A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build
CVE-2026-90648 None 0.00% 2 0 2026-09-13T00:31:26 wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situatio
CVE-2026-90647 7.4 0.00% 2 0 2026-09-13T00:31:26 ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows con
CVE-2026-90651 8.1 0.00% 4 0 2026-09-13T00:17:07.203000 Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0
CVE-2026-90616 7.4 0.00% 2 0 2026-09-12T20:16:30.957000 In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read an
CVE-2026-84171 9.8 0.37% 4 0 2026-09-12T18:31:29 The WP images upload on piclect WordPress plugin through 1.0 does not validate t
CVE-2026-75800 9.8 0.42% 2 0 2026-09-12T18:31:28 The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signatu
CVE-2026-87842 7.5 0.29% 2 0 2026-09-12T18:31:28 The Zonify WordPress plugin before 1.0.5 does not perform any capability or aut
CVE-2026-90558 9.8 0.00% 4 0 2026-09-12T18:30:33 sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attri
CVE-2026-90559 7.5 0.00% 2 0 2026-09-12T18:30:33 snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Sn
CVE-2026-90556 7.8 0.00% 2 0 2026-09-12T18:30:33 Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load()
CVE-2026-81742 8.8 0.28% 2 0 2026-09-12T18:30:22 The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any author
CVE-2026-80494 8.6 0.32% 2 0 2026-09-12T18:30:22 The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-suppli
CVE-2026-82845 9.9 0.35% 2 0 2026-09-12T18:30:22 The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied
CVE-2026-84099 8.1 0.27% 2 0 2026-09-12T18:30:22 The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthen
CVE-2026-90560 8.2 0.00% 2 0 2026-09-12T18:16:44.890000 zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerabi
CVE-2026-87888 8.0 0.23% 2 0 2026-09-12T16:16:42.897000 The YayPricing WordPress plugin before 3.5.7 does not perform an authorization
CVE-2026-87759 8.8 0.23% 4 0 2026-09-12T16:16:42.473000 The Add User Autocomplete WordPress plugin before 1.2 does not perform any capab
CVE-2026-85681 9.8 0.28% 4 0 2026-09-12T16:16:42.170000 The WP Component WordPress plugin through 2.2.4 does not have any capability or
CVE-2026-84047 8.6 0.26% 2 0 2026-09-12T16:16:41.527000 The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize
CVE-2026-81402 9.8 0.45% 2 0 2026-09-12T16:16:40.140000 The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability c
CVE-2026-80491 8.6 0.32% 2 0 2026-09-12T16:16:39.737000 The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and esc
CVE-2026-77006 9.6 0.18% 2 0 2026-09-12T16:16:38.670000 The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-sup
CVE-2026-77005 9.6 0.30% 2 0 2026-09-12T16:16:38.523000 The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a u
CVE-2026-15451 8.8 0.25% 2 0 2026-09-12T15:31:49 The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privile
CVE-2026-90537 8.2 0.21% 2 0 2026-09-12T15:31:49 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a m
CVE-2026-90553 7.8 0.21% 2 0 2026-09-12T13:16:53.887000 vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOn
CVE-2026-85706 10.0 1.16% 40 10 template 2026-09-12T12:30:50 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7
CVE-2026-78159 9.8 0.76% 6 0 2026-09-12T09:33:41 The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execut
CVE-2026-16482 7.5 0.34% 2 0 2026-09-12T09:33:41 The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulner
CVE-2026-78175 8.8 0.59% 2 0 2026-09-12T09:33:41 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul
CVE-2026-85200 7.5 0.76% 2 0 2026-09-12T09:33:36 The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all
CVE-2026-78006 9.8 0.78% 6 2 2026-09-12T08:16:24.240000 The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execut
CVE-2026-86093 7.5 0.47% 1 0 2026-09-12T04:16:45.040000 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker
CVE-2026-84869 9.9 0.69% 4 0 2026-09-12T04:16:42.757000 A condition in the ScreenConnect client may allow files to be transferred and ex
CVE-2026-42018 7.5 0.92% 9 1 2026-09-12T04:16:33.587000 JFrog Artifactory could return an internal anonymous-user token to an unauthenti
CVE-2026-42016 8.1 0.89% 6 0 2026-09-12T04:16:32.483000 JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a pri
CVE-2026-87719 9.9 0.61% 3 0 2026-09-12T03:30:28 GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 bef
CVE-2026-90456 None 0.25% 2 0 2026-09-12T00:31:35 An example environment-configuration file for a bundled inventory-management com
CVE-2026-89266 8.2 0.47% 2 0 2026-09-12T00:17:06.440000 stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where
CVE-2026-90460 0 0.34% 2 0 2026-09-11T22:16:48.243000 An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via
CVE-2026-49846 7.5 0.34% 1 0 2026-09-11T22:16:37.537000 libks provides foundational support for signalwire C products. Prior to version
CVE-2026-79393 7.5 0.53% 1 0 2026-09-11T21:31:22 A heap-based buffer overflow vulnerability in the WS-Addressing Action transform
CVE-2026-89260 7.5 0.43% 1 0 2026-09-11T21:17:58.153000 MoguBlog through 6.2 contains an XML external entity injection vulnerability in
CVE-2026-62112 7.6 0.28% 1 0 2026-09-11T21:17:02.457000 Editor SQL Injection in Amelia <= 2.4.9 versions.
CVE-2026-79395 9.8 0.41% 1 0 2026-09-11T20:18:54.030000 An improper authentication vulnerability in the WS-Security (wsse:UsernameToken)
CVE-2026-53952 9.8 0.33% 1 0 2026-09-11T20:17:14.060000 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the
CVE-2026-89262 7.5 0.31% 1 0 2026-09-11T18:31:32 MoguBlog through 6.2 contains an authorization bypass vulnerability in the comme
CVE-2026-19646 9.1 0.52% 1 0 2026-09-11T18:16:56.877000 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0
CVE-2026-86781 5.3 0.12% 1 0 2026-09-11T17:35:21.440000 The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin befor
CVE-2026-84890 5.9 0.25% 1 0 2026-09-11T16:55:29.047000 undici's decompress interceptor decompresses response bodies according to the un
CVE-2026-89176 8.8 0.25% 1 0 2026-09-11T16:17:50.073000 WeenyGenius, a computer lab management system developed by Howyar Technologies,
CVE-2026-87908 7.5 0.30% 1 0 2026-09-11T16:17:48.057000 multiparty is a Node.js library for parsing multipart/form-data request bodies.
CVE-2026-80462 10.0 0.30% 4 0 2026-09-11T15:32:48 A vulnerability in the Chef Automate API gateway and identity validation path ma
CVE-2026-47839 None 0.30% 1 0 2026-09-11T15:32:40 A vulnerability allows users authenticating through a federated OIDC provider to
CVE-2026-87020 8.1 0.56% 2 0 2026-09-11T15:17:06.937000 An integer overflow in a specified pitch and buffer-size computation leads to a
CVE-2026-82100 9.6 0.40% 1 0 2026-09-11T15:17:06.230000 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a
CVE-2026-80469 8.3 0.23% 1 0 2026-09-11T15:17:04.913000 An attacker may achieve arbitrary code execution on a target system by uploading
CVE-2026-71416 8.8 0.17% 1 0 2026-09-11T15:17:03.373000 Headroom compresses data before the data reaches a large language model. Prior t
CVE-2026-82107 9.6 0.36% 2 0 2026-09-11T14:56:50.613000 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a
CVE-2026-89212 8.6 0.33% 1 0 2026-09-11T14:17:36.847000 A flaw resulting in XML external entity (XXE) was found in Akana API Platform in
CVE-2026-81467 9.8 3.84% 1 0 2026-09-11T13:18:18.543000 Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutraliza
CVE-2026-86060 9.8 1.02% 1 1 2026-09-11T12:52:16.507000 RouterOS contains an argument-handling flaw in the SSH login path involving user
CVE-2026-89259 9.8 0.41% 1 0 2026-09-11T12:33:34 Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under N
CVE-2026-89178 8.8 0.23% 1 0 2026-09-11T09:31:31 WeenyGenius, a computer lab management system by Howyar Technologies, has an Ori
CVE-2026-89177 8.8 0.23% 1 0 2026-09-11T09:31:31 WeenyGenius, a computer lab management system by Howyar Technologies, has a Use
CVE-2026-89174 7.5 0.38% 1 0 2026-09-11T09:31:31 Smart Video Intercom System developed by Kingdom Communication Associated has a
CVE-2026-89060 7.7 0.23% 1 0 2026-09-11T06:31:14 A flaw was found in multicluster-observability-addon. This vulnerability allows
CVE-2026-8778 9.8 0.62% 1 0 2026-09-11T06:31:14 The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout
CVE-2026-77807 7.5 0.68% 1 0 2026-09-11T00:31:23 The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution
CVE-2026-81940 8.8 0.54% 1 0 2026-09-11T00:31:23 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacke
CVE-2026-84889 8.8 0.53% 1 0 2026-09-11T00:31:23 IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacke
CVE-2026-87958 8.1 0.21% 1 0 2026-09-11T00:31:16 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a deni
CVE-2026-88062 None 0.40% 1 0 2026-09-10T21:22:13 ## 2. Summary `POST /api/acp/agents` registers a custom ACP agent. The endpoint
CVE-2026-89094 9.9 0.50% 2 0 2026-09-10T21:17:53.160000 Forgejo before 16.0.4 allows remote code execution via a crafted template reposi
CVE-2026-65638 0 3.20% 3 0 2026-09-10T19:54:25.810000 Improper escaping of a request URL in ConfigServer Security & Firewall allows a
CVE-2026-65639 0 1.61% 1 0 2026-09-10T19:54:25.810000 OS command injection in the advanced-rule parser of ConfigServer Security & Fire
CVE-2026-80352 9.8 0.33% 1 0 2026-09-10T18:33:12 Improper Control of Generation of Code ('Code Injection') vulnerability in Apach
CVE-2026-19490 9.8 5.60% 2 2 2026-09-10T15:33:58 Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: f
CVE-2026-87491 8.8 0.86% 1 2 2026-09-10T12:49:02.630000 Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remo
CVE-2026-20079 10.0 75.75% 6 2 template 2026-09-10T12:48:17.580000 A vulnerability in the web interface of Cisco Secure Firewall Management Center
CVE-2025-25249 8.1 2.40% 2 0 2026-09-10T12:47:59.933000 A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6
CVE-2026-0310 None 0.34% 1 0 2026-09-10T06:31:55 A buffer overflow vulnerability in the XML processing functionality of Palo Alto
CVE-2026-50894 9.8 0.48% 1 0 2026-09-09T21:32:24 easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous T
CVE-2026-75170 6.1 0.24% 1 0 2026-09-09T21:32:23 Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoin
CVE-2026-38961 5.4 0.20% 1 0 2026-09-09T21:32:23 Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Pl
CVE-2026-75166 8.8 0.49% 1 0 2026-09-09T20:20:34.103000 Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_0
CVE-2026-71626 7.5 0.32% 1 0 2026-09-09T16:04:24.933000 An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive
CVE-2026-73324 6.5 0.33% 6 0 2026-09-09T15:35:16 VLC media player copies an RTSP response line into a fixed buffer without guaran
CVE-2026-56711 8.8 0.30% 6 0 2026-09-09T15:35:15 VLC media player computes the size of a picture buffer with 32-bit arithmetic an
CVE-2026-85103 9.8 0.36% 10 0 2026-09-09T15:35:15 A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unau
CVE-2026-85102 9.8 0.33% 10 0 2026-09-09T15:35:15 Improper certificate trust validation during VPN negotiation in Check Point Quan
CVE-2026-86218 9.8 0.74% 2 2 2026-09-09T05:18:19.490000 N-central is vulnerable to a pre-auth remote code execution This issue affects N
CVE-2026-85880 7.8 0.57% 1 0 2026-09-09T05:18:19.193000 Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elev
CVE-2026-86100 6.4 0.19% 1 0 2026-09-08T20:05:53.177000 Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when
CVE-2026-86426 0 1.41% 1 0 template 2026-09-08T19:57:49.663000 LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the RE
CVE-2026-78849 0 0.26% 1 0 2026-09-08T19:42:20.313000 Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <=
CVE-2026-69827 8.1 0.53% 1 0 2026-09-08T18:33:26 Concurrent execution using shared resource with improper synchronization ('race
CVE-2026-69730 9.8 1.05% 2 0 2026-09-08T18:33:07 Use after free in Windows DNS allows an unauthorized attacker to execute code ov
CVE-2026-13297 7.5 0.25% 1 0 2026-09-08T18:32:45 IBM Verify Identity Access Advanced Access Control may be vulnerable to an infor
CVE-2026-46636 0 0.36% 1 0 2026-09-08T18:17:37.770000 Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0
CVE-2026-78745 9.8 0.72% 1 1 2026-09-08T15:31:35 An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote
CVE-2026-85046 8.8 1.26% 1 8 2026-09-08T14:55:04.093000 Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote at
CVE-2026-80883 0 0.16% 1 0 2026-09-07T15:17:33.310000 In the Linux kernel, the following vulnerability has been resolved: drm/tegra:
CVE-2026-85636 5.3 0.43% 1 0 2026-09-04T18:31:46 A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerabi
CVE-2026-80909 None 0.17% 1 0 2026-09-04T18:31:46 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:
CVE-2026-80901 None 0.16% 1 0 2026-09-04T18:31:46 In the Linux kernel, the following vulnerability has been resolved: ipvs: fix t
CVE-2026-80890 None 0.18% 1 0 2026-09-04T18:31:46 In the Linux kernel, the following vulnerability has been resolved: sctp: rejec
CVE-2026-80907 None 0.16% 1 0 2026-09-04T18:31:46 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu:
CVE-2026-80880 None 0.16% 1 0 2026-09-04T18:31:40 In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Pr
CVE-2026-17444 5.3 0.29% 1 0 2026-09-04T18:31:40 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.
CVE-2026-17622 6.5 0.49% 1 0 2026-09-04T18:31:40 IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacke
CVE-2026-16689 6.2 0.11% 1 0 2026-09-04T18:31:39 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.
CVE-2026-80871 None 0.15% 1 0 2026-09-04T18:31:34 In the Linux kernel, the following vulnerability has been resolved: crypto: xil
CVE-2026-18073 4.4 0.10% 1 0 2026-09-04T18:31:31 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to injec
CVE-2026-80913 0 0.17% 1 0 2026-09-04T18:18:01.200000 In the Linux kernel, the following vulnerability has been resolved: selinux: re
CVE-2026-80912 0 0.16% 1 0 2026-09-04T18:18:01.047000 In the Linux kernel, the following vulnerability has been resolved: selinux: re
CVE-2026-80904 0 0.16% 1 0 2026-09-04T18:17:59.983000 In the Linux kernel, the following vulnerability has been resolved: net/tls: Fa
CVE-2026-80894 0 0.17% 1 0 2026-09-04T18:17:57.603000 In the Linux kernel, the following vulnerability has been resolved: iommufd: Fi
CVE-2026-20212 9.8 0.53% 1 1 2026-09-02T18:32:26 A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switc
CVE-2026-82329 9.8 7.67% 3 7 template 2026-09-02T18:31:57 JFrog Artifactory contains an authentication weakness that, under default config
CVE-2026-46331 7.8 0.58% 2 14 2026-09-02T13:17:55.903000 In the Linux kernel, the following vulnerability has been resolved: net/sched:
CVE-2026-81578 9.8 1.62% 1 2 2026-08-31T21:31:56 An improper access control vulnerability exists in the web management interface
CVE-2026-82078 9.1 1.69% 1 2 2026-08-31T21:31:56 An unsafe dynamic class loading vulnerability exists in the database connection
CVE-2026-59310 9.8 45.88% 2 2 2026-08-18T18:32:52 VMware vCenter contains a directory traversal vulnerability in the Syslog server
CVE-2026-50768 9.8 0.45% 1 0 2026-08-17T21:32:25 File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9
CVE-2026-61511 9.8 70.77% 2 5 template 2026-08-07T06:16:56.993000 vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vul
CVE-2026-20316 5.3 11.15% 1 0 2026-07-29T21:31:00 A vulnerability in the web interface of Cisco Secure Firewall Management Center
CVE-2026-50458 7.8 0.26% 2 0 2026-07-22T16:17:59.653000 Use after free in Microsoft Brokering File System allows an authorized attacker
CVE-2026-49176 7.8 0.47% 2 2 2026-07-22T16:17:28.753000 Improper privilege management in Windows WalletService allows an authorized atta
CVE-2026-15409 10.0 84.54% 1 6 template 2026-07-14T21:32:22 A Server-side request forgery (SSRF) vulnerability has been identified in the SM
CVE-2026-50013 7.5 0.27% 1 0 2026-07-14T18:03:10 ### Summary: When Hoverfly is running in Diff mode, the `AddDiff()` function wr
CVE-2026-54174 8.3 0.10% 1 0 2026-07-10T21:43:06 Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the
CVE-2026-52777 None 0.21% 1 0 2026-07-09T21:02:59 ## Details ### Sink `tools/bazar/services/CSVManager.php` line 372-399: ``` p
CVE-2026-57239 8.2 0.17% 2 1 2026-07-09T15:33:27 The user-controllable executable files will be directly executed by high-privile
CVE-2026-49464 8.1 0.20% 1 0 2026-07-08T21:12:01 ## Impact In versions from 1.5.0 up to and including 3.0.0, any authenticated p
CVE-2026-28576 5.5 0.15% 1 1 2026-06-17T16:43:32.927000 In Contacts Provider, there is a possible way to access the contacts database du
CVE-2024-1813 9.8 1.22% 2 1 2026-06-17T07:05:03.993000 The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection
CVE-2026-4986 5.3 0.20% 2 2 2026-06-09T15:33:16 The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity o
CVE-2026-39987 9.8 98.95% 1 25 template 2026-04-27T16:30:09 ## Summary Marimo (19.6k stars) has a Pre-Auth RCE vulnerability. The terminal
CVE-2026-20841 8.8 11.85% 1 14 2026-02-11T15:31:25 Improper neutralization of special elements used in a command ('command injectio
CVE-2026-51990 0 0.00% 6 1 N/A
CVE-2026-63030 0 97.27% 2 85 template N/A
CVE-2026-53761 0 0.34% 1 0 N/A
CVE-2026-53758 0 0.26% 1 0 N/A
CVE-2026-54135 0 0.55% 1 0 N/A
CVE-2026-89066 0 0.16% 1 0 N/A
CVE-2026-16338 0 0.00% 1 0 N/A
CVE-2026-70416 0 0.00% 1 0 N/A
CVE-2026-63695 0 0.00% 1 0 N/A

CVE-2026-29811
(7.7 HIGH)

EPSS: 0.00%

updated 2026-09-13T20:16:51.020000

2 posts

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

thehackerwire@mastodon.social at 2026-09-13T20:59:49.000Z ##

🟠 CVE-2026-29811 - High (7.7)

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T20:59:49.000Z ##

🟠 CVE-2026-29811 - High (7.7)

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90783
(7.8 HIGH)

EPSS: 0.00%

updated 2026-09-13T15:30:28

2 posts

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an undersized heap allocation, allowing a heap buffer overflow when the file is parsed with mkvmerge.

thehackerwire@mastodon.social at 2026-09-13T13:59:47.000Z ##

🟠 CVE-2026-90783 - High (7.8)

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an unde...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T13:59:47.000Z ##

🟠 CVE-2026-90783 - High (7.8)

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an unde...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90510
(8.3 HIGH)

EPSS: 0.00%

updated 2026-09-13T12:31:19

2 posts

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key . The attack is possible to b

thehackerwire@mastodon.social at 2026-09-13T14:00:49.000Z ##

🟠 CVE-2026-90510 - High (8.3)

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/drom...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T14:00:49.000Z ##

🟠 CVE-2026-90510 - High (8.3)

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/drom...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90775
(6.5 MEDIUM)

EPSS: 0.00%

updated 2026-09-13T12:31:19

2 posts

PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.

offseq at 2026-09-13T13:30:23.119Z ##

CVE-2026-90775: HIGH severity vuln in PostGIS address_standardizer (≤3.7.0) allows out-of-bounds read via unvalidated Weight parameter, crashing PostgreSQL backend (DoS). Patch status pending — monitor vendor updates. radar.offseq.com/threat/cve-20

##

offseq@infosec.exchange at 2026-09-13T13:30:23.000Z ##

CVE-2026-90775: HIGH severity vuln in PostGIS address_standardizer (≤3.7.0) allows out-of-bounds read via unvalidated Weight parameter, crashing PostgreSQL backend (DoS). Patch status pending — monitor vendor updates. radar.offseq.com/threat/cve-20 #OffSeq #PostGIS #Vuln

##

CVE-2026-90778
(7.5 HIGH)

EPSS: 0.00%

updated 2026-09-13T12:31:19

2 posts

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.

thehackerwire@mastodon.social at 2026-09-13T13:01:05.000Z ##

🟠 CVE-2026-90778 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag para...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T13:01:05.000Z ##

🟠 CVE-2026-90778 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag para...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90776
(7.5 HIGH)

EPSS: 0.00%

updated 2026-09-13T12:31:19

2 posts

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service.

thehackerwire@mastodon.social at 2026-09-13T13:00:15.000Z ##

🟠 CVE-2026-90776 - High (7.5)

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T13:00:15.000Z ##

🟠 CVE-2026-90776 - High (7.5)

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90772
(7.6 HIGH)

EPSS: 0.00%

updated 2026-09-13T12:31:19

2 posts

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.

thehackerwire@mastodon.social at 2026-09-13T12:02:42.000Z ##

🟠 CVE-2026-90772 - High (7.6)

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T12:02:42.000Z ##

🟠 CVE-2026-90772 - High (7.6)

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90770
(8.8 HIGH)

EPSS: 0.00%

updated 2026-09-13T12:31:12

2 posts

Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/run_test/ endpoint to execute arbitrary commands as the Spug process user.

thehackerwire@mastodon.social at 2026-09-13T12:02:32.000Z ##

🟠 CVE-2026-90770 - High (8.8)

Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T12:02:32.000Z ##

🟠 CVE-2026-90770 - High (8.8)

Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90768
(8.1 HIGH)

EPSS: 0.00%

updated 2026-09-13T12:31:12

2 posts

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.

thehackerwire@mastodon.social at 2026-09-13T12:01:09.000Z ##

🟠 CVE-2026-90768 - High (8.1)

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T12:01:09.000Z ##

🟠 CVE-2026-90768 - High (8.1)

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90562
(8.1 HIGH)

EPSS: 0.00%

updated 2026-09-13T12:31:11

4 posts

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.

thehackerwire@mastodon.social at 2026-09-13T13:01:27.000Z ##

🟠 CVE-2026-90562 - High (8.1)

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through con...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq at 2026-09-13T12:00:24.616Z ##

LangBot <4.10.11 is affected by CRITICAL CVE-2026-90562: password reset keys generated with only 24 bits of entropy & no rate limiting let attackers brute-force admin resets. Upgrade to 4.10.11+! radar.offseq.com/threat/cve-20

##

thehackerwire@mastodon.social at 2026-09-13T13:01:27.000Z ##

🟠 CVE-2026-90562 - High (8.1)

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through con...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-09-13T12:00:24.000Z ##

LangBot <4.10.11 is affected by CRITICAL CVE-2026-90562: password reset keys generated with only 24 bits of entropy & no rate limiting let attackers brute-force admin resets. Upgrade to 4.10.11+! radar.offseq.com/threat/cve-20 #OffSeq #CVE202690562 #infosec #AppSec

##

CVE-2026-90780
(7.5 HIGH)

EPSS: 0.00%

updated 2026-09-13T12:17:17.093000

2 posts

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages with oversized headers to overflow the static buffer and crash the process.

thehackerwire@mastodon.social at 2026-09-13T13:00:04.000Z ##

🟠 CVE-2026-90780 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T13:00:04.000Z ##

🟠 CVE-2026-90780 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90779
(7.5 HIGH)

EPSS: 0.00%

updated 2026-09-13T12:17:16.960000

2 posts

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process.

thehackerwire@mastodon.social at 2026-09-13T13:01:17.000Z ##

🟠 CVE-2026-90779 - High (7.5)

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt th...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T13:01:17.000Z ##

🟠 CVE-2026-90779 - High (7.5)

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt th...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90777
(8.8 HIGH)

EPSS: 0.00%

updated 2026-09-13T12:17:16.690000

2 posts

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deserialization when loaded through the initialization or fine-tuning path.

thehackerwire@mastodon.social at 2026-09-13T13:00:25.000Z ##

🟠 CVE-2026-90777 - High (8.8)

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deseri...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T13:00:25.000Z ##

🟠 CVE-2026-90777 - High (8.8)

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deseri...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90774
(7.5 HIGH)

EPSS: 0.00%

updated 2026-09-13T11:17:02.163000

2 posts

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.

thehackerwire@mastodon.social at 2026-09-13T12:00:58.000Z ##

🟠 CVE-2026-90774 - High (7.5)

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write f...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T12:00:58.000Z ##

🟠 CVE-2026-90774 - High (7.5)

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write f...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90769
(7.7 HIGH)

EPSS: 0.00%

updated 2026-09-13T11:17:01.270000

2 posts

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests.

thehackerwire@mastodon.social at 2026-09-13T12:01:20.000Z ##

🟠 CVE-2026-90769 - High (7.7)

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T12:01:20.000Z ##

🟠 CVE-2026-90769 - High (7.7)

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90561
(8.7 HIGH)

EPSS: 0.00%

updated 2026-09-13T11:17:00.613000

2 posts

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.

thehackerwire@mastodon.social at 2026-09-13T12:02:51.000Z ##

🟠 CVE-2026-90561 - High (8.7)

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious s...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T12:02:51.000Z ##

🟠 CVE-2026-90561 - High (8.7)

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious s...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89080
(7.5 HIGH)

EPSS: 0.00%

updated 2026-09-13T11:16:59.650000

2 posts

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the second factor and obtain that user's session, up to administrator.

thehackerwire@mastodon.social at 2026-09-13T14:01:09.000Z ##

🟠 CVE-2026-89080 - High (7.5)

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the sec...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T14:01:09.000Z ##

🟠 CVE-2026-89080 - High (7.5)

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the sec...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-86406
(7.5 HIGH)

EPSS: 0.00%

updated 2026-09-13T11:16:58.793000

2 posts

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role attached to a paid plan without paying for it. Where the site owner has mapped a plan to a privileged ro

thehackerwire@mastodon.social at 2026-09-13T14:00:58.000Z ##

🟠 CVE-2026-86406 - High (7.5)

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T14:00:58.000Z ##

🟠 CVE-2026-86406 - High (7.5)

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89767
(7.8 HIGH)

EPSS: 0.15%

updated 2026-09-13T09:33:34

2 posts

In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-mismatch path ovl_create_real() releases the new dentry twice when the casefold consistency check fails. The S_IFDIR branch calls end_creating() and sets err, then falls through to the common out: label which calls end_creating() on the same dentry again: case S_IFDIR: newdentr

thehackerwire@mastodon.social at 2026-09-13T09:59:56.000Z ##

🟠 CVE-2026-89767 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix double end_creating() on the casefold-mismatch path

ovl_create_real() releases the new dentry twice when the casefold
consistency check fails. The S_IFDIR branch calls...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T09:59:56.000Z ##

🟠 CVE-2026-89767 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix double end_creating() on the casefold-mismatch path

ovl_create_real() releases the new dentry twice when the casefold
consistency check fails. The S_IFDIR branch calls...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89763
(7.8 HIGH)

EPSS: 0.11%

updated 2026-09-13T09:33:34

2 posts

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type_lookup() holds key_types_sem for reading until the key operation finishes, while unregister_key_type() takes it for writing. It therefore provides the synchroniza

thehackerwire@mastodon.social at 2026-09-13T09:00:39.000Z ##

🟠 CVE-2026-89763 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix TPM teardown ordering

trusted_tpm_exit() drops the TPM chip reference and frees the digest
array before unregistering the trusted key type. key_type_lookup()
...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T09:00:39.000Z ##

🟠 CVE-2026-89763 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix TPM teardown ordering

trusted_tpm_exit() drops the TPM chip reference and frees the digest
array before unregistering the trusted key type. key_type_lookup()
...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89771
(7.8 HIGH)

EPSS: 0.12%

updated 2026-09-13T09:32:31

2 posts

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can simultaneously be resized with ring_buffer_subbuf_order_set(). Instead of trace_buffer::subbuf_size, use bpage::order in ring_buffer_read_start() and ring_b

thehackerwire@mastodon.social at 2026-09-13T07:59:52.000Z ##

🟠 CVE-2026-89771 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix subbuf resize race with ring buffer readers

trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and
ring_buffer_read_start(), while it can simu...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T07:59:52.000Z ##

🟠 CVE-2026-89771 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix subbuf resize race with ring buffer readers

trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and
ring_buffer_read_start(), while it can simu...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89750
(7.8 HIGH)

EPSS: 0.16%

updated 2026-09-13T09:32:30

2 posts

In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Clear copied tracing state before fork duplication dup_task_struct() copies user_event_mm from the parent into the child, without grabbing a reference to it. user_event_mm_dup() should replace it, but it leaves that copied pointer unmodified if user_event_mm_alloc() fails. When the child exits, user_event_m

thehackerwire@mastodon.social at 2026-09-13T16:01:19.000Z ##

🟠 CVE-2026-89750 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing/user_events: Clear copied tracing state before fork duplication

dup_task_struct() copies user_event_mm from the parent into the child,
without grabbing a reference to it...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T16:01:19.000Z ##

🟠 CVE-2026-89750 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing/user_events: Clear copied tracing state before fork duplication

dup_task_struct() copies user_event_mm from the parent into the child,
without grabbing a reference to it...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89748
(7.8 HIGH)

EPSS: 0.15%

updated 2026-09-13T09:32:30

2 posts

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero, while a failed replacement leaves it at -1. The current !retry test re

thehackerwire@mastodon.social at 2026-09-13T16:01:07.000Z ##

🟠 CVE-2026-89748 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix retry exhaustion in simple ring buffer reader swap

simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
post-decrements it only after a failed link ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T16:01:07.000Z ##

🟠 CVE-2026-89748 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix retry exhaustion in simple ring buffer reader swap

simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
post-decrements it only after a failed link ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89747
(7.8 HIGH)

EPSS: 0.16%

updated 2026-09-13T09:32:30

2 posts

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(), which frees every sub-buffer of the ring buffer, including the reader page, and replaces them with newly allocated ones. Readers of trace_pipe hold pointers into those pages. ring_buff

thehackerwire@mastodon.social at 2026-09-13T16:00:55.000Z ##

🟠 CVE-2026-89747 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(),
which frees every sub-buffer of ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T16:00:55.000Z ##

🟠 CVE-2026-89747 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(),
which frees every sub-buffer of ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89746
(7.8 HIGH)

EPSS: 0.16%

updated 2026-09-13T09:32:30

2 posts

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_re

thehackerwire@mastodon.social at 2026-09-13T15:00:53.000Z ##

🟠 CVE-2026-89746 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free with same-name named triggers

When two hist triggers on different events are registered with the same
name=, the second one reuses the first as named...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T15:00:53.000Z ##

🟠 CVE-2026-89746 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free with same-name named triggers

When two hist triggers on different events are registered with the same
name=, the second one reuses the first as named...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89754
(7.8 HIGH)

EPSS: 0.12%

updated 2026-09-13T09:32:30

2 posts

In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is retried. The PMD entry may be cleared at the point of retry. In this case, if walk->ops->install_pte is not specified, the code continues to the next PMD entry in the range without resetting

thehackerwire@mastodon.social at 2026-09-13T10:00:06.000Z ##

🟠 CVE-2026-89754 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/pagewalk: fix stale walk->action escaping walk_pmd_range()

If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is
retried. The PMD entry may be cleared a...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T10:00:06.000Z ##

🟠 CVE-2026-89754 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/pagewalk: fix stale walk->action escaping walk_pmd_range()

If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is
retried. The PMD entry may be cleared a...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89762
(7.8 HIGH)

EPSS: 0.12%

updated 2026-09-13T09:32:30

2 posts

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begin_current_label_crit_section() AppArmor's begin_current_label_crit_section() is a scary function called from lots of LSM hooks (in particular VFS/socket-related ones) that checks if the label referenced by the current creds is marked FLAG_STALE, and if so, attempts to use aa_replace_current_l

thehackerwire@mastodon.social at 2026-09-13T09:00:24.000Z ##

🟠 CVE-2026-89762 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix cred UAF caused by begin_current_label_crit_section()

AppArmor's begin_current_label_crit_section() is a scary function called
from lots of LSM hooks (in particula...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T09:00:24.000Z ##

🟠 CVE-2026-89762 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix cred UAF caused by begin_current_label_crit_section()

AppArmor's begin_current_label_crit_section() is a scary function called
from lots of LSM hooks (in particula...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89761
(7.8 HIGH)

EPSS: 0.12%

updated 2026-09-13T09:32:30

2 posts

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix out-of-bounds write when null terminating a label vec aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE is passed. If the components are all distinct no duplicates are dropped, dups is 0 and the terminator goes to vec[n], so the caller has to provide room for n + 1 entries. aa_label_strn_par

thehackerwire@mastodon.social at 2026-09-13T08:00:11.000Z ##

🟠 CVE-2026-89761 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix out-of-bounds write when null terminating a label vec

aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE
is passed. If the components are all...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T08:00:11.000Z ##

🟠 CVE-2026-89761 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix out-of-bounds write when null terminating a label vec

aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE
is passed. If the components are all...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89736
(7.8 HIGH)

EPSS: 0.12%

updated 2026-09-13T09:32:29

2 posts

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix use-after-free on sound card disconnect g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound card teardown and immediately frees the underlying struct snd_uac_chip context. However, snd_card_free_when_closed() returns asynchronously while ALSA control elements (kctls) remain open in u

thehackerwire@mastodon.social at 2026-09-13T17:00:05.000Z ##

🟠 CVE-2026-89736 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_audio: Fix use-after-free on sound card disconnect

g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
card teardown and immediately frees the...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T17:00:05.000Z ##

🟠 CVE-2026-89736 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_audio: Fix use-after-free on sound card disconnect

g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
card teardown and immediately frees the...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89764
(7.8 HIGH)

EPSS: 0.14%

updated 2026-09-13T07:17:40.843000

2 posts

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU. The revoker that does not claim the is_

thehackerwire@mastodon.social at 2026-09-13T09:00:51.000Z ##

🟠 CVE-2026-89764 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

rust: devres: fix race between concurrent revokers

There is a potential race condition when two paths try to revoke a
Devres concurrently.

The driver core's devres_release_all(...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T09:00:51.000Z ##

🟠 CVE-2026-89764 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

rust: devres: fix race between concurrent revokers

There is a potential race condition when two paths try to revoke a
Devres concurrently.

The driver core's devres_release_all(...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89760
(7.8 HIGH)

EPSS: 0.11%

updated 2026-09-13T07:17:40.307000

2 posts

In the Linux kernel, the following vulnerability has been resolved: mm, swap: don't free a hibernation slot that is in the swap cache A slot with a folio in the swap cache is freed when the folio leaves the cache, not when its count drops. swap_put_entries_cluster() follows that rule. swap_free_hibernation_slot() does not, it calls __swap_cluster_free_entries() whether or not a folio sits on t

thehackerwire@mastodon.social at 2026-09-13T08:00:01.000Z ##

🟠 CVE-2026-89760 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm, swap: don't free a hibernation slot that is in the swap cache

A slot with a folio in the swap cache is freed when the folio leaves the
cache, not when its count drops. swap...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T08:00:01.000Z ##

🟠 CVE-2026-89760 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm, swap: don't free a hibernation slot that is in the swap cache

A slot with a folio in the swap cache is freed when the folio leaves the
cache, not when its count drops. swap...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89758
(7.8 HIGH)

EPSS: 0.14%

updated 2026-09-13T07:17:40.190000

2 posts

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe ("mm/huge_memory: add device-private THP support to PMD operations") a PMD may hold a device-private swap entry whenever an HMM-based GPU driver migrates an anonymous THP folio

thehackerwire@mastodon.social at 2026-09-13T15:00:31.000Z ##

🟠 CVE-2026-89758 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: skip non-present PMDs when queueing folios

Patch series "mm: handle device-private PMDs in walk callbacks", v3.

Since commit 368076f52ebe ("mm/huge_memory: add de...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T15:00:31.000Z ##

🟠 CVE-2026-89758 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: skip non-present PMDs when queueing folios

Patch series "mm: handle device-private PMDs in walk callbacks", v3.

Since commit 368076f52ebe ("mm/huge_memory: add de...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89755
(7.8 HIGH)

EPSS: 0.14%

updated 2026-09-13T07:17:39.983000

2 posts

In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: clear stale mapping after freeing swapcache __migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap() succeeds, the folio is removed from the swap cache, but the saved mapping still points to swap_space. Passing the stale mapping to folio_migrate_mapping() make

thehackerwire@mastodon.social at 2026-09-13T10:00:16.000Z ##

🟠 CVE-2026-89755 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate_device: clear stale mapping after freeing swapcache

__migrate_device_pages() reads the folio mapping before calling
folio_free_swap(). When folio_free_swap() succeed...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T10:00:16.000Z ##

🟠 CVE-2026-89755 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate_device: clear stale mapping after freeing swapcache

__migrate_device_pages() reads the folio mapping before calling
folio_free_swap(). When folio_free_swap() succeed...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89744
(8.4 HIGH)

EPSS: 0.14%

updated 2026-09-13T07:17:39.073000

2 posts

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can enter an infinite loop if the secondary fwnode has more than one child. Parent Child (Primary fwnode) FWa: {FWa1, FWa2, F

thehackerwire@mastodon.social at 2026-09-13T15:00:42.000Z ##

🟠 CVE-2026-89744 - High (8.4)

In the Linux kernel, the following vulnerability has been resolved:

device property: fix infinite loop in fwnode_for_each_child_node()

When iterate over children of a fwnode that has a secondary fwnode,
fwnode_get_next_child_node() can enter an ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T15:00:42.000Z ##

🟠 CVE-2026-89744 - High (8.4)

In the Linux kernel, the following vulnerability has been resolved:

device property: fix infinite loop in fwnode_for_each_child_node()

When iterate over children of a fwnode that has a secondary fwnode,
fwnode_get_next_child_node() can enter an ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89706
(7.5 HIGH)

EPSS: 0.44%

updated 2026-09-13T07:17:36.240000

2 posts

In the Linux kernel, the following vulnerability has been resolved: nfsd: Reset write verifier when async COPY writeback fails Async COPY captures nn->writeverf at request time and reports it to the client via CB_OFFLOAD after the worker kthread completes. When the post-copy vfs_fsync_range() or filemap_check_wb_err() in _nfsd_copy_file_range() reports an error, the worker correctly leaves NFSD4

thehackerwire@mastodon.social at 2026-09-13T18:00:07.000Z ##

🟠 CVE-2026-89706 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Reset write verifier when async COPY writeback fails

Async COPY captures nn->writeverf at request time and reports it to
the client via CB_OFFLOAD after the worker kthread...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T18:00:07.000Z ##

🟠 CVE-2026-89706 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Reset write verifier when async COPY writeback fails

Async COPY captures nn->writeverf at request time and reports it to
the client via CB_OFFLOAD after the worker kthread...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89704
(7.5 HIGH)

EPSS: 0.44%

updated 2026-09-13T07:17:35.990000

2 posts

In the Linux kernel, the following vulnerability has been resolved: nfsd: sample writeback error cursor before async COPY loop _nfsd_copy_file_range() samples dst->f_wb_err into "since" after the copy loop, then uses it to detect writeback errors via filemap_check_wb_err() once vfs_fsync_range() returns. Because the nfsd_file cache reuses a single struct file across requests targeting the same i

thehackerwire@mastodon.social at 2026-09-13T17:59:56.000Z ##

🟠 CVE-2026-89704 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: sample writeback error cursor before async COPY loop

_nfsd_copy_file_range() samples dst->f_wb_err into "since"
after the copy loop, then uses it to detect writeback error...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T17:59:56.000Z ##

🟠 CVE-2026-89704 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: sample writeback error cursor before async COPY loop

_nfsd_copy_file_range() samples dst->f_wb_err into "since"
after the copy loop, then uses it to detect writeback error...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89697
(9.1 CRITICAL)

EPSS: 0.60%

updated 2026-09-13T07:17:35.480000

2 posts

In the Linux kernel, the following vulnerability has been resolved: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare() can inspect the dentry. This causes nfsd_setattr() to skip fh_want_write(), so notify_change() runs without a mount write reference. Add the missing fh_want_write() call after the ear

thehackerwire@mastodon.social at 2026-09-13T19:59:53.000Z ##

🔴 CVE-2026-89697 - Critical (9.1)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()
can inspect the dentry. This ca...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T19:59:53.000Z ##

🔴 CVE-2026-89697 - Critical (9.1)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()
can inspect the dentry. This ca...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89696
(7.5 HIGH)

EPSS: 0.67%

updated 2026-09-13T07:17:35.343000

2 posts

In the Linux kernel, the following vulnerability has been resolved: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return success with fh_dentry and fh_export both NULL if fh_verify() returns nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag is set, but the compound dispatch loop only uses this

thehackerwire@mastodon.social at 2026-09-13T19:00:21.000Z ##

🟠 CVE-2026-89696 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return
success with fh_dentry and fh_export bo...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T19:00:21.000Z ##

🟠 CVE-2026-89696 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return
success with fh_dentry and fh_export bo...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89695
(7.5 HIGH)

EPSS: 0.49%

updated 2026-09-13T07:17:35.230000

2 posts

In the Linux kernel, the following vulnerability has been resolved: nfsd: cap decoded POSIX ACL count to bound sort cost nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes it straight to posix_acl_alloc() and sort_pacl_range(). The latter is an O(n^2) bubble sort, so a client-chosen count drives unbounded CPU in the server's compound processing path. nfsd4_decode_posixa

thehackerwire@mastodon.social at 2026-09-13T19:00:11.000Z ##

🟠 CVE-2026-89695 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: cap decoded POSIX ACL count to bound sort cost

nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes
it straight to posix_acl_alloc() and sort_pacl_range...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T19:00:11.000Z ##

🟠 CVE-2026-89695 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: cap decoded POSIX ACL count to bound sort cost

nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes
it straight to posix_acl_alloc() and sort_pacl_range...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89692
(7.5 HIGH)

EPSS: 0.43%

updated 2026-09-13T07:17:35.107000

2 posts

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue nfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit at entry to serialize recall work, then calls nfsd4_run_cb() to queue the recall. When the queue attempt fails the refcount bump is undone, but the RUNNING bit is left set. The only site that c

thehackerwire@mastodon.social at 2026-09-13T19:00:01.000Z ##

🟠 CVE-2026-89692 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

nfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit
at entry to serialize recall work, then ca...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T19:00:01.000Z ##

🟠 CVE-2026-89692 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

nfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit
at entry to serialize recall work, then ca...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89690
(7.8 HIGH)

EPSS: 0.16%

updated 2026-09-13T07:17:34.850000

2 posts

In the Linux kernel, the following vulnerability has been resolved: nfsd: defer vfree of compound ops to fix rpc_status UAF The rpc_status netlink dumpit walks every in-flight svc_rqst under rcu_read_lock and, for NFSv4 requests, reads opnums out of args->ops[]. But args->ops is a separate vmalloc buffer freed synchronously by vfree() in nfsd4_release_compoundargs() at the end of every compound.

thehackerwire@mastodon.social at 2026-09-13T18:00:20.000Z ##

🟠 CVE-2026-89690 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: defer vfree of compound ops to fix rpc_status UAF

The rpc_status netlink dumpit walks every in-flight svc_rqst under
rcu_read_lock and, for NFSv4 requests, reads opnums ou...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T18:00:20.000Z ##

🟠 CVE-2026-89690 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: defer vfree of compound ops to fix rpc_status UAF

The rpc_status netlink dumpit walks every in-flight svc_rqst under
rcu_read_lock and, for NFSv4 requests, reads opnums ou...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89684
(7.5 HIGH)

EPSS: 0.45%

updated 2026-09-13T07:17:34.130000

2 posts

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix cpntf publish race in nfs4_init_cp_state nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry is reachable by so_id but cp_list is still {NULL,NULL}

thehackerwire@mastodon.social at 2026-09-13T20:00:13.000Z ##

🟠 CVE-2026-89684 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix cpntf publish race in nfs4_init_cp_state

nfs4_alloc_init_cpntf_state() published the new cpntf entry into the
s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T20:00:13.000Z ##

🟠 CVE-2026-89684 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix cpntf publish race in nfs4_init_cp_state

nfs4_alloc_init_cpntf_state() published the new cpntf entry into the
s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89682
(8.1 HIGH)

EPSS: 0.40%

updated 2026-09-13T07:17:34.003000

2 posts

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads via a per-net freeme queue, preventing the shrinker and GC worker from bearing the cost of closing files (see ffb402596147). However, the queue lives in a separately-allocated struct nfsd_

thehackerwire@mastodon.social at 2026-09-13T20:00:03.000Z ##

🟠 CVE-2026-89682 - High (8.1)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads
via a per-net freeme queue, preventi...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T20:00:03.000Z ##

🟠 CVE-2026-89682 - High (8.1)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads
via a per-net freeme queue, preventi...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-81000
(7.8 HIGH)

EPSS: 0.16%

updated 2026-09-13T07:17:06.600000

2 posts

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the re

offseq at 2026-09-12T01:30:23.675Z ##

CVE-2026-81000: Linux kernel TUN driver HIGH severity vulnerability fixed. Flaw in skb headroom calculation could trigger memory corruption. Update to patched kernel ASAP. 🐧 radar.offseq.com/threat/in-the

##

offseq@infosec.exchange at 2026-09-12T01:30:23.000Z ##

CVE-2026-81000: Linux kernel TUN driver HIGH severity vulnerability fixed. Flaw in skb headroom calculation could trigger memory corruption. Update to patched kernel ASAP. 🐧 radar.offseq.com/threat/in-the #OffSeq #Linux #Vulnerability #BlueTeam

##

CVE-2026-80995
(7.8 HIGH)

EPSS: 0.12%

updated 2026-09-13T07:17:06.230000

2 posts

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctp_route_lookup() mctp_route_lookup() uses rt->dev without holding a reference on it. mctp_route_lookup_single() returns the route under RCU only, so the route's device can be torn down concurrently: mctp_dev_put() drops the last reference and synchronously kfree()s mdev->addr

offseq at 2026-09-12T04:30:24.311Z ##

CVE-2026-80995: HIGH severity use-after-free in Linux kernel MCTP code lets unprivileged users trigger memory corruption or DoS. Fix: update to patched kernel when released. Details: radar.offseq.com/threat/in-the

##

offseq@infosec.exchange at 2026-09-12T04:30:24.000Z ##

CVE-2026-80995: HIGH severity use-after-free in Linux kernel MCTP code lets unprivileged users trigger memory corruption or DoS. Fix: update to patched kernel when released. Details: radar.offseq.com/threat/in-the #OffSeq #Linux #Infosec #CVE #Vulnerability

##

CVE-2026-80981
(9.8 CRITICAL)

EPSS: 0.59%

updated 2026-09-13T07:17:05

2 posts

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() smc_llc_srv_add_link() keeps add_llc pointing into the queue entry: add_llc = &qentry->msg.add_link; smc_llc.c:1482 ... smc_llc_save_add_link_info(link_new, add_llc); smc_llc.c:1494 smc_llc_flow_qentry_del(&lgr->llc_flow_lcl); smc_llc.c:1495 ..

offseq at 2026-09-12T06:00:24.830Z ##

CVE-2026-80981: Linux kernel net/smc HIGH severity use-after-free in smc_llc_srv_add_link(). Risk of memory corruption & escalation. Patch when available! Details: radar.offseq.com/threat/in-the

##

offseq@infosec.exchange at 2026-09-12T06:00:24.000Z ##

CVE-2026-80981: Linux kernel net/smc HIGH severity use-after-free in smc_llc_srv_add_link(). Risk of memory corruption & escalation. Patch when available! Details: radar.offseq.com/threat/in-the #OffSeq #Linux #Infosec #Vulnerability

##

CVE-2026-90678
(7.5 HIGH)

EPSS: 0.00%

updated 2026-09-13T04:17:25.227000

2 posts

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length

thehackerwire@mastodon.social at 2026-09-13T05:00:08.000Z ##

🟠 CVE-2026-90678 - High (7.5)

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reac...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T05:00:08.000Z ##

🟠 CVE-2026-90678 - High (7.5)

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reac...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90668
(7.5 HIGH)

EPSS: 0.00%

updated 2026-09-13T03:30:22

3 posts

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default).

unrealircd@fosstodon.org at 2026-09-13T14:23:39.000Z ##

The UnrealIRCd security issue from yesterday was assigned CVE-2026-90668. Admins on older versions could apply a hot-patch to fix the issue without restart.

We have been doing that at UnrealIRCd for more than 20 years now, so I wrote a story on my personal blog about how effective it is, and the times it did not work: vulnscan.org/why-hot-patching-

#IRC #infosec

##

thehackerwire@mastodon.social at 2026-09-13T02:59:48.000Z ##

🟠 CVE-2026-90668 - High (7.5)

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unl...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T02:59:48.000Z ##

🟠 CVE-2026-90668 - High (7.5)

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unl...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90493
(8.8 HIGH)

EPSS: 0.00%

updated 2026-09-13T03:30:22

4 posts

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls. Attacking locally is a requirement. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond

thehackerwire@mastodon.social at 2026-09-13T05:00:17.000Z ##

🟠 CVE-2026-90493 - High (8.8)

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq at 2026-09-13T04:30:23.428Z ##

Tonec Internet Download Manager <=6.42.63 hit by CRITICAL vuln (CVE-2026-90493) in idmwfp.sys — improper access controls enable local privilege escalation. Public exploit code, no patch yet. Restrict local access & monitor. radar.offseq.com/threat/cve-20

##

thehackerwire@mastodon.social at 2026-09-13T05:00:17.000Z ##

🟠 CVE-2026-90493 - High (8.8)

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-09-13T04:30:23.000Z ##

Tonec Internet Download Manager <=6.42.63 hit by CRITICAL vuln (CVE-2026-90493) in idmwfp.sys — improper access controls enable local privilege escalation. Public exploit code, no patch yet. Restrict local access & monitor. radar.offseq.com/threat/cve-20 #OffSeq #CVE202690493 #Vuln #Cybersecurity

##

CVE-2026-90648(CVSS UNKNOWN)

EPSS: 0.00%

updated 2026-09-13T00:31:26

2 posts

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When the funcref table allocation fails, table->data is left NULL while table->size keeps the guest-declared element count; thus,

offseq at 2026-09-13T09:00:26.724Z ##

CVE-2026-90648: HIGH severity vuln in wasm2c (WebAssembly wabt <=1.0.41). Unchecked calloc() return enables sandbox escape & code exec if allocation fails — mainly on 32-bit/memory-limited systems. Patch status pending. radar.offseq.com/threat/cve-20

##

offseq@infosec.exchange at 2026-09-13T09:00:26.000Z ##

CVE-2026-90648: HIGH severity vuln in wasm2c (WebAssembly wabt <=1.0.41). Unchecked calloc() return enables sandbox escape & code exec if allocation fails — mainly on 32-bit/memory-limited systems. Patch status pending. radar.offseq.com/threat/cve-20 #OffSeq #WebAssembly #CVE202690648

##

CVE-2026-90647
(7.4 HIGH)

EPSS: 0.00%

updated 2026-09-13T00:31:26

2 posts

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.

offseq at 2026-09-13T00:00:35.847Z ##

CVE-2026-90647 (CRITICAL, CVSS 9.1) affects Kalkitech ASE2000 V2 (2.35 – 2.37): improper TLS certificate validation in IEC 60870-5-104 enables MitM attacks. No patch confirmed. Restrict access & monitor. radar.offseq.com/threat/cve-20

##

offseq@infosec.exchange at 2026-09-13T00:00:35.000Z ##

CVE-2026-90647 (CRITICAL, CVSS 9.1) affects Kalkitech ASE2000 V2 (2.35 – 2.37): improper TLS certificate validation in IEC 60870-5-104 enables MitM attacks. No patch confirmed. Restrict access & monitor. radar.offseq.com/threat/cve-20 #OffSeq #ICS #CVE202690647 #TLS

##

CVE-2026-90651
(8.1 HIGH)

EPSS: 0.00%

updated 2026-09-13T00:17:07.203000

4 posts

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client used for outbound requests accepts an

offseq at 2026-09-13T07:30:23.959Z ##

CVE-2026-90651 | HIGH severity in Socket Socket Firewall <2.0.0: TLS certs not validated by default — MITM risk. Set api_ssl_verify and upstream_ssl_verify to true & patch configs or upgrade to 2.0.0+. radar.offseq.com/threat/cve-20

##

thehackerwire@mastodon.social at 2026-09-13T00:59:47.000Z ##

🟠 CVE-2026-90651 - High (8.1)

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-09-13T07:30:23.000Z ##

CVE-2026-90651 | HIGH severity in Socket Socket Firewall <2.0.0: TLS certs not validated by default — MITM risk. Set api_ssl_verify and upstream_ssl_verify to true & patch configs or upgrade to 2.0.0+. radar.offseq.com/threat/cve-20 #OffSeq #vuln #infosec #supplychain

##

thehackerwire@mastodon.social at 2026-09-13T00:59:47.000Z ##

🟠 CVE-2026-90651 - High (8.1)

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90616
(7.4 HIGH)

EPSS: 0.00%

updated 2026-09-12T20:16:30.957000

2 posts

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories (e.g., /var/cache, /var/data, /var/config, and /var/tmp) in every sandbox on every app launch where, in some cases, components of

offseq at 2026-09-13T10:30:24.719Z ##

CVE-2026-90616: Flatpak <1.18.1 has a HIGH severity vuln — malicious sandboxed apps can use symlinks to gain arbitrary read/write host access, risking code execution. Update to 1.18.1+ now. radar.offseq.com/threat/in-fla

##

offseq@infosec.exchange at 2026-09-13T10:30:24.000Z ##

CVE-2026-90616: Flatpak <1.18.1 has a HIGH severity vuln — malicious sandboxed apps can use symlinks to gain arbitrary read/write host access, risking code execution. Update to 1.18.1+ now. radar.offseq.com/threat/in-fla #OffSeq #Flatpak #Linux #Security

##

CVE-2026-84171
(9.8 CRITICAL)

EPSS: 0.37%

updated 2026-09-12T18:31:29

4 posts

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbitrary code on the server.

thehackerwire@mastodon.social at 2026-09-12T17:00:02.000Z ##

🔴 CVE-2026-84171 - Critical (9.8)

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbi...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq at 2026-09-12T13:30:24.200Z ##

WP images upload on piclect (≤1.0) suffers from CRITICAL CVE-2026-84171: Unauthenticated attackers can upload arbitrary files, risking code execution. Restrict uploads & monitor activity until a fix is released. radar.offseq.com/threat/cve-20

##

thehackerwire@mastodon.social at 2026-09-12T17:00:02.000Z ##

🔴 CVE-2026-84171 - Critical (9.8)

The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a publicly accessible directory, allowing unauthenticated attackers to upload arbitrary files and execute arbi...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-09-12T13:30:24.000Z ##

WP images upload on piclect (≤1.0) suffers from CRITICAL CVE-2026-84171: Unauthenticated attackers can upload arbitrary files, risking code execution. Restrict uploads & monitor activity until a fix is released. radar.offseq.com/threat/cve-20 #OffSeq #WordPress #CVE202684171 #Vuln

##

CVE-2026-75800
(9.8 CRITICAL)

EPSS: 0.42%

updated 2026-09-12T18:31:28

2 posts

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.

thehackerwire@mastodon.social at 2026-09-13T01:00:10.000Z ##

🔴 CVE-2026-75800 - Critical (9.8)

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as wel...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-13T01:00:10.000Z ##

🔴 CVE-2026-75800 - Critical (9.8)

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as wel...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-87842
(7.5 HIGH)

EPSS: 0.29%

updated 2026-09-12T18:31:28

2 posts

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.

thehackerwire@mastodon.social at 2026-09-12T18:00:02.000Z ##

🟠 CVE-2026-87842 - High (7.5)

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T18:00:02.000Z ##

🟠 CVE-2026-87842 - High (7.5)

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90558
(9.8 CRITICAL)

EPSS: 0.00%

updated 2026-09-12T18:30:33

4 posts

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.

offseq at 2026-09-13T01:30:24.952Z ##

CVE-2026-90558: CRITICAL stack buffer overflow in irontec sngrep (<=1.8.4). Malicious SIP headers can crash or allow code execution. Patch status pending — filter untrusted SIP traffic. radar.offseq.com/threat/cve-20

##

thehackerwire@mastodon.social at 2026-09-12T19:00:23.000Z ##

🔴 CVE-2026-90558 - Critical (9.8)

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other hea...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-09-13T01:30:24.000Z ##

CVE-2026-90558: CRITICAL stack buffer overflow in irontec sngrep (<=1.8.4). Malicious SIP headers can crash or allow code execution. Patch status pending — filter untrusted SIP traffic. radar.offseq.com/threat/cve-20 #OffSeq #CVE202690558 #vuln #SIPrisk

##

thehackerwire@mastodon.social at 2026-09-12T19:00:23.000Z ##

🔴 CVE-2026-90558 - Critical (9.8)

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other hea...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90559
(7.5 HIGH)

EPSS: 0.00%

updated 2026-09-12T18:30:33

2 posts

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.

thehackerwire@mastodon.social at 2026-09-12T19:00:34.000Z ##

🟠 CVE-2026-90559 - High (7.5)

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data th...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T19:00:34.000Z ##

🟠 CVE-2026-90559 - High (7.5)

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data th...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90556
(7.8 HIGH)

EPSS: 0.00%

updated 2026-09-12T18:30:33

2 posts

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write past the entries array into adjacent heap-allocated struct fields, potentially corrupting memory when a user or server operator loads the file.

thehackerwire@mastodon.social at 2026-09-12T19:00:13.000Z ##

🟠 CVE-2026-90556 - High (7.8)

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write p...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T19:00:13.000Z ##

🟠 CVE-2026-90556 - High (7.8)

Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist lengths exceeding the fixed array bound of 64 elements. Attackers can craft malicious savegame files that write p...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-81742
(8.8 HIGH)

EPSS: 0.28%

updated 2026-09-12T18:30:22

2 posts

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in the browser of any user visiting the site.

thehackerwire@mastodon.social at 2026-09-12T22:59:51.000Z ##

🟠 CVE-2026-81742 - High (8.8)

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to i...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T22:59:51.000Z ##

🟠 CVE-2026-81742 - High (8.8)

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to i...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-80494
(8.6 HIGH)

EPSS: 0.32%

updated 2026-09-12T18:30:22

2 posts

The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.

thehackerwire@mastodon.social at 2026-09-12T20:00:24.000Z ##

🟠 CVE-2026-80494 - High (8.6)

The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrar...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T20:00:24.000Z ##

🟠 CVE-2026-80494 - High (8.6)

The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrar...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-82845
(9.9 CRITICAL)

EPSS: 0.35%

updated 2026-09-12T18:30:22

2 posts

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the s

thehackerwire@mastodon.social at 2026-09-12T19:01:35.000Z ##

🔴 CVE-2026-82845 - Critical (9.9)

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class s...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T19:01:35.000Z ##

🔴 CVE-2026-82845 - Critical (9.9)

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class s...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-84099
(8.1 HIGH)

EPSS: 0.27%

updated 2026-09-12T18:30:22

2 posts

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.

thehackerwire@mastodon.social at 2026-09-12T16:59:52.000Z ##

🟠 CVE-2026-84099 - High (8.1)

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitr...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T16:59:52.000Z ##

🟠 CVE-2026-84099 - High (8.1)

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitr...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90560
(8.2 HIGH)

EPSS: 0.00%

updated 2026-09-12T18:16:44.890000

2 posts

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination.

thehackerwire@mastodon.social at 2026-09-12T19:01:24.000Z ##

🟠 CVE-2026-90560 - High (8.2)

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T19:01:24.000Z ##

🟠 CVE-2026-90560 - High (8.2)

zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-87888
(8.0 HIGH)

EPSS: 0.23%

updated 2026-09-12T16:16:42.897000

2 posts

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.

thehackerwire@mastodon.social at 2026-09-12T18:00:16.000Z ##

🟠 CVE-2026-87888 - High (8)

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administra...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T18:00:16.000Z ##

🟠 CVE-2026-87888 - High (8)

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administra...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-87759
(8.8 HIGH)

EPSS: 0.23%

updated 2026-09-12T16:16:42.473000

4 posts

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to grant themselves the administrator role on a multisite installation.

thehackerwire@mastodon.social at 2026-09-12T17:59:53.000Z ##

🟠 CVE-2026-87759 - High (8.8)

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to gr...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq at 2026-09-12T07:30:24.066Z ##

CVE-2026-87759 (CRITICAL): Add User Autocomplete plugin (<1.2) for WordPress allows authenticated users to self-assign admin on multisite via improper privilege checks. Upgrade to 1.2+ or restrict user roles. radar.offseq.com/threat/cve-20

##

thehackerwire@mastodon.social at 2026-09-12T17:59:53.000Z ##

🟠 CVE-2026-87759 - High (8.8)

The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membership invitation carrying a caller-supplied role, allowing any authenticated user, such as a subscriber, to gr...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-09-12T07:30:24.000Z ##

CVE-2026-87759 (CRITICAL): Add User Autocomplete plugin (<1.2) for WordPress allows authenticated users to self-assign admin on multisite via improper privilege checks. Upgrade to 1.2+ or restrict user roles. radar.offseq.com/threat/cve-20 #OffSeq #WordPress #Security #CVE202687759

##

CVE-2026-85681
(9.8 CRITICAL)

EPSS: 0.28%

updated 2026-09-12T16:16:42.170000

4 posts

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled

thehackerwire@mastodon.social at 2026-09-12T17:00:14.000Z ##

🔴 CVE-2026-85681 - Critical (9.8)

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unaut...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq at 2026-09-12T12:00:24.408Z ##

CVE-2026-85681 (CRITICAL): WP Component plugin ≤2.2.4 allows unauthenticated option overwrites, risking full WordPress site takeover. Single-site installs are exposed. Check vendor advisory for mitigation steps: radar.offseq.com/threat/cve-20

##

thehackerwire@mastodon.social at 2026-09-12T17:00:14.000Z ##

🔴 CVE-2026-85681 - Critical (9.8)

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unaut...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-09-12T12:00:24.000Z ##

CVE-2026-85681 (CRITICAL): WP Component plugin ≤2.2.4 allows unauthenticated option overwrites, risking full WordPress site takeover. Single-site installs are exposed. Check vendor advisory for mitigation steps: radar.offseq.com/threat/cve-20 #OffSeq #WordPress #Vuln #BlueTeam

##

CVE-2026-84047
(8.6 HIGH)

EPSS: 0.26%

updated 2026-09-12T16:16:41.527000

2 posts

The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

thehackerwire@mastodon.social at 2026-09-12T19:01:45.000Z ##

🟠 CVE-2026-84047 - High (8.6)

The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T19:01:45.000Z ##

🟠 CVE-2026-84047 - High (8.6)

The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-81402
(9.8 CRITICAL)

EPSS: 0.45%

updated 2026-09-12T16:16:40.140000

2 posts

The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-accessible directory, which can lead to remote code execution.

thehackerwire@mastodon.social at 2026-09-12T20:00:36.000Z ##

🔴 CVE-2026-81402 - Critical (9.8)

The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-ac...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T20:00:36.000Z ##

🔴 CVE-2026-81402 - Critical (9.8)

The DS Ad Rotator WordPress plugin through 0.8 does not perform any capability check, nonce verification, or file-type validation on its image upload handler, allowing unauthenticated attackers to upload arbitrary files, including PHP, to a web-ac...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-80491
(8.6 HIGH)

EPSS: 0.32%

updated 2026-09-12T16:16:39.737000

2 posts

The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.

thehackerwire@mastodon.social at 2026-09-12T20:00:13.000Z ##

🟠 CVE-2026-80491 - High (8.6)

The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T20:00:13.000Z ##

🟠 CVE-2026-80491 - High (8.6)

The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-77006
(9.6 CRITICAL)

EPSS: 0.18%

updated 2026-09-12T16:16:38.670000

2 posts

The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.

thehackerwire@mastodon.social at 2026-09-12T23:00:13.000Z ##

🔴 CVE-2026-77006 - Critical (9.6)

The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T23:00:13.000Z ##

🔴 CVE-2026-77006 - Critical (9.6)

The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-77005
(9.6 CRITICAL)

EPSS: 0.30%

updated 2026-09-12T16:16:38.523000

2 posts

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.

thehackerwire@mastodon.social at 2026-09-12T23:00:01.000Z ##

🔴 CVE-2026-77005 - Critical (9.6)

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber,...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T23:00:01.000Z ##

🔴 CVE-2026-77005 - Critical (9.6)

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber,...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-15451
(8.8 HIGH)

EPSS: 0.25%

updated 2026-09-12T15:31:49

2 posts

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-lev

thehackerwire@mastodon.social at 2026-09-12T14:00:24.000Z ##

🟠 CVE-2026-15451 - High (8.8)

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'user...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T14:00:24.000Z ##

🟠 CVE-2026-15451 - High (8.8)

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'user...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90537
(8.2 HIGH)

EPSS: 0.21%

updated 2026-09-12T15:31:49

2 posts

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid dail

thehackerwire@mastodon.social at 2026-09-12T14:00:13.000Z ##

🟠 CVE-2026-90537 - High (8.2)

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T14:00:13.000Z ##

🟠 CVE-2026-90537 - High (8.2)

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90553
(7.8 HIGH)

EPSS: 0.21%

updated 2026-09-12T13:16:53.887000

2 posts

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processing_llava_onevision2.py that executes with vLLM process authority even when trust_remote_code is set to False.

thehackerwire@mastodon.social at 2026-09-12T13:59:48.000Z ##

🟠 CVE-2026-90553 - High (7.8)

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T13:59:48.000Z ##

🟠 CVE-2026-90553 - High (7.8)

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-85706
(10.0 CRITICAL)

EPSS: 1.16%

updated 2026-09-12T12:30:50

40 posts

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Nuclei template

10 repos

https://github.com/jithinkrishnanrs/gitlab-cve-2026-85706-ioc

https://github.com/brigadeops32/CVE-2026-85706

https://github.com/ynsmroztas/GitLabSniper

https://github.com/guneykabel/cve-2026-85706

https://github.com/FlowerWitch/CVE-2026-85706_docker_exp

https://github.com/solivaquaant/CVE-2026-85706

https://github.com/plur1bu5/gitread

https://github.com/mhtsec/CVE-2026-85706

https://github.com/gagaltotal/CVE-2026-85706-gitlab-poc

https://github.com/0xlyvio/cve-2026-85706-poc-exploit-gitlab

netsecio@mastodon.social at 2026-09-13T16:23:52.000Z ##

📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability

GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow

🔗 cyber.netsecops.io/articles/gi

##

undercodenews@mastodon.social at 2026-09-13T12:50:13.000Z ##

GitLab CVE-2026-85706: Critical CVSS 100 Flaw Is Already Being Probed in the Wild + Video

GitLab CVE-2026-85706: Critical CVSS 10.0 Path Traversal Flaw Puts Sensitive Files at Risk A Maximum-Severity Warning for GitLab Administrators A dangerous new GitLab vulnerability has moved from disclosure to real-world reconnaissance with remarkable speed. Tracked as CVE-2026-85706, the flaw carries the maximum CVSS score of 10.0 and affects the repository commits API in…

undercodenews.com/gitlab-cve-2

##

threatnoir at 2026-09-13T05:15:08.200Z ##

2026-W37 — Weekly Threat Roundup

🤖 AI is no longer just a defender's tool: state-sponsored groups and criminals weaponized Claude, ChatGPT, and OpenAI agents to automate exploitation, rebuild malware, and generate one million personalized phishing emails in three days.
🔓 GitLab's CVSS 10.0 path traversal flaw (CVE-2026-85706) wa…

threatnoir.com/weekly/2026-w37

🤖 AI generated summary

##

cyberworldops at 2026-09-12T20:20:00.745Z ##

GitLab CVE-2026-85706 is a maximum-severity path traversal in the repository commits API enabling unauthenticated arbitrary file read on self-managed servers. CISA added it to KEV with a three-day deadline, signaling active exploitation risk. Patch immediately and review for anomalous access to credentials and secrets.

cyberworldops.eu/en/gitlab-pat

##

security_crawler_carl at 2026-09-12T20:01:23.523Z ##

That is a faster turnaround than most people's pizza delivery.

Patch GitLab immediately to remediate CVE-2026-85706 — your self-managed server is the featured product in someone else's highlight reel.

Reward: Complimentary sponsorship credit from Deferred Maintenance Inc. Your inaction keeps them in business.

securityweek.com/gitlab-vulner

(2/2)

##

security_crawler_carl at 2026-09-12T20:01:23.359Z ##

🏆 New Achievement! Speed-Run Sponsored by Your Unpatched GitLab!

This achievement is brought to you by Deferred Maintenance Inc. — when you absolutely, positively need unauthenticated strangers reading every file on your server within a single HTTP request. CVE-2026-85706 scored a perfect ten out of ten on the CVSS scale, because some bugs don't do half measures. GitLab dropped patches on a Thursday. By Friday, WatchTowr was already watching wild exploitation probes roll in. One day. (1/2)

##

undercodenews@mastodon.social at 2026-09-12T18:44:35.000Z ##

GitLab CVSS 100 Vulnerability Reportedly Exploited Within 24 Hours, Leaving Self-Managed Servers Under Immediate Threat + Video

A Critical GitLab Warning for Defenders A critical security vulnerability in GitLab has reportedly moved from public disclosure to active exploitation in roughly a single day. Tracked as CVE-2026-85706, the flaw carries the highest possible CVSS score of 10.0, making it one of the most urgent vulnerabilities facing organizations operating…

undercodenews.com/gitlab-cvss-

##

Matchbook3469@mastodon.social at 2026-09-12T18:12:02.000Z ##

🔵 THREAT INTELLIGENCE

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

Vulnerability | CRITICAL
CVEs: CVE-2026-85706

GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes...

Full analysis:
yazoul.net/news/article/gitlab

by Yazoul AI

#CyberSecurity #CVE #SecurityOps

##

netsecio@mastodon.social at 2026-09-12T17:43:52.000Z ##

📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability

GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow

🔗 cyber.netsecops.io/articles/gi

##

rxerium at 2026-09-12T16:36:01.746Z ##

🚨 Detection for the actively exploited GitLab vulnerability tagged as CVE-2026-85706 (CVSS 10.0) available here:
github.com/projectdiscovery/nu

##

Matchbook3469@mastodon.social at 2026-09-12T11:15:42.000Z ##

🔴 New security advisory:

CVE-2026-85706 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
yazoul.net/advisory/cve/cve-20

by Yazoul AI

#CVE #VulnerabilityManagement #CyberSec

##

obivan at 2026-09-12T08:46:52.501Z ##

PoC for unauthenticated arbitrary file read on Gitlab github.com/guneykabel/cve-2026

##

sayzard@mastodon.sayzard.org at 2026-09-12T08:39:18.000Z ##

Improper Limitation of a Pathname to a Restricted Directory in GitLab 10/10

GitLab CE/EE의 Repository Commits API에서 경로 제한(path confinement)과 인증 검증이 불완전해 발생한 치명적 경로 탐색 취약점(CWE-22)입니다. 공격자는 인증 없이 조작된 경로를 통해 GitLab 서버의 임의 파일을 읽을 수 있으며, CVSS 3.1 기준 10.0(Critical)으로 평가됩니다. 영향 버전은 18.7 이상 19.1.8 미만, 19.2.0 이상 19.2.6 미만, 19.3.0 이상 19.3.2 미만이며, 각각 19.1.8·19.2.6·19.3.2 이상으로 즉시 업데이트해야 합니다. GitLab은 소스...

cve.org/CVERecord?id=CVE-2026-

##

beyondmachines1 at 2026-09-12T08:01:13.477Z ##

GitLab Patches Critical Path Traversal Flaw Under Active Exploitation

GitLab released emergency patches for 18 vulnerabilities, including a CVSS 10.0 path traversal flaw (CVE-2026-85706) that allows unauthenticated attackers to read sensitive server files and is currently seeing active probes.

**If you run a self-hosted GitLab instance, update it now to version 19.3.2, 19.2.6, or 19.1.8. One of these flaws is already being exploited and lets anyone read files off your server without logging in. All it takes is one public project to exist on the instance. If you can't patch right away, take the instance off the public internet and check your logs for POST requests to the repository commits API containing a "file.path" parameter to see if you've already been probed.**

beyondmachines.net/event_detai

##

undercodenews@mastodon.social at 2026-09-12T05:07:57.000Z ##

CISA Sounds the Alarm: Actively Exploited GitLab Flaw Could Expose Secrets and CI/CD Infrastructure

A Dangerous New Entry in CISA’s Exploited Vulnerabilities Catalog A serious security warning has emerged around GitLab after U.S. cybersecurity authorities identified active exploitation of a critical vulnerability capable of exposing arbitrary files from affected servers. The flaw, tracked as CVE-2026-85706, affects both GitLab Community Edition and Enterprise Edition…

undercodenews.com/cisa-sounds-

##

cyberworldops at 2026-09-12T04:20:00.522Z ##

GitLab path-traversal CVE-2026-85706 (CVSS 10.0) is being exploited in the wild one day after disclosure. It allows unauthenticated arbitrary file read with a single HTTP request, exposing secrets and enabling further compromise. Prioritize immediate patching and review logs.

cyberworldops.eu/en/critical-g

##

thehackerwire@mastodon.social at 2026-09-12T04:00:22.000Z ##

🔴 CVE-2026-85706 - Critical (10)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab serve...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

threatnoir at 2026-09-12T01:05:48.700Z ##

⚠️ CRITICAL: GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab patched a CVSS 10.0 unauthenticated file-read vulnerability (CVE-2026-85706) in the repository commits API that allows attackers to read arbitrary files from affected servers. In-the-wild probes are already active. Attackers can extract credentials, SSH keys, and other sensitive data without…

threatnoir.com/focus

🤖 AI generated summary

##

threatnoir@infosec.exchange at 2026-09-13T05:15:08.000Z ##

2026-W37 — Weekly Threat Roundup

🤖 AI is no longer just a defender's tool: state-sponsored groups and criminals weaponized Claude, ChatGPT, and OpenAI agents to automate exploitation, rebuild malware, and generate one million personalized phishing emails in three days.
🔓 GitLab's CVSS 10.0 path traversal flaw (CVE-2026-85706) wa…

threatnoir.com/weekly/2026-w37

#infosec #cybersecurity #threatintel

🤖 AI generated summary

##

cyberworldops@infosec.exchange at 2026-09-12T20:20:00.000Z ##

GitLab CVE-2026-85706 is a maximum-severity path traversal in the repository commits API enabling unauthenticated arbitrary file read on self-managed servers. CISA added it to KEV with a three-day deadline, signaling active exploitation risk. Patch immediately and review for anomalous access to credentials and secrets. #GitLab #CisaKev #InfoSec

cyberworldops.eu/en/gitlab-pat

##

security_crawler_carl@infosec.exchange at 2026-09-12T20:01:23.000Z ##

That is a faster turnaround than most people's pizza delivery.

Patch GitLab immediately to remediate CVE-2026-85706 — your self-managed server is the featured product in someone else's highlight reel.

Reward: Complimentary sponsorship credit from Deferred Maintenance Inc. Your inaction keeps them in business.

securityweek.com/gitlab-vulner

#GitLab #CyberSecurity #ZeroDay #PathTraversal #CVE #PatchedOrPerish (2/2)

##

security_crawler_carl@infosec.exchange at 2026-09-12T20:01:23.000Z ##

🏆 New Achievement! Speed-Run Sponsored by Your Unpatched GitLab!

This achievement is brought to you by Deferred Maintenance Inc. — when you absolutely, positively need unauthenticated strangers reading every file on your server within a single HTTP request. CVE-2026-85706 scored a perfect ten out of ten on the CVSS scale, because some bugs don't do half measures. GitLab dropped patches on a Thursday. By Friday, WatchTowr was already watching wild exploitation probes roll in. One day. (1/2)

##

netsecio@mastodon.social at 2026-09-12T17:43:52.000Z ##

📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability

GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow

🔗 cyber.netsecops.io/articles/gi

##

rxerium@infosec.exchange at 2026-09-12T16:36:01.000Z ##

🚨 Detection for the actively exploited GitLab vulnerability tagged as CVE-2026-85706 (CVSS 10.0) available here:
github.com/projectdiscovery/nu

##

obivan@infosec.exchange at 2026-09-12T08:46:52.000Z ##

PoC for unauthenticated arbitrary file read on Gitlab github.com/guneykabel/cve-2026

##

beyondmachines1@infosec.exchange at 2026-09-12T08:01:13.000Z ##

GitLab Patches Critical Path Traversal Flaw Under Active Exploitation

GitLab released emergency patches for 18 vulnerabilities, including a CVSS 10.0 path traversal flaw (CVE-2026-85706) that allows unauthenticated attackers to read sensitive server files and is currently seeing active probes.

**If you run a self-hosted GitLab instance, update it now to version 19.3.2, 19.2.6, or 19.1.8. One of these flaws is already being exploited and lets anyone read files off your server without logging in. All it takes is one public project to exist on the instance. If you can't patch right away, take the instance off the public internet and check your logs for POST requests to the repository commits API containing a "file.path" parameter to see if you've already been probed.**
#cybersecurity #infosec #attack #activeexploit
beyondmachines.net/event_detai

##

cyberworldops@infosec.exchange at 2026-09-12T04:20:00.000Z ##

GitLab path-traversal CVE-2026-85706 (CVSS 10.0) is being exploited in the wild one day after disclosure. It allows unauthenticated arbitrary file read with a single HTTP request, exposing secrets and enabling further compromise. Prioritize immediate patching and review logs. #GitLab #PathTraversal #ThreatIntel

cyberworldops.eu/en/critical-g

##

thehackerwire@mastodon.social at 2026-09-12T04:00:22.000Z ##

🔴 CVE-2026-85706 - Critical (10)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab serve...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

threatnoir@infosec.exchange at 2026-09-12T01:05:48.000Z ##

⚠️ CRITICAL: GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab patched a CVSS 10.0 unauthenticated file-read vulnerability (CVE-2026-85706) in the repository commits API that allows attackers to read arbitrary files from affected servers. In-the-wild probes are already active. Attackers can extract credentials, SSH keys, and other sensitive data without…

threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

##

secdb@infosec.exchange at 2026-09-11T21:00:27.000Z ##

🚨 [CISA-2026:0911] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-42016 (secdb.nttzen.cloud/cve/detail/)
- Name: JFrog Artifactory Incorrect Authorization Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: docs.jfrog.com/releases/docs/j ; docs.jfrog.com/releases/docs/a ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-42018 (secdb.nttzen.cloud/cve/detail/)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: docs.jfrog.com/releases/docs/j ; docs.jfrog.com/releases/docs/a ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-84869 (secdb.nttzen.cloud/cve/detail/)
- Name: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ConnectWise
- Product: ScreenConnect
- Notes: connectwise.com/company/trust/ ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-85706 (secdb.nttzen.cloud/cve/detail/)
- Name: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: GitLab
- Product: Community Edition and Enterprise Edition
- Notes: docs.gitlab.com/releases/patch ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260911 #cisa20260911 #cve_2026_42016 #cve_2026_42018 #cve_2026_84869 #cve_2026_85706 #cve202642016 #cve202642018 #cve202684869 #cve202685706

##

ssvc@infosec.exchange at 2026-09-11T20:20:10.000Z ##

@cR0w no mention of exploitation from CNA GitLab

CVE-2026-85706 - Path Traversal issue in repository commits API impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Impacted Versions: GitLab CE/EE: all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

Thanks s3ntago for reporting this vulnerability through our HackerOne bug bounty program.

docs.gitlab.com/releases/patch

##

cisakevtracker@mastodon.social at 2026-09-11T20:00:54.000Z ##

CVE ID: CVE-2026-85706
Vendor: GitLab
Product: Community Edition and Enterprise Edition
Date Added: 2026-09-11
CVE URL: nvd.nist.gov/vuln/detail/CVE-2

##

cR0w@infosec.exchange at 2026-09-11T19:55:48.000Z ##

CVE-2026-85706 is now in the KEV but the CVE still isn't published. LMAO. Go hack and patch more GitLab shit.

##

DarkWebInformer@infosec.exchange at 2026-09-11T17:30:12.000Z ##

🚨 CVE-2026-85706: An unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1

PoC: github.com/guneykabel/cve-2026

##

DarkWebInformer@infosec.exchange at 2026-09-11T17:24:17.000Z ##

🚨 GitLab CVSS 10 vulnerability exploited just one day after disclosure

Threat actors have begun exploiting CVE-2026-85706, a critical path traversal vulnerability affecting self-hosted GitLab Community and Enterprise Edition instances.

The flaw allows an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server using a single HTTP request.

Affected versions include:

• GitLab 18.7 through versions before 19.1.8
• GitLab 19.2 through versions before 19.2.6
• GitLab 19.3 through versions before 19.3.2

GitLab disclosed and patched the vulnerability on September 10.

Just one day later, watchTowr began observing in-the-wild exploitation attempts and warns that mass exploitation is likely to follow.

Administrators should upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or a newer supported release.

GitLab.com is already patched.

Source: docs.gitlab.com/releases/patch

##

jbhall56@infosec.exchange at 2026-09-11T14:05:07.000Z ##

GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. bleepingcomputer.com/news/secu

##

guru@thecybersecguru.com at 2026-09-11T13:16:52.000Z ##

Critical GitLab Vulnerabilities Exposed: Deep Dive into the CVSS 10.0 Path Traversal (CVE-2026-85706) & GraphQL Exploits

GitLab fixes CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal flaw, alongside CVE-2026-87719. Learn affected versions and patch now

thecybersecguru.com/news/gitla

##

tugatech@masto.pt at 2026-09-11T12:53:11.000Z ##

GitLab alerta para vulnerabilidade de gravidade máxima e pede atualização imediata. A falha, identificada como CVE-2026-85706, foi descoberta por um investigador de segurança e reportada através do programa de recompensas de bugs do HackerOne. 🚨

🔗 tugatech.com.pt/t90842-gitlab-

#alerta #gitlab #vulnerabilidade 

##

oversecurity@mastodon.social at 2026-09-11T12:00:50.000Z ##

GitLab urges users to patch max severity path traversal flaw

GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706.

🔗️ [Bleepingcomputer] link.is.it/jdshdd

##

DailyCyberSecurity@infosec.exchange at 2026-09-11T00:18:04.000Z ##

GitLab patched critical GitLab vulnerabilities, led by CVE-2026-85706 with a CVSS 10.0 score. Update your server now to protect source code from exposure.

#GitLab #CVE202685706 #Vulnerabilities #DevSecOps #Cybersecurity
securityonline.info/gitlab-vul

##

CVE-2026-78159
(9.8 CRITICAL)

EPSS: 0.76%

updated 2026-09-12T09:33:41

6 posts

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it p

offseq at 2026-09-13T06:00:25.530Z ##

CVE-2026-78159: The Events Calendar <=6.17.3 for WordPress has a CRITICAL RCE flaw via parse_array(). Unauthenticated code execution if comments on tribe_events posts are enabled. Disable comments as interim mitigation. radar.offseq.com/threat/the-th

##

offseq at 2026-09-12T09:00:24.081Z ##

CVE-2026-78159: CRITICAL RCE in The Events Calendar (<=6.17.3). Unauthenticated attackers can run arbitrary code via crafted comments. Disable comments on tribe_events posts to mitigate. CVSS 9.8. Details: radar.offseq.com/threat/cve-20

##

thehackerwire@mastodon.social at 2026-09-12T08:59:59.000Z ##

🔴 CVE-2026-78159 - Critical (9.8)

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-arr...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-09-13T06:00:25.000Z ##

CVE-2026-78159: The Events Calendar <=6.17.3 for WordPress has a CRITICAL RCE flaw via parse_array(). Unauthenticated code execution if comments on tribe_events posts are enabled. Disable comments as interim mitigation. radar.offseq.com/threat/the-th #OffSeq #WordPress #RCE #CVE202678159

##

offseq@infosec.exchange at 2026-09-12T09:00:24.000Z ##

CVE-2026-78159: CRITICAL RCE in The Events Calendar (<=6.17.3). Unauthenticated attackers can run arbitrary code via crafted comments. Disable comments on tribe_events posts to mitigate. CVSS 9.8. Details: radar.offseq.com/threat/cve-20 #OffSeq #WordPress #Infosec #RCE

##

thehackerwire@mastodon.social at 2026-09-12T08:59:59.000Z ##

🔴 CVE-2026-78159 - Critical (9.8)

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-arr...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-16482
(7.5 HIGH)

EPSS: 0.34%

updated 2026-09-12T09:33:41

2 posts

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries

thehackerwire@mastodon.social at 2026-09-12T09:00:55.000Z ##

🟠 CVE-2026-16482 - High (7.5)

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied param...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T09:00:55.000Z ##

🟠 CVE-2026-16482 - High (7.5)

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied param...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-78175
(8.8 HIGH)

EPSS: 0.59%

updated 2026-09-12T09:33:41

2 posts

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sq

thehackerwire@mastodon.social at 2026-09-12T09:00:09.000Z ##

🟠 CVE-2026-78175 - High (8.8)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handl...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T09:00:09.000Z ##

🟠 CVE-2026-78175 - High (8.8)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handl...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-85200
(7.5 HIGH)

EPSS: 0.76%

updated 2026-09-12T09:33:36

2 posts

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sen

thehackerwire@mastodon.social at 2026-09-12T09:00:45.000Z ##

🟠 CVE-2026-85200 - High (7.5)

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader function. This makes it possible for unauthenticated attackers to include and ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T09:00:45.000Z ##

🟠 CVE-2026-85200 - High (7.5)

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader function. This makes it possible for unauthenticated attackers to include and ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-78006
(9.8 CRITICAL)

EPSS: 0.78%

updated 2026-09-12T08:16:24.240000

6 posts

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attri

2 repos

https://github.com/DeadExpl0it/CVE-2026-78006-POC

https://github.com/user445213/CVE-2026-78006

offseq at 2026-09-13T03:00:23.504Z ##

CVE-2026-78006: The Events Calendar plugin ≤6.17.4 has a CRITICAL RCE flaw. Unauthenticated attackers can run code via comment handling — disable event comments until patched. Review vendor advisories. radar.offseq.com/threat/the-th

##

offseq at 2026-09-12T10:30:24.457Z ##

CVE-2026-78006: CRITICAL RCE in The Events Calendar plugin (<=6.17.4) for WordPress. Unauthenticated attackers can exploit comments to run code on the server. Disable event comments now & check for patches. radar.offseq.com/threat/cve-20

##

thehackerwire@mastodon.social at 2026-09-12T08:59:50.000Z ##

🔴 CVE-2026-78006 - Critical (9.8)

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-09-13T03:00:23.000Z ##

CVE-2026-78006: The Events Calendar plugin ≤6.17.4 has a CRITICAL RCE flaw. Unauthenticated attackers can run code via comment handling — disable event comments until patched. Review vendor advisories. radar.offseq.com/threat/the-th #OffSeq #WordPress #CVE202678006 #RCE

##

offseq@infosec.exchange at 2026-09-12T10:30:24.000Z ##

CVE-2026-78006: CRITICAL RCE in The Events Calendar plugin (<=6.17.4) for WordPress. Unauthenticated attackers can exploit comments to run code on the server. Disable event comments now & check for patches. radar.offseq.com/threat/cve-20 #OffSeq #WordPress #RCE #Vuln

##

thehackerwire@mastodon.social at 2026-09-12T08:59:50.000Z ##

🔴 CVE-2026-78006 - Critical (9.8)

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-86093
(7.5 HIGH)

EPSS: 0.47%

updated 2026-09-12T04:16:45.040000

1 posts

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.

thehackerwire@mastodon.social at 2026-09-11T00:01:55.000Z ##

🟠 CVE-2026-86093 - High (7.5)

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly co...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-84869
(9.9 CRITICAL)

EPSS: 0.69%

updated 2026-09-12T04:16:42.757000

4 posts

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

DailyCyberSecurity at 2026-09-12T07:12:00.953Z ##

A critical ConnectWise ScreenConnect vulnerability, CVE-2026-84869, is actively exploited in the wild. Patch your servers now to stop remote attacks.

securityonline.info/connectwis

##

DailyCyberSecurity@infosec.exchange at 2026-09-12T07:12:00.000Z ##

A critical ConnectWise ScreenConnect vulnerability, CVE-2026-84869, is actively exploited in the wild. Patch your servers now to stop remote attacks.

#ConnectWise #ScreenConnect #CVE202684869 #Cybersecurity #Vulnerability

securityonline.info/connectwis

##

secdb@infosec.exchange at 2026-09-11T21:00:27.000Z ##

🚨 [CISA-2026:0911] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-42016 (secdb.nttzen.cloud/cve/detail/)
- Name: JFrog Artifactory Incorrect Authorization Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: docs.jfrog.com/releases/docs/j ; docs.jfrog.com/releases/docs/a ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-42018 (secdb.nttzen.cloud/cve/detail/)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: docs.jfrog.com/releases/docs/j ; docs.jfrog.com/releases/docs/a ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-84869 (secdb.nttzen.cloud/cve/detail/)
- Name: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ConnectWise
- Product: ScreenConnect
- Notes: connectwise.com/company/trust/ ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-85706 (secdb.nttzen.cloud/cve/detail/)
- Name: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: GitLab
- Product: Community Edition and Enterprise Edition
- Notes: docs.gitlab.com/releases/patch ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260911 #cisa20260911 #cve_2026_42016 #cve_2026_42018 #cve_2026_84869 #cve_2026_85706 #cve202642016 #cve202642018 #cve202684869 #cve202685706

##

cisakevtracker@mastodon.social at 2026-09-11T19:00:57.000Z ##

CVE ID: CVE-2026-84869
Vendor: ConnectWise
Product: ScreenConnect
Date Added: 2026-09-11
CVE URL: nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2026-42018
(7.5 HIGH)

EPSS: 0.92%

updated 2026-09-12T04:16:33.587000

9 posts

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

1 repos

https://github.com/BL0odz/JFrog_CVE-2026-65615-ByGLM

thecybermind at 2026-09-12T14:40:36.719Z ##

CRITICAL SOC ALERT: CVE-2026-42018 exposes JFrog Artifactory via improper auth and token leakage. Active KEV exploitation verified. Access our TSUITE brief for Splunk, Sentinel, QRadar queries, and endpoint hardening steps to neutralize attacker persistence. thecybermind.co/9t6b

##

thecybermind at 2026-09-12T13:46:54.425Z ##

CRITICAL CISA KEV ALERT: CVE-2026-42018 targets JFrog Artifactory via improper auth and token leakage. Active exploitation verified. Access our CSUITE Brief for technical execution vectors, asset integrity rules, and endpoint hardening steps to protect your enterprise perimeter. thecybermind.co/22sa

##

threatnoir at 2026-09-12T01:05:51.850Z ##

⚠️ CRITICAL: Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers are chaining multiple JFrog Artifactory vulnerabilities (CVE-2026-42018, CVE-2026-42016, CVE-2026-82329) to escalate from anonymous users to administrator control on self-hosted instances. This grants them ability to plant backdoors and execute arbitrary shell commands in your build pipel…

threatnoir.com/focus

🤖 AI generated summary

##

thecybermind@infosec.exchange at 2026-09-12T14:40:36.000Z ##

CRITICAL SOC ALERT: CVE-2026-42018 exposes JFrog Artifactory via improper auth and token leakage. Active KEV exploitation verified. Access our TSUITE brief for Splunk, Sentinel, QRadar queries, and endpoint hardening steps to neutralize attacker persistence. thecybermind.co/9t6b

##

thecybermind@infosec.exchange at 2026-09-12T13:46:54.000Z ##

CRITICAL CISA KEV ALERT: CVE-2026-42018 targets JFrog Artifactory via improper auth and token leakage. Active exploitation verified. Access our CSUITE Brief for technical execution vectors, asset integrity rules, and endpoint hardening steps to protect your enterprise perimeter. thecybermind.co/22sa

##

threatnoir@infosec.exchange at 2026-09-12T01:05:51.000Z ##

⚠️ CRITICAL: Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers are chaining multiple JFrog Artifactory vulnerabilities (CVE-2026-42018, CVE-2026-42016, CVE-2026-82329) to escalate from anonymous users to administrator control on self-hosted instances. This grants them ability to plant backdoors and execute arbitrary shell commands in your build pipel…

threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

##

secdb@infosec.exchange at 2026-09-11T21:00:27.000Z ##

🚨 [CISA-2026:0911] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-42016 (secdb.nttzen.cloud/cve/detail/)
- Name: JFrog Artifactory Incorrect Authorization Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: docs.jfrog.com/releases/docs/j ; docs.jfrog.com/releases/docs/a ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-42018 (secdb.nttzen.cloud/cve/detail/)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: docs.jfrog.com/releases/docs/j ; docs.jfrog.com/releases/docs/a ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-84869 (secdb.nttzen.cloud/cve/detail/)
- Name: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ConnectWise
- Product: ScreenConnect
- Notes: connectwise.com/company/trust/ ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-85706 (secdb.nttzen.cloud/cve/detail/)
- Name: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: GitLab
- Product: Community Edition and Enterprise Edition
- Notes: docs.gitlab.com/releases/patch ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260911 #cisa20260911 #cve_2026_42016 #cve_2026_42018 #cve_2026_84869 #cve_2026_85706 #cve202642016 #cve202642018 #cve202684869 #cve202685706

##

cisakevtracker@mastodon.social at 2026-09-11T19:01:28.000Z ##

CVE ID: CVE-2026-42018
Vendor: JFrog
Product: Artifactory
Date Added: 2026-09-11
CVE URL: nvd.nist.gov/vuln/detail/CVE-2

##

cyberworldops@infosec.exchange at 2026-09-11T18:30:01.000Z ##

Active exploitation chains CVE-2026-42018 and CVE-2026-42016 to bypass authentication on self-hosted JFrog Artifactory and deploy a Rust backdoor with C2. CVE-2026-82329 is also abused to create admin tokens. This enables full server takeover and supply chain compromise. #JFrog #Artifactory #SupplyChainSecurity

cyberworldops.eu/en/attackers-

##

CVE-2026-42016
(8.1 HIGH)

EPSS: 0.89%

updated 2026-09-12T04:16:32.483000

6 posts

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

Matchbook3469@mastodon.social at 2026-09-13T18:36:28.000Z ##

🔵 THREAT INTELLIGENCE

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

Vulnerability | CRITICAL
CVEs: CVE-2026-42016

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security flaws impacting JFrog Artifactory, ConnectWise...

Full analysis:
yazoul.net/news/article/cisa-a

by Yazoul AI

#ThreatIntel #SecurityNews #IncidentResponse

##

threatnoir at 2026-09-12T01:05:51.850Z ##

⚠️ CRITICAL: Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers are chaining multiple JFrog Artifactory vulnerabilities (CVE-2026-42018, CVE-2026-42016, CVE-2026-82329) to escalate from anonymous users to administrator control on self-hosted instances. This grants them ability to plant backdoors and execute arbitrary shell commands in your build pipel…

threatnoir.com/focus

🤖 AI generated summary

##

threatnoir@infosec.exchange at 2026-09-12T01:05:51.000Z ##

⚠️ CRITICAL: Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers are chaining multiple JFrog Artifactory vulnerabilities (CVE-2026-42018, CVE-2026-42016, CVE-2026-82329) to escalate from anonymous users to administrator control on self-hosted instances. This grants them ability to plant backdoors and execute arbitrary shell commands in your build pipel…

threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

##

secdb@infosec.exchange at 2026-09-11T21:00:27.000Z ##

🚨 [CISA-2026:0911] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (secdb.nttzen.cloud/security-ad)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-42016 (secdb.nttzen.cloud/cve/detail/)
- Name: JFrog Artifactory Incorrect Authorization Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: docs.jfrog.com/releases/docs/j ; docs.jfrog.com/releases/docs/a ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-42018 (secdb.nttzen.cloud/cve/detail/)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: docs.jfrog.com/releases/docs/j ; docs.jfrog.com/releases/docs/a ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-84869 (secdb.nttzen.cloud/cve/detail/)
- Name: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ConnectWise
- Product: ScreenConnect
- Notes: connectwise.com/company/trust/ ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

⚠️ CVE-2026-85706 (secdb.nttzen.cloud/cve/detail/)
- Name: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: GitLab
- Product: Community Edition and Enterprise Edition
- Notes: docs.gitlab.com/releases/patch ; BOD 26-04: cisa.gov/news-events/directive ; Forensics Triage Requirements: cisa.gov/news-events/directive ; nvd.nist.gov/vuln/detail/CVE-2

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260911 #cisa20260911 #cve_2026_42016 #cve_2026_42018 #cve_2026_84869 #cve_2026_85706 #cve202642016 #cve202642018 #cve202684869 #cve202685706

##

cisakevtracker@mastodon.social at 2026-09-11T19:01:13.000Z ##

CVE ID: CVE-2026-42016
Vendor: JFrog
Product: Artifactory
Date Added: 2026-09-11
CVE URL: nvd.nist.gov/vuln/detail/CVE-2

##

cyberworldops@infosec.exchange at 2026-09-11T18:30:01.000Z ##

Active exploitation chains CVE-2026-42018 and CVE-2026-42016 to bypass authentication on self-hosted JFrog Artifactory and deploy a Rust backdoor with C2. CVE-2026-82329 is also abused to create admin tokens. This enables full server takeover and supply chain compromise. #JFrog #Artifactory #SupplyChainSecurity

cyberworldops.eu/en/attackers-

##

CVE-2026-87719
(9.9 CRITICAL)

EPSS: 0.61%

updated 2026-09-12T03:30:28

3 posts

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server objec

thehackerwire@mastodon.social at 2026-09-12T04:00:11.000Z ##

🔴 CVE-2026-87719 - Critical (9.9)

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search i...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T04:00:11.000Z ##

🔴 CVE-2026-87719 - Critical (9.9)

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search i...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

guru@thecybersecguru.com at 2026-09-11T13:16:52.000Z ##

Critical GitLab Vulnerabilities Exposed: Deep Dive into the CVSS 10.0 Path Traversal (CVE-2026-85706) & GraphQL Exploits

GitLab fixes CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal flaw, alongside CVE-2026-87719. Learn affected versions and patch now

thecybersecguru.com/news/gitla

##

CVE-2026-90456(CVSS UNKNOWN)

EPSS: 0.25%

updated 2026-09-12T00:31:35

2 posts

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.

offseq at 2026-09-12T00:00:35.043Z ##

CISA Malcolm (<=26.05.x) faces CRITICAL risk: CVE-2026-90456 allows admin takeover via default creds in inventory component if setup isn't run. Ensure unique passwords! radar.offseq.com/threat/cve-20

##

offseq@infosec.exchange at 2026-09-12T00:00:35.000Z ##

CISA Malcolm (<=26.05.x) faces CRITICAL risk: CVE-2026-90456 allows admin takeover via default creds in inventory component if setup isn't run. Ensure unique passwords! radar.offseq.com/threat/cve-20 #OffSeq #CISAMalcolm #CVE202690456 #infosec

##

CVE-2026-89266
(8.2 HIGH)

EPSS: 0.47%

updated 2026-09-12T00:17:06.440000

2 posts

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values to trigger out-of-bounds writes, causing process crashes or heap corruption.

thehackerwire@mastodon.social at 2026-09-12T00:59:49.000Z ##

🟠 CVE-2026-89266 - High (8.2)

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values t...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

thehackerwire@mastodon.social at 2026-09-12T00:59:49.000Z ##

🟠 CVE-2026-89266 - High (8.2)

stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated from size_t to int. Attackers can craft a malicious Ogg Vorbis file with large entries and dimensions values t...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-90460
(0 None)

EPSS: 0.34%

updated 2026-09-11T22:16:48.243000

2 posts

An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH

offseq at 2026-09-12T03:00:25.358Z ##

CVE-2026-90460: OpenStack Keystone <29.0.3 HIGH risk flaw allows delegated tokens to manage credentials & read sensitive data (MFA seeds) via /v3/credentials. Limit delegated token use & monitor access. Patch status pending. radar.offseq.com/threat/an-iss

##

offseq@infosec.exchange at 2026-09-12T03:00:25.000Z ##

CVE-2026-90460: OpenStack Keystone <29.0.3 HIGH risk flaw allows delegated tokens to manage credentials & read sensitive data (MFA seeds) via /v3/credentials. Limit delegated token use & monitor access. Patch status pending. radar.offseq.com/threat/an-iss #OffSeq #OpenStack #Infosec

##

CVE-2026-49846
(7.5 HIGH)

EPSS: 0.34%

updated 2026-09-11T22:16:37.537000

1 posts

libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI wit

thehackerwire@mastodon.social at 2026-09-11T22:59:58.000Z ##

🟠 CVE-2026-49846 - High (7.5)

libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonica...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-79393
(7.5 HIGH)

EPSS: 0.53%

updated 2026-09-11T21:31:22

1 posts

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes.

thehackerwire@mastodon.social at 2026-09-11T19:59:46.000Z ##

🟠 CVE-2026-79393 - High (7.5)

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a deni...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89260
(7.5 HIGH)

EPSS: 0.43%

updated 2026-09-11T21:17:58.153000

1 posts

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter ent

thehackerwire@mastodon.social at 2026-09-11T17:00:27.000Z ##

🟠 CVE-2026-89260 - High (7.5)

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-62112
(7.6 HIGH)

EPSS: 0.28%

updated 2026-09-11T21:17:02.457000

1 posts

Editor SQL Injection in Amelia <= 2.4.9 versions.

CVE-2026-79395
(9.8 CRITICAL)

EPSS: 0.41%

updated 2026-09-11T20:18:54.030000

1 posts

An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions (including PTZ control, stream URL retrieval, and system reboot) via a crafted SOAP request supplying the admin

thehackerwire@mastodon.social at 2026-09-11T22:02:03.000Z ##

🔴 CVE-2026-79395 - Critical (9.8)

An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentica...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-53952
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-09-11T20:17:14.060000

1 posts

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installatio

thehackerwire@mastodon.social at 2026-09-11T22:01:43.000Z ##

🔴 CVE-2026-53952 - Critical (9.8)

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a n...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89262
(7.5 HIGH)

EPSS: 0.31%

updated 2026-09-11T18:31:32

1 posts

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.

thehackerwire@mastodon.social at 2026-09-11T17:00:37.000Z ##

🟠 CVE-2026-89262 - High (7.5)

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and the...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-19646
(9.1 CRITICAL)

EPSS: 0.52%

updated 2026-09-11T18:16:56.877000

1 posts

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header.

offseq@infosec.exchange at 2026-09-11T00:00:36.000Z ##

CVE-2026-19646 (CRITICAL, CVSS 9.1) affects IBM Common Licensing 9.0.x & ART 9.0. Improper Host header validation enables remote redirection to attacker domains. No patch yet — monitor IBM guidance. radar.offseq.com/threat/cve-20 #OffSeq #Vuln #IBM #InfoSec

##

CVE-2026-86781
(5.3 MEDIUM)

EPSS: 0.12%

updated 2026-09-11T17:35:21.440000

1 posts

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.

offseq@infosec.exchange at 2026-09-11T07:30:24.000Z ##

CVE-2026-86781: SSL Zen plugin (<4.7.40) has a CRITICAL auth flaw — any WP user can download TLS private key & certs, risking site impersonation. Patch to 4.7.40+ now. radar.offseq.com/threat/cve-20 #OffSeq #WordPress #Vuln #TLS

##

CVE-2026-84890
(5.9 MEDIUM)

EPSS: 0.25%

updated 2026-09-11T16:55:29.047000

1 posts

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream can therefore return a small compressed payload, a compression bomb, that expands to hundreds of megaby

hugovalters@mastodon.social at 2026-09-12T08:40:01.000Z ##

CVE-2026-84890: undici decompression bomb risk. Malicious upstream can expand tiny payloads to hundreds of MB, exhausting client memory. CVSS 5.9. Patch status unknown—review your undici usage and add limits if possible. Details: valtersit.com/cve/CVE-2026-848 #CVE

##

CVE-2026-89176
(8.8 HIGH)

EPSS: 0.25%

updated 2026-09-11T16:17:50.073000

1 posts

WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, whereas impersonating a teacher can induce student computers to initiate connections, thereby gaining remote control o

thehackerwire@mastodon.social at 2026-09-11T11:00:25.000Z ##

🟠 CVE-2026-89176 - High (8.8)

WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can di...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-87908
(7.5 HIGH)

EPSS: 0.30%

updated 2026-09-11T16:17:48.057000

1 posts

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and

thehackerwire@mastodon.social at 2026-09-11T11:01:28.000Z ##

🟠 CVE-2026-87908 - High (7.5)

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-80462
(10.0 CRITICAL)

EPSS: 0.30%

updated 2026-09-11T15:32:48

4 posts

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

DailyCyberSecurity at 2026-09-12T01:42:24.777Z ##

Progress patched a critical Chef Automate vulnerability tracked as CVE-2026-80462. Fix this Chef Automate vulnerability to stop DevOps account takeovers.

securityonline.info/chef-autom

##

DailyCyberSecurity@infosec.exchange at 2026-09-12T01:42:24.000Z ##

Progress patched a critical Chef Automate vulnerability tracked as CVE-2026-80462. Fix this Chef Automate vulnerability to stop DevOps account takeovers.

#ChefAutomate #CVE202680462 #DevOpsSecurity #Cybersecurity #InfoSec

securityonline.info/chef-autom

##

thehackerwire@mastodon.social at 2026-09-11T15:00:28.000Z ##

🔴 CVE-2026-80462 - Critical (10)

A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to protected Chef Automate functionality under specific conditions.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

offseq@infosec.exchange at 2026-09-11T13:30:34.000Z ##

CRITICAL vuln (CVE-2026-80462) in Progress Chef Automate (4.13.516 – 4.13.519): API gateway auth bypass enables unauth’d privilege escalation. Restrict API access & review logs until patch confirmed. radar.offseq.com/threat/cve-20 #OffSeq #ChefAutomate #vuln #CVE202680462

##

CVE-2026-47839(CVSS UNKNOWN)

EPSS: 0.30%

updated 2026-09-11T15:32:40

1 posts

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.

offseq@infosec.exchange at 2026-09-11T10:30:25.000Z ##

Cloud Foundry UAA hit by CRITICAL vuln (CVE-2026-47839, CVSS 9.2): OIDC users with wildcard group mapping can gain uaa.admin. Review configs, avoid wildcards, and monitor for patches. radar.offseq.com/threat/cve-20 #OffSeq #CloudSecurity #CVE202647839 #Infosec

##

CVE-2026-87020
(8.1 HIGH)

EPSS: 0.56%

updated 2026-09-11T15:17:06.937000

2 posts

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG.

cyberworldops at 2026-09-13T18:50:01.251Z ##

Orthanc DICOM Server is affected by CVE-2026-87020, an integer overflow in image pitch calculation enabling authenticated heap out-of-bounds write via malicious PNG. It matters for clinical environments where exploitation risks service disruption and imaging integrity.

cyberworldops.eu/en/orthanc-di

##

cyberworldops@infosec.exchange at 2026-09-13T18:50:01.000Z ##

Orthanc DICOM Server is affected by CVE-2026-87020, an integer overflow in image pitch calculation enabling authenticated heap out-of-bounds write via malicious PNG. It matters for clinical environments where exploitation risks service disruption and imaging integrity. #OrthancServer #DicomSecurity #HeapCorruption

cyberworldops.eu/en/orthanc-di

##

CVE-2026-82100
(9.6 CRITICAL)

EPSS: 0.40%

updated 2026-09-11T15:17:06.230000

1 posts

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

offseq@infosec.exchange at 2026-09-11T01:30:25.000Z ##

CVE-2026-82100: CRITICAL path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 (CVSS 9.6). Remote authenticated attackers can cause denial of service via improper directory handling. Restrict access & monitor until patch confirmed. radar.offseq.com/threat/cve-20 #OffSeq #CVE202682100 #IBM #infosec

##

CVE-2026-80469
(8.3 HIGH)

EPSS: 0.23%

updated 2026-09-11T15:17:04.913000

1 posts

An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of attacker-controlled code. User interaction is required.

thehackerwire@mastodon.social at 2026-09-11T11:00:02.000Z ##

🟠 CVE-2026-80469 - High (8.3)

An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the execution of
attacker-controlled code. User interaction is required.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-71416
(8.8 HIGH)

EPSS: 0.17%

updated 2026-09-11T15:17:03.373000

1 posts

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket

thehackerwire@mastodon.social at 2026-09-11T15:00:16.000Z ##

🟠 CVE-2026-71416 - High (8.8)

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstre...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-82107
(9.6 CRITICAL)

EPSS: 0.36%

updated 2026-09-11T14:56:50.613000

2 posts

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication.

offseq@infosec.exchange at 2026-09-11T03:00:24.000Z ##

CVE-2026-82107: CRITICAL vuln in IBM DataStage on Cloud Pak for Data 5.4.0.0 (CVSS 9.6). Authenticated attackers can bypass authentication & access sensitive data. No patch — limit access & monitor for abuse. radar.offseq.com/threat/cve-20 #OffSeq #Vuln #IBM #InfoSec

##

thehackerwire@mastodon.social at 2026-09-10T23:00:08.000Z ##

🔴 CVE-2026-82107 - Critical (9.6)

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information and bypass security restrictions due to improper authentication.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89212
(8.6 HIGH)

EPSS: 0.33%

updated 2026-09-11T14:17:36.847000

1 posts

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.

thehackerwire@mastodon.social at 2026-09-11T15:00:05.000Z ##

🟠 CVE-2026-89212 - High (8.6)

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (includ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-81467
(9.8 CRITICAL)

EPSS: 3.84%

updated 2026-09-11T13:18:18.543000

1 posts

Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

DailyCyberSecurity@infosec.exchange at 2026-09-11T08:40:47.000Z ##

Dell patched critical Dell ThinOS vulnerabilities, including CVE-2026-81467. Update your ThinOS clients now to stop remote code execution attacks.

#Dell #ThinOS #Cybersecurity #Vulnerabilities #CVE202681467

securityonline.info/dell-thino

##

CVE-2026-86060
(9.8 CRITICAL)

EPSS: 1.02%

updated 2026-09-11T12:52:16.507000

1 posts

RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable

1 repos

https://github.com/bahirul/cve-2026-86060

thecybermind@infosec.exchange at 2026-09-11T11:38:21.000Z ##

Executive alert: CVE-2026-86060 actively threatens MikroTik RouterOS infrastructure. Review board-ready risk evaluation protocols, network asset integrity measures, and strategic remediation steps to protect your enterprise value today.

thecybermind.co/stnk

##

CVE-2026-89259
(9.8 CRITICAL)

EPSS: 0.41%

updated 2026-09-11T12:33:34

1 posts

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration (--allow-addons, --allow-child-process, --allow-worker). As a result, the restrictions intended by the fix for GHSA-x597-9fr4-5857 could still be bypassed, allowing a Node tool invoked

offseq@infosec.exchange at 2026-09-11T12:00:28.000Z ##

CVE-2026-89259 (CRITICAL): gohugoio Hugo <0.165.0 lets Node tools like TailwindCSS bypass security.exec.allow list, enabling file access outside project dirs. Upgrade to 0.165.0 or restrict exec.allow in hugo.toml. radar.offseq.com/threat/cve-20 #OffSeq #CVE #Hugo #InfoSec

##

CVE-2026-89178
(8.8 HIGH)

EPSS: 0.23%

updated 2026-09-11T09:31:31

1 posts

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the attacker.

thehackerwire@mastodon.social at 2026-09-11T11:01:18.000Z ##

🟠 CVE-2026-89178 - High (8.8)

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student compute...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89177
(8.8 HIGH)

EPSS: 0.23%

updated 2026-09-11T09:31:31

1 posts

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or perform replay attacks with forged commands to disrupt classroom operations.

thehackerwire@mastodon.social at 2026-09-11T11:01:05.000Z ##

🟠 CVE-2026-89177 - High (8.8)

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89174
(7.5 HIGH)

EPSS: 0.38%

updated 2026-09-11T09:31:31

1 posts

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts.

thehackerwire@mastodon.social at 2026-09-11T11:00:13.000Z ##

🟠 CVE-2026-89174 - High (7.5)

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89060
(7.7 HIGH)

EPSS: 0.23%

updated 2026-09-11T06:31:14

1 posts

A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster.

offseq@infosec.exchange at 2026-09-11T06:00:25.000Z ##

Red Hat Advanced Cluster Management for Kubernetes 2 is affected by CVE-2026-89060 (HIGH, CVSS 7.7): managed-cluster identities may access hub Secrets outside their namespace due to authorization flaws. Monitor Red Hat and restrict permissions. radar.offseq.com/threat/cve-20 #OffSeq #Kubernetes #RedHat

##

CVE-2026-8778
(9.8 CRITICAL)

EPSS: 0.62%

updated 2026-09-11T06:31:14

1 posts

The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote

offseq@infosec.exchange at 2026-09-11T04:30:23.000Z ##

CVE-2026-8778 (CRITICAL): MIPL Grouped Checkout Fields for WooCommerce ≤1.2.2 suffers from unrestricted file upload due to missing file type validation. Remote code execution possible by unauthenticated attackers. Restrict uploads & monitor! radar.offseq.com/threat/cve-20 #OffSeq #WordPress #CVE20268778

##

CVE-2026-77807
(7.5 HIGH)

EPSS: 0.68%

updated 2026-09-11T00:31:23

1 posts

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires

thehackerwire@mastodon.social at 2026-09-11T02:00:03.000Z ##

🟠 CVE-2026-77807 - High (7.5)

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it p...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-81940
(8.8 HIGH)

EPSS: 0.54%

updated 2026-09-11T00:31:23

1 posts

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.

thehackerwire@mastodon.social at 2026-09-11T00:02:16.000Z ##

🟠 CVE-2026-81940 - High (8.8)

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-84889
(8.8 HIGH)

EPSS: 0.53%

updated 2026-09-11T00:31:23

1 posts

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.

thehackerwire@mastodon.social at 2026-09-10T23:00:18.000Z ##

🟠 CVE-2026-84889 - High (8.8)

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-87958
(8.1 HIGH)

EPSS: 0.21%

updated 2026-09-11T00:31:16

1 posts

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

thehackerwire@mastodon.social at 2026-09-11T00:02:05.000Z ##

🟠 CVE-2026-87958 - High (8.1)

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-88062(CVSS UNKNOWN)

EPSS: 0.40%

updated 2026-09-10T21:22:13

1 posts

## 2. Summary `POST /api/acp/agents` registers a custom ACP agent. The endpoint accepts user-controlled `binary` and `versionCommand` values. After saving the custom agent, the same request calls `refreshAgentCache()`, which triggers agent version detection. The version probe eventually runs: ```ts execFileSync(probe.command, probe.args, ...) ``` The only validation is `resolveVersionProbe(bina

DailyCyberSecurity@infosec.exchange at 2026-09-11T08:30:48.000Z ##

A critical CVSS 9.5 OmniRoute RCE flaw (CVE-2026-88062) has public PoC exploit code available. Upgrade your AI gateway immediately to prevent compromises.

#OmniRoute #CVE202688062 #CyberSecurity #InfoSec #RCE

securityonline.info/omniroute-

##

CVE-2026-89094
(9.9 CRITICAL)

EPSS: 0.50%

updated 2026-09-10T21:17:53.160000

2 posts

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

DarkWebInformer@infosec.exchange at 2026-09-11T21:37:54.000Z ##

🚨 CVE-2026-89094: Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

CVSS: 9.9

Foregejo Update/Notes: codeberg.org/forgejo/forgejo/s

##

DailyCyberSecurity@infosec.exchange at 2026-09-11T13:09:20.000Z ##

A critical Forgejo remote code execution flaw, tracked as CVE-2026-89094, threatens Git servers. Patch this Forgejo remote code execution bug today.

#Forgejo #RemoteCodeExecution #CVE202689094 #Cybersecurity #DevSecOps

securityonline.info/forgejo-re

##

CVE-2026-65638
(0 None)

EPSS: 3.20%

updated 2026-09-10T19:54:25.810000

3 posts

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that contain the vulnerable code. WebPros has addressed t

beyondmachines1 at 2026-09-12T09:01:13.148Z ##

Critical ConfigServer Firewall Flaw Allows Unauthenticated Remote Command Execution

ConfigServer Security & Firewall (CSF) patched a critical shell injection vulnerability (CVE-2026-65638) in its MESSENGER service that allows unauthenticated remote code execution.

**If you run ConfigServer Security & Firewall (CSF) on your Linux or cPanel/WHM servers, update to version 16.30 right away (on cPanel systems run `yum clean all` then `/scripts/update-packages`) to close CVE-2026-65638. If you can't update immediately, turn the vulnerable feature off by setting `MESSENGER = 0` in `/etc/csf/csf.conf`, restart with `systemctl restart csf lfd`. Then check your logs for any unexpected commands run under the CSF service account.**

beyondmachines.net/event_detai

##

beyondmachines1@infosec.exchange at 2026-09-12T09:01:13.000Z ##

Critical ConfigServer Firewall Flaw Allows Unauthenticated Remote Command Execution

ConfigServer Security & Firewall (CSF) patched a critical shell injection vulnerability (CVE-2026-65638) in its MESSENGER service that allows unauthenticated remote code execution.

**If you run ConfigServer Security & Firewall (CSF) on your Linux or cPanel/WHM servers, update to version 16.30 right away (on cPanel systems run `yum clean all` then `/scripts/update-packages`) to close CVE-2026-65638. If you can't update immediately, turn the vulnerable feature off by setting `MESSENGER = 0` in `/etc/csf/csf.conf`, restart with `systemctl restart csf lfd`. Then check your logs for any unexpected commands run under the CSF service account.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

##

DailyCyberSecurity@infosec.exchange at 2026-09-11T03:18:48.000Z ##

Two critical CSF plugin vulnerabilities, CVE-2026-65638 and CVE-2026-65639, allow remote code execution. Patch your ConfigServer firewall immediately.

#CSFPlugin #Cybersecurity #CVE202665639 #Vulnerabilities #InfoSec

securityonline.info/csf-plugin

##

CVE-2026-65639
(0 None)

EPSS: 1.61%

updated 2026-09-10T19:54:25.810000

1 posts

OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data. The vulnerability affects versions of the software originally distributed by ConfigServer, as well as versions of the WebPros-maintained fork that co

DailyCyberSecurity@infosec.exchange at 2026-09-11T03:18:48.000Z ##

Two critical CSF plugin vulnerabilities, CVE-2026-65638 and CVE-2026-65639, allow remote code execution. Patch your ConfigServer firewall immediately.

#CSFPlugin #Cybersecurity #CVE202665639 #Vulnerabilities #InfoSec

securityonline.info/csf-plugin

##

CVE-2026-80352
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-09-10T18:33:12

1 posts

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before

DailyCyberSecurity@infosec.exchange at 2026-09-11T14:13:15.000Z ##

Three critical Apache Camel K vulnerabilities, including CVE-2026-80352, allow code injection and eval injection. Patch these critical flaws immediately.

#ApacheCamel #CamelK #Cybersecurity #CVE202680352 #InfoSec

securityonline.info/apache-cam

##

CVE-2026-19490
(9.8 CRITICAL)

EPSS: 5.60%

updated 2026-09-10T15:33:58

2 posts

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

2 repos

https://github.com/TarPeg007/CVE-2026-19490

https://github.com/BishopFox/CVE-2026-19490-check

dgchultaeiz@hachyderm.io at 2026-09-13T13:26:24.000Z ##

¿Seguimos confiando demasiado?

Anderson hablaba de confianza en seguridad informática a comienzos de los años 70.

Más de cincuenta años después tenemos Cloud, SaaS, Zero Trust, MFA, PAM, EDR y tecnologías que en aquella época hubieran parecido ciencia ficción.

Entonces me hice una pregunta:

¿El problema también cambió?

En lugar de buscar la respuesta en otro paper, decidí mirar algunas vulnerabilidades recientes:

CVE-2026-20079
CVE-2026-19490
CVE-2025-25249
CVE-2026-20212

Authentication bypass, problemas de memoria, componentes de infraestructura...

Vulnerabilidades técnicamente muy diferentes.

Pero hay una pregunta interesante que podemos hacerle a cada una:

¿Qué tuvo que asumir el sistema para que esa vulnerabilidad pudiera existir?

De eso hablaremos próximamente

¿Seguimos confiando demasiado? —
De Anderson a la Inteligencia Artificial

##

obivan@infosec.exchange at 2026-09-11T07:51:26.000Z ##

Safely detect Citrix NetScaler SAML auth bypass (CVE-2026-19490) github.com/BishopFox/CVE-2026-

##

CVE-2026-87491
(8.8 HIGH)

EPSS: 0.86%

updated 2026-09-10T12:49:02.630000

1 posts

Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

2 repos

https://github.com/SneakyNachos/CVE-2026-87491-and-CVE-2026-85046-the-bagel-fell-off-the-counter

https://github.com/SneakyNachos/CVE-2026-87575-CVE-2026-87606-CVE-2026-87491-and-CVE-2026-85046.-Escape-the-v8-carcass.

security_crawler_carl@infosec.exchange at 2026-09-11T09:27:16.000Z ##

🏆 New Achievement! Seventh Inning Slaughter!

CHANGELOG v2026.09.09 — Google Chrome (Unscheduled Hotfix #7)

FIXED: Nothing you did. ADDED: CVE-2026-87491, an out-of-bounds write in the V8 JavaScript and WebAssembly engine, actively exploited in the wild via crafted HTML pages. Remote attackers can execute arbitrary code inside your browser sandbox, corrupt the heap, expose sensitive data, or simply crash the party. This is the seventh actively exploited Chrome zero-day patched this year. (1/2)

##

CVE-2026-20079
(10.0 CRITICAL)

EPSS: 75.75%

updated 2026-09-10T12:48:17.580000

6 posts

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.&nbsp; This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this v

Nuclei template

2 repos

https://github.com/0xBlackash/CVE-2026-20079

https://github.com/CyberAuth/CVE-2026-20079

dgchultaeiz@hachyderm.io at 2026-09-13T13:26:24.000Z ##

¿Seguimos confiando demasiado?

Anderson hablaba de confianza en seguridad informática a comienzos de los años 70.

Más de cincuenta años después tenemos Cloud, SaaS, Zero Trust, MFA, PAM, EDR y tecnologías que en aquella época hubieran parecido ciencia ficción.

Entonces me hice una pregunta:

¿El problema también cambió?

En lugar de buscar la respuesta en otro paper, decidí mirar algunas vulnerabilidades recientes:

CVE-2026-20079
CVE-2026-19490
CVE-2025-25249
CVE-2026-20212

Authentication bypass, problemas de memoria, componentes de infraestructura...

Vulnerabilidades técnicamente muy diferentes.

Pero hay una pregunta interesante que podemos hacerle a cada una:

¿Qué tuvo que asumir el sistema para que esa vulnerabilidad pudiera existir?

De eso hablaremos próximamente

¿Seguimos confiando demasiado? —
De Anderson a la Inteligencia Artificial

##

netsecio@mastodon.social at 2026-09-12T17:43:34.000Z ##

📰 Cisco Firewall Flaws Actively Exploited by Ransomware & State Actors

Cisco warns multiple threat groups, including Qilin ransomware and state actors, are exploiting a critical auth bypass flaw (CVE-2026-20079) in Secure Firewall Management Center (FMC). CVSS 10.0. Patch now! #CVE202620079 #Cisco #Ransomware

🔗 cyber.netsecops.io/articles/ci

##

thenewoil@mastodon.thenewoil.org at 2026-09-11T20:00:01.000Z ##

#Cisco confirms CVE-2026-20079 #SecureFMC flaw exploited in attacks

bleepingcomputer.com/news/secu

#cybersecurity

##

security_crawler_carl@infosec.exchange at 2026-09-11T16:34:15.000Z ##

Reward: You've unlocked the Mandatory Remediation Sprint — a stackable negative buff. Enjoy your weekend.

tech-insider.org/cisco-fmc-cve

#CiscoFMC #CyberSecurity #CriticalVulnerability #Ransomware #CVSS10 #BudgetJustified (3/3)

##

security_crawler_carl@infosec.exchange at 2026-09-11T16:34:14.000Z ##

🏆 New Achievement! Perfect Score, Wrong Test!

Welcome, new player, to the Management Plane Tutorial. This is a mandatory segment. You cannot skip it. Your Cisco Firepower Management Console, CVE-2026-20079, has just rolled a CVSS 10.0 — a perfect score — and approximately 700 exposed instances are now enrolled in this questline whether they opted in or not. (1/3)

##

youranonnewsirc@nerdculture.de at 2026-09-11T04:26:21.000Z ##

The EU Cyber Resilience Act (CRA) takes effect today, September 11, mandating 24-hour vulnerability reporting from manufacturers of connected hardware and software. Simultaneously, state-backed threat actors are increasingly targeting EU officials via encrypted messaging apps for phishing attacks, and a critical Cisco Secure Firewall Management Center flaw (CVE-2026-20079) requires urgent patching. Geopolitically, tensions escalated in the Strait of Hormuz following Iranian claims of ship attacks after US actions, and conflicts continue in the Middle East. In technology, Google Threat Intelligence reported on an AI system capable of harvesting thousands of credentials autonomously.

#Cybersecurity #Geopolitics #TechNews

##

CVE-2025-25249
(8.1 HIGH)

EPSS: 2.40%

updated 2026-09-10T12:47:59.933000

2 posts

A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets

dgchultaeiz@hachyderm.io at 2026-09-13T13:26:24.000Z ##

¿Seguimos confiando demasiado?

Anderson hablaba de confianza en seguridad informática a comienzos de los años 70.

Más de cincuenta años después tenemos Cloud, SaaS, Zero Trust, MFA, PAM, EDR y tecnologías que en aquella época hubieran parecido ciencia ficción.

Entonces me hice una pregunta:

¿El problema también cambió?

En lugar de buscar la respuesta en otro paper, decidí mirar algunas vulnerabilidades recientes:

CVE-2026-20079
CVE-2026-19490
CVE-2025-25249
CVE-2026-20212

Authentication bypass, problemas de memoria, componentes de infraestructura...

Vulnerabilidades técnicamente muy diferentes.

Pero hay una pregunta interesante que podemos hacerle a cada una:

¿Qué tuvo que asumir el sistema para que esa vulnerabilidad pudiera existir?

De eso hablaremos próximamente

¿Seguimos confiando demasiado? —
De Anderson a la Inteligencia Artificial

##

thecybermind@infosec.exchange at 2026-09-11T13:36:46.000Z ##

🚨 CRITICAL THREAT BRIEF: CVE-2025-25249 (Fortinet FortiOS & Gateway Infrastructure)

Active exploitation verified by the CISA KEV matrix has placed enterprise network perimeters at risk due to a critical heap-based buffer overflow vulnerability.

🔗 Read the full intelligence brief: thecybermind.co/us4c

##

CVE-2026-0310(CVSS UNKNOWN)

EPSS: 0.34%

updated 2026-09-10T06:31:55

1 posts

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls. The security risk posed by this issue is minimiz

GossiTheDog@cyberplace.social at 2026-09-11T22:47:49.000Z ##

Palo-Alto are calling resellers and asking them to call customers to tell them to update their Palo-Alto PA and VM firewalls to cover CVE-2026-0310 - an unauthenticated XML parsing vulneraility which causes a buffer overflow leading to code execution, on the PA (physical) firewalls via the dataplane.
security.paloaltonetworks.com/

HT @databeestje

##

CVE-2026-50894
(9.8 CRITICAL)

EPSS: 0.48%

updated 2026-09-09T21:32:24

1 posts

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload.

hugovalters@mastodon.social at 2026-09-13T17:40:14.000Z ##

CVE-2026-50894: Unrestricted file upload in easyadmin v2.0.2.2 enables authenticated RCE and full server takeover. CVSS not scored, but impact is critical. If you use easyadmin, restrict access and audit uploads now. Patch valtersit.com/cve/CVE-2026-508

##

CVE-2026-75170
(6.1 MEDIUM)

EPSS: 0.24%

updated 2026-09-09T21:32:23

1 posts

Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter.

hugovalters@mastodon.social at 2026-09-12T07:10:02.000Z ##

CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: valtersit.com/cve/CVE-2026-751 #CVE #infosec #XSS

##

CVE-2026-38961
(5.4 MEDIUM)

EPSS: 0.20%

updated 2026-09-09T21:32:23

1 posts

Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any authenticated user who views the dashboard, due to insufficient sanitization of feed title data

hugovalters@mastodon.social at 2026-09-12T03:40:17.000Z ##

CVE-2026-38961: Stored XSS in Netgate pfSense RSS Widget (versions 26.03, 25.11.1, CE 2.8.1). Malicious feed titles execute JS for any authenticated user viewing the dashboard. CVSS: N/A. Unpatched—restrict RSS access now. Details: valtersit.com/cve/CVE-2026-389 #C

##

CVE-2026-75166
(8.8 HIGH)

EPSS: 0.49%

updated 2026-09-09T20:20:34.103000

1 posts

Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution.

hugovalters@mastodon.social at 2026-09-13T02:50:18.000Z ##

CVE-2026-75166: Insecure permission in MBS-Solutions X-Serie Gateway (V6_00_05) lets low-priv user run tcpdump as root, leading to RCE via -z flag. CVSS: N/A. Patch unknown—assume vulnerable. Restrict access & monitor now. valtersit.com/cve/CVE-2026-751 #CVE #infos

##

CVE-2026-71626
(7.5 HIGH)

EPSS: 0.32%

updated 2026-09-09T16:04:24.933000

1 posts

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components

hugovalters@mastodon.social at 2026-09-12T10:20:19.000Z ##

CVE-2026-71626: Invoice Ninja v5.13.24 leaks sensitive data via webhook request components. Remote info exposure, no CVSS or patch yet. Review your instance now. Details: valtersit.com/cve/CVE-2026-716 #CVE #infosec #InvoiceNinja

##

CVE-2026-73324
(6.5 MEDIUM)

EPSS: 0.33%

updated 2026-09-09T15:35:16

6 posts

VLC media player copies an RTSP response line into a fixed buffer without guaranteeing termination and then treats that buffer as a C string. RtspReadLine in modules/access/rtsp/access.c calls strncpy with the full buffer length, which writes no terminator when the source line is at least as long as the destination, and rtsp_get in modules/access/rtsp/rtsp.c allocates that buffer as BUF_SIZE bytes

beyondmachines1 at 2026-09-13T17:01:13.011Z ##

VLC Media Player Flaws Allow Heap Corruption and Sensitive Data Disclosure

VideoLAN reports two vulnerabilities in VLC Media Player (CVE-2026-56711 and CVE-2026-73324) that allow attackers to corrupt heap memory or leak sensitive data via crafted PNG files and RTSP streams.

**If you use VLC Media Player (any version from 3.0.0 to 3.0.23), update it to the latest patched version as soon as VideoLAN releases it. Until you've updated, don't open media files, playlists, or RTSP streaming links that come from people or websites you don't know and trust.**

beyondmachines.net/event_detai

##

guru@thecybersecguru.com at 2026-09-12T17:11:54.000Z ##

VLC Media Player hit by two critical security flaws: heap corruption and memory disclosure putting millions at risk

Two critical VLC Media Player vulnerabilities, CVE-2026-56711 and CVE-2026-73324, expose users to heap corruption and memory disclosure. Here’s what to do

thecybersecguru.com/news/vlc-m

##

beyondmachines1@infosec.exchange at 2026-09-13T17:01:13.000Z ##

VLC Media Player Flaws Allow Heap Corruption and Sensitive Data Disclosure

VideoLAN reports two vulnerabilities in VLC Media Player (CVE-2026-56711 and CVE-2026-73324) that allow attackers to corrupt heap memory or leak sensitive data via crafted PNG files and RTSP streams.

**If you use VLC Media Player (any version from 3.0.0 to 3.0.23), update it to the latest patched version as soon as VideoLAN releases it. Until you've updated, don't open media files, playlists, or RTSP streaming links that come from people or websites you don't know and trust.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

##

guru@thecybersecguru.com at 2026-09-12T17:11:54.000Z ##

VLC Media Player hit by two critical security flaws: heap corruption and memory disclosure putting millions at risk

Two critical VLC Media Player vulnerabilities, CVE-2026-56711 and CVE-2026-73324, expose users to heap corruption and memory disclosure. Here’s what to do

thecybersecguru.com/news/vlc-m

##

DarkWebInformer@infosec.exchange at 2026-09-11T16:37:27.000Z ##

🚨 Two VLC Media Player flaws can allow code execution and leak sensitive memory

Security researchers have disclosed two vulnerabilities affecting VLC Media Player versions 3.0.0 through 3.0.23.

CVE-2026-56711, rated 8.6, is a heap out-of-bounds write caused by an integer overflow in VLC's picture buffer allocation.

An attacker can craft a malicious PNG with manipulated dimensions that causes VLC to allocate an undersized memory buffer before writing beyond its boundaries.

The flaw can potentially lead to arbitrary code execution when the malicious image is opened directly or loaded through a playlist.

CVE-2026-73324, rated 6.9, affects VLC's RealRTSP handling.

A malicious RTSP server can send an oversized response that causes VLC to read beyond an allocated buffer and return adjacent heap memory to the attacker, potentially exposing sensitive information.

The vulnerable RealRTSP component is enabled in official VideoLAN builds, although some Linux distribution packages may compile VLC without it.

As of September 11, VLC 3.0.23 remains the current stable desktop release listed by VideoLAN and is affected by both vulnerabilities.

Users should avoid opening untrusted image files or RealRTSP playlist links until an updated release addressing the flaws becomes available.

Source: securityonline.info/vlc-media-

##

DailyCyberSecurity@infosec.exchange at 2026-09-11T08:54:19.000Z ##

Two VLC media player vulnerabilities (CVE-2026-56711, CVE-2026-73324) allow heap out-of-bounds write and read. No patch is available yet.

#VLC #VideoLAN #VLCvulnerability #CVE #HeapOverflow #MediaPlayer #InfoSec #IntegerOverflow #RTSP #PatchNow

securityonline.info/vlc-media-

##

CVE-2026-56711
(8.8 HIGH)

EPSS: 0.30%

updated 2026-09-09T15:35:15

6 posts

VLC media player computes the size of a picture buffer with 32-bit arithmetic and allocates from the wrapped result. In AllocatePicture in src/misc/picture.c the running total is accumulated as i_bytes += p->i_pitch * p->i_lines, and both plane_t fields are declared int in include/vlc_picture.h, so the multiplication is evaluated at 32 bits and wraps before it is widened to the size_t accumulator.

beyondmachines1 at 2026-09-13T17:01:13.011Z ##

VLC Media Player Flaws Allow Heap Corruption and Sensitive Data Disclosure

VideoLAN reports two vulnerabilities in VLC Media Player (CVE-2026-56711 and CVE-2026-73324) that allow attackers to corrupt heap memory or leak sensitive data via crafted PNG files and RTSP streams.

**If you use VLC Media Player (any version from 3.0.0 to 3.0.23), update it to the latest patched version as soon as VideoLAN releases it. Until you've updated, don't open media files, playlists, or RTSP streaming links that come from people or websites you don't know and trust.**

beyondmachines.net/event_detai

##

guru@thecybersecguru.com at 2026-09-12T17:11:54.000Z ##

VLC Media Player hit by two critical security flaws: heap corruption and memory disclosure putting millions at risk

Two critical VLC Media Player vulnerabilities, CVE-2026-56711 and CVE-2026-73324, expose users to heap corruption and memory disclosure. Here’s what to do

thecybersecguru.com/news/vlc-m

##

beyondmachines1@infosec.exchange at 2026-09-13T17:01:13.000Z ##

VLC Media Player Flaws Allow Heap Corruption and Sensitive Data Disclosure

VideoLAN reports two vulnerabilities in VLC Media Player (CVE-2026-56711 and CVE-2026-73324) that allow attackers to corrupt heap memory or leak sensitive data via crafted PNG files and RTSP streams.

**If you use VLC Media Player (any version from 3.0.0 to 3.0.23), update it to the latest patched version as soon as VideoLAN releases it. Until you've updated, don't open media files, playlists, or RTSP streaming links that come from people or websites you don't know and trust.**
#cybersecurity #infosec #advisory #vulnerability
beyondmachines.net/event_detai

##

guru@thecybersecguru.com at 2026-09-12T17:11:54.000Z ##

VLC Media Player hit by two critical security flaws: heap corruption and memory disclosure putting millions at risk

Two critical VLC Media Player vulnerabilities, CVE-2026-56711 and CVE-2026-73324, expose users to heap corruption and memory disclosure. Here’s what to do

thecybersecguru.com/news/vlc-m

##

DarkWebInformer@infosec.exchange at 2026-09-11T16:37:27.000Z ##

🚨 Two VLC Media Player flaws can allow code execution and leak sensitive memory

Security researchers have disclosed two vulnerabilities affecting VLC Media Player versions 3.0.0 through 3.0.23.

CVE-2026-56711, rated 8.6, is a heap out-of-bounds write caused by an integer overflow in VLC's picture buffer allocation.

An attacker can craft a malicious PNG with manipulated dimensions that causes VLC to allocate an undersized memory buffer before writing beyond its boundaries.

The flaw can potentially lead to arbitrary code execution when the malicious image is opened directly or loaded through a playlist.

CVE-2026-73324, rated 6.9, affects VLC's RealRTSP handling.

A malicious RTSP server can send an oversized response that causes VLC to read beyond an allocated buffer and return adjacent heap memory to the attacker, potentially exposing sensitive information.

The vulnerable RealRTSP component is enabled in official VideoLAN builds, although some Linux distribution packages may compile VLC without it.

As of September 11, VLC 3.0.23 remains the current stable desktop release listed by VideoLAN and is affected by both vulnerabilities.

Users should avoid opening untrusted image files or RealRTSP playlist links until an updated release addressing the flaws becomes available.

Source: securityonline.info/vlc-media-

##

DailyCyberSecurity@infosec.exchange at 2026-09-11T08:54:19.000Z ##

Two VLC media player vulnerabilities (CVE-2026-56711, CVE-2026-73324) allow heap out-of-bounds write and read. No patch is available yet.

#VLC #VideoLAN #VLCvulnerability #CVE #HeapOverflow #MediaPlayer #InfoSec #IntegerOverflow #RTSP #PatchNow

securityonline.info/vlc-media-

##

CVE-2026-85103
(9.8 CRITICAL)

EPSS: 0.36%

updated 2026-09-09T15:35:15

10 posts

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

netsecio@mastodon.social at 2026-09-13T16:23:48.000Z ##

📰 Check Point patches two critical 9.8 CVSS flaws in VPN products

Check Point patches two critical 9.8 CVSS vulnerabilities (CVE-2026-85102, CVE-2026-85103) in its VPN products. Flaws could allow unauthenticated RCE. Admins are urged to apply hotfixes immediately. #CyberSecurity #Vulnerability #VPN #PatchNow

🔗 cyber.netsecops.io/articles/ch

##

guru@thecybersecguru.com at 2026-09-13T13:02:46.000Z ##

Check Point patches two critical VPN gateway flaws scoring 9.8 on CVSS

Check Point patches two critical VPN vulnerabilities, CVE-2026-85102 and CVE-2026-85103, rated CVSS 9.8 and capable of unauthenticated remote code execution

thecybersecguru.com/news/check

##

daniel1820815 at 2026-09-13T10:08:42.324Z ##

@cyberwald Bevor man hier einen Hersteller zu CVEs verurteilt, sollte man vielleicht tiefer recherchieren und dazu ein paar Fakten hinzufügen.

Beide Schwachstellen wurden intern entdeckt und bis zur Veröffentlichung gab es keine Hinweise darauf, dass sie in freier Wildbahn ausgenutzt wurden. Weiterhin gab es zu jedem CVE direkt entsprechende Anweisungen und Patches:

Darüber hinaus gibt es mittlerweile die Funktion Check Point Live Patch (CPLP), welches ein im Betriebssystem Gaia enthaltener Dienst zur Bereitstellung von Abwehrmaßnahmen ist. Es schließt kritische Schwachstellen im laufenden Betrieb durch gezielte In-Memory-Korrekturen (Live-Patches). -> support.checkpoint.com/results



##

Analyst207@mastodon.social at 2026-09-12T14:37:55.000Z ##

Dutch NCSC Warns of Imminent Check Point VPN Flaw Exploitation

The Dutch National Cyber Security Centrum is warning organizations to act fast - two critical flaws in Check Point VPN, tracked as CVE-2026-85102 and CVE-2026-85103, are likely to be exploited soon, with potentially severe consequences. Install security updates as soon as possible to protect yourself.

osintsights.com/dutch-ncsc-war

#CheckPointVpn #Cve202685102 #Cve202685103 #EmergingThreats #NationState

##

undercodenews@mastodon.social at 2026-09-12T14:35:56.000Z ##

Critical Check Point VPN Flaws Could Soon Trigger Remote Attacks, Dutch Cyber Agency Warns + Video

Critical Check Point VPN Flaws Could Soon Trigger Remote Attacks, Dutch Cyber Agency Warns A Dangerous Window Is Opening A new warning from the Dutch Nationaal Cyber Security Centrum (NCSC) is putting administrators of Check Point Security Gateways on high alert. Two critical vulnerabilities in Check Point VPN technology, tracked as CVE-2026-85102 and CVE-2026-85103,…

undercodenews.com/critical-che

##

cR0w at 2026-09-12T14:18:21.659Z ##

ncsc.nl/alerts/kritieke-kwetsb

Er zijn 2 kritieke kwetsbaarheden in Check Point VPN-producten, met de kenmerken CVE-2026-85102 en CVE-2026-85103. Het gaat om 2 ernstige kwetsbaarheden met een CVSS-score van 9,8. Het NCSC beoordeelt de kans op misbruik en de mogelijke schade als hoog en verwacht dat er snel pogingen tot misbruik zullen plaatsvinden, het advies is dan ook om de updates zo snel mogelijk te installeren.

Translated by LibreWolf:

There are 2 critical vulnerabilities in Check Point VPN products, with the characteristics CVE-2026-85102 and CVE-2026-85103. This concerns 2 serious vulnerabilities with a CVSS score of 9.8. The NCSC assesses the risk of abuse and possible damage as high and expects that attempts at abuse will take place quickly, so the advice is to install the updates as quickly as possible.

##

guru@thecybersecguru.com at 2026-09-13T13:02:46.000Z ##

Check Point patches two critical VPN gateway flaws scoring 9.8 on CVSS

Check Point patches two critical VPN vulnerabilities, CVE-2026-85102 and CVE-2026-85103, rated CVSS 9.8 and capable of unauthenticated remote code execution

thecybersecguru.com/news/check

##

daniel1820815@infosec.exchange at 2026-09-13T10:08:42.000Z ##

@cyberwald Bevor man hier einen Hersteller zu CVEs verurteilt, sollte man vielleicht tiefer recherchieren und dazu ein paar Fakten hinzufügen.

Beide Schwachstellen wurden intern entdeckt und bis zur Veröffentlichung gab es keine Hinweise darauf, dass sie in freier Wildbahn ausgenutzt wurden. Weiterhin gab es zu jedem CVE direkt entsprechende Anweisungen und Patches:

Darüber hinaus gibt es mittlerweile die Funktion Check Point Live Patch (CPLP), welches ein im Betriebssystem Gaia enthaltener Dienst zur Bereitstellung von Abwehrmaßnahmen ist. Es schließt kritische Schwachstellen im laufenden Betrieb durch gezielte In-Memory-Korrekturen (Live-Patches). -> support.checkpoint.com/results

#CheckPoint #CheckpointsoftwareTechnologies
#CheckPointsw
#CVE #CVE202685102 #CVE202685103

##

cR0w@infosec.exchange at 2026-09-12T14:18:21.000Z ##

ncsc.nl/alerts/kritieke-kwetsb

Er zijn 2 kritieke kwetsbaarheden in Check Point VPN-producten, met de kenmerken CVE-2026-85102 en CVE-2026-85103. Het gaat om 2 ernstige kwetsbaarheden met een CVSS-score van 9,8. Het NCSC beoordeelt de kans op misbruik en de mogelijke schade als hoog en verwacht dat er snel pogingen tot misbruik zullen plaatsvinden, het advies is dan ook om de updates zo snel mogelijk te installeren.

Translated by LibreWolf:

There are 2 critical vulnerabilities in Check Point VPN products, with the characteristics CVE-2026-85102 and CVE-2026-85103. This concerns 2 serious vulnerabilities with a CVSS score of 9.8. The NCSC assesses the risk of abuse and possible damage as high and expects that attempts at abuse will take place quickly, so the advice is to install the updates as quickly as possible.

##

jbhall56@infosec.exchange at 2026-09-11T13:56:38.000Z ##

Tracked as CVE-2026-85102 and CVE-2026-85103, the flaws could be exploited for remote code execution. securityweek.com/check-point-p

##

CVE-2026-85102
(9.8 CRITICAL)

EPSS: 0.33%

updated 2026-09-09T15:35:15

10 posts

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

netsecio@mastodon.social at 2026-09-13T16:23:48.000Z ##

📰 Check Point patches two critical 9.8 CVSS flaws in VPN products

Check Point patches two critical 9.8 CVSS vulnerabilities (CVE-2026-85102, CVE-2026-85103) in its VPN products. Flaws could allow unauthenticated RCE. Admins are urged to apply hotfixes immediately. #CyberSecurity #Vulnerability #VPN #PatchNow

🔗 cyber.netsecops.io/articles/ch

##

guru@thecybersecguru.com at 2026-09-13T13:02:46.000Z ##

Check Point patches two critical VPN gateway flaws scoring 9.8 on CVSS

Check Point patches two critical VPN vulnerabilities, CVE-2026-85102 and CVE-2026-85103, rated CVSS 9.8 and capable of unauthenticated remote code execution

thecybersecguru.com/news/check

##

daniel1820815 at 2026-09-13T10:08:42.324Z ##

@cyberwald Bevor man hier einen Hersteller zu CVEs verurteilt, sollte man vielleicht tiefer recherchieren und dazu ein paar Fakten hinzufügen.

Beide Schwachstellen wurden intern entdeckt und bis zur Veröffentlichung gab es keine Hinweise darauf, dass sie in freier Wildbahn ausgenutzt wurden. Weiterhin gab es zu jedem CVE direkt entsprechende Anweisungen und Patches:

Darüber hinaus gibt es mittlerweile die Funktion Check Point Live Patch (CPLP), welches ein im Betriebssystem Gaia enthaltener Dienst zur Bereitstellung von Abwehrmaßnahmen ist. Es schließt kritische Schwachstellen im laufenden Betrieb durch gezielte In-Memory-Korrekturen (Live-Patches). -> support.checkpoint.com/results



##

Analyst207@mastodon.social at 2026-09-12T14:37:55.000Z ##

Dutch NCSC Warns of Imminent Check Point VPN Flaw Exploitation

The Dutch National Cyber Security Centrum is warning organizations to act fast - two critical flaws in Check Point VPN, tracked as CVE-2026-85102 and CVE-2026-85103, are likely to be exploited soon, with potentially severe consequences. Install security updates as soon as possible to protect yourself.

osintsights.com/dutch-ncsc-war

#CheckPointVpn #Cve202685102 #Cve202685103 #EmergingThreats #NationState

##

undercodenews@mastodon.social at 2026-09-12T14:35:56.000Z ##

Critical Check Point VPN Flaws Could Soon Trigger Remote Attacks, Dutch Cyber Agency Warns + Video

Critical Check Point VPN Flaws Could Soon Trigger Remote Attacks, Dutch Cyber Agency Warns A Dangerous Window Is Opening A new warning from the Dutch Nationaal Cyber Security Centrum (NCSC) is putting administrators of Check Point Security Gateways on high alert. Two critical vulnerabilities in Check Point VPN technology, tracked as CVE-2026-85102 and CVE-2026-85103,…

undercodenews.com/critical-che

##

cR0w at 2026-09-12T14:18:21.659Z ##

ncsc.nl/alerts/kritieke-kwetsb

Er zijn 2 kritieke kwetsbaarheden in Check Point VPN-producten, met de kenmerken CVE-2026-85102 en CVE-2026-85103. Het gaat om 2 ernstige kwetsbaarheden met een CVSS-score van 9,8. Het NCSC beoordeelt de kans op misbruik en de mogelijke schade als hoog en verwacht dat er snel pogingen tot misbruik zullen plaatsvinden, het advies is dan ook om de updates zo snel mogelijk te installeren.

Translated by LibreWolf:

There are 2 critical vulnerabilities in Check Point VPN products, with the characteristics CVE-2026-85102 and CVE-2026-85103. This concerns 2 serious vulnerabilities with a CVSS score of 9.8. The NCSC assesses the risk of abuse and possible damage as high and expects that attempts at abuse will take place quickly, so the advice is to install the updates as quickly as possible.

##

guru@thecybersecguru.com at 2026-09-13T13:02:46.000Z ##

Check Point patches two critical VPN gateway flaws scoring 9.8 on CVSS

Check Point patches two critical VPN vulnerabilities, CVE-2026-85102 and CVE-2026-85103, rated CVSS 9.8 and capable of unauthenticated remote code execution

thecybersecguru.com/news/check

##

daniel1820815@infosec.exchange at 2026-09-13T10:08:42.000Z ##

@cyberwald Bevor man hier einen Hersteller zu CVEs verurteilt, sollte man vielleicht tiefer recherchieren und dazu ein paar Fakten hinzufügen.

Beide Schwachstellen wurden intern entdeckt und bis zur Veröffentlichung gab es keine Hinweise darauf, dass sie in freier Wildbahn ausgenutzt wurden. Weiterhin gab es zu jedem CVE direkt entsprechende Anweisungen und Patches:

Darüber hinaus gibt es mittlerweile die Funktion Check Point Live Patch (CPLP), welches ein im Betriebssystem Gaia enthaltener Dienst zur Bereitstellung von Abwehrmaßnahmen ist. Es schließt kritische Schwachstellen im laufenden Betrieb durch gezielte In-Memory-Korrekturen (Live-Patches). -> support.checkpoint.com/results

#CheckPoint #CheckpointsoftwareTechnologies
#CheckPointsw
#CVE #CVE202685102 #CVE202685103

##

cR0w@infosec.exchange at 2026-09-12T14:18:21.000Z ##

ncsc.nl/alerts/kritieke-kwetsb

Er zijn 2 kritieke kwetsbaarheden in Check Point VPN-producten, met de kenmerken CVE-2026-85102 en CVE-2026-85103. Het gaat om 2 ernstige kwetsbaarheden met een CVSS-score van 9,8. Het NCSC beoordeelt de kans op misbruik en de mogelijke schade als hoog en verwacht dat er snel pogingen tot misbruik zullen plaatsvinden, het advies is dan ook om de updates zo snel mogelijk te installeren.

Translated by LibreWolf:

There are 2 critical vulnerabilities in Check Point VPN products, with the characteristics CVE-2026-85102 and CVE-2026-85103. This concerns 2 serious vulnerabilities with a CVSS score of 9.8. The NCSC assesses the risk of abuse and possible damage as high and expects that attempts at abuse will take place quickly, so the advice is to install the updates as quickly as possible.

##

jbhall56@infosec.exchange at 2026-09-11T13:56:38.000Z ##

Tracked as CVE-2026-85102 and CVE-2026-85103, the flaws could be exploited for remote code execution. securityweek.com/check-point-p

##

CVE-2026-86218
(9.8 CRITICAL)

EPSS: 0.74%

updated 2026-09-09T05:18:19.490000

2 posts

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

2 repos

https://github.com/jithinkrishnanrs/CVE-2026-86218-N-central-IOC-Toolkit

https://github.com/HORKimhab/CVE-2026-86218

threatcodex at 2026-09-12T18:13:24.202Z ##

CVE-2026-86218: Active Exploitation of N-able N-central: Critical Pre-Auth Remote Code Execution (RCE) Vulnerability

arcticwolf.com/resources/blog/

##

threatcodex@infosec.exchange at 2026-09-12T18:13:24.000Z ##

CVE-2026-86218: Active Exploitation of N-able N-central: Critical Pre-Auth Remote Code Execution (RCE) Vulnerability
#N_central #CVE_2026_86218
arcticwolf.com/resources/blog/

##

CVE-2026-85880
(7.8 HIGH)

EPSS: 0.57%

updated 2026-09-09T05:18:19.193000

1 posts

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

PC_Fluesterer@social.tchncs.de at 2026-09-11T15:02:15.000Z ##

Die allerschlechteste Kombination: Chrome und Windows

Wer sich wundert, weshalb Chromium und und daraus abgeleitete Browser (Chrome, Edge, Opera, Vivaldi) schon wieder Updates erhalten, hier ist die Erklärung. Ein Sicherheitsunternehmen hat entdeckt, dass mindestens vier Gruppen von Cybergangstern eine Kette von Sicherheitslücken nutzen, um in Institution (Firmen, Behörden) vor allem in den USA und Südostasien einzudringen. Die Angreifer verketten zwei Sicherheitslücken in Chrome (CVE-2026-85046 und ein Sandkasten-Ausbruch ohne CVE-Nummer) mit einer in Windows (CVE-2026-85880). Die Lücke in Windows wurde gerade geflickt. ... Weiterlesen:

pc-fluesterer.info/wordpress/2

#0day #browser #chrome #cybercrime #exploits #Microsoft #sicherheit #spionage #unplugMicrosoft #UnplugTrump #windows

##

CVE-2026-86100
(6.4 MEDIUM)

EPSS: 0.19%

updated 2026-09-08T20:05:53.177000

1 posts

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services.

hugovalters@mastodon.social at 2026-09-13T09:50:16.000Z ##

CVE-2026-86100: Camaleon CMS SSRF via media upload redirect bypass. Versions 2.7.5-2.9.1 expose internal services to authenticated attackers. CVSS 6.4. Unpatched—act now. Details: valtersit.com/cve/CVE-2026-861 #CVE #infosec

##

CVE-2026-86426
(0 None)

EPSS: 1.41%

updated 2026-09-08T19:57:49.663000

1 posts

LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access protected endpoints by sending numeric values instead of string tokens. Attackers can exploit MySQL type coercion by sending small integers like 0 through 9 to match token hashes, gaining access to API functionality including device credentials and administrative f

Nuclei template

halildeniz@mastodon.social at 2026-09-12T13:14:20.000Z ##

🚨 Critical Security Alert!
Deep-dive vulnerability analysis of CVE-2026-86426 (CVSS 9.2): Unauthenticated API Access & RCE in LibreNMS <= 26.7.0 caused by JSON type confusion & MySQL coercion.

denizhalil.com/2026/09/12/cve-

#CyberSecurity #Vulnerability #LibreNMS

##

CVE-2026-78849
(0 None)

EPSS: 0.26%

updated 2026-09-08T19:42:20.313000

1 posts

Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote attacker to execute arbitrary code via the captive_portal_status.widget.php file

hugovalters@mastodon.social at 2026-09-12T15:00:03.000Z ##

CVE-2026-78849 - XSS in Netgate pfSense (Plus <=26.03 & CE <=2.8.1). Remote code execution via captive_portal_status.widget.php. Unpatched. CVSS N/A. Isolate exposed firewalls & monitor logs. Details: valtersit.com/cve/CVE-2026-788 #CVE #pfSense #infosec

##

CVE-2026-69827
(8.1 HIGH)

EPSS: 0.53%

updated 2026-09-08T18:33:26

1 posts

Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.

shaknais@mastodon.social at 2026-09-11T23:11:45.000Z ##

@hrbrmstr

MS selling "MDASH" as having fixed their TCP/IP stack, a day after a critical DNS CVE comes out without a fix.

cve.org/CVERecord?id=CVE-2026-

##

CVE-2026-69730
(9.8 CRITICAL)

EPSS: 1.05%

updated 2026-09-08T18:33:07

2 posts

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

CVE-2026-13297
(7.5 HIGH)

EPSS: 0.25%

updated 2026-09-08T18:32:45

1 posts

IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack.

hugovalters@mastodon.social at 2026-09-13T14:30:02.000Z ##

CVE-2026-13297: IBM Verify Identity Access (AAC) risks info disclosure. CVSS N/A, patch status unknown. If you use it, audit exposure now. Details: valtersit.com/cve/CVE-2026-132 #CVE #infosec #IBM

##

CVE-2026-46636
(0 None)

EPSS: 0.36%

updated 2026-09-08T18:17:37.770000

1 posts

Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a Markup-derived class into a sandboxed template (typically to mark a chunk of HTML as safe) inadvertently e

hugovalters@mastodon.social at 2026-09-12T03:50:03.000Z ##

CVE-2026-46636: Twig <3.27.0 sandbox bypass—subclasses of Twig\Markup expose all public methods, allowing arbitrary code execution. CVSS N/A, fix available. Update immediately to 3.27.0+. valtersit.com/cve/CVE-2026-466 #CVE #infosec #PHP

##

CVE-2026-78745
(9.8 CRITICAL)

EPSS: 0.72%

updated 2026-09-08T15:31:35

1 posts

An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge (ADB) daemon (adbd)

1 repos

https://github.com/n0c71v3x/CVE-2026-78745

hugovalters@mastodon.social at 2026-09-12T21:20:05.000Z ##

CVE-2026-78745: Unpatched flaw in HiDPT Android (Hi3751V350/V352E) allows remote code execution via ADB daemon. Risk is critical if ADB exposed. CVSS N/A. Check exposure and restrict ADB now. Details: valtersit.com/cve/CVE-2026-787 #CVE #Android #infosec

##

PC_Fluesterer@social.tchncs.de at 2026-09-11T15:02:15.000Z ##

Die allerschlechteste Kombination: Chrome und Windows

Wer sich wundert, weshalb Chromium und und daraus abgeleitete Browser (Chrome, Edge, Opera, Vivaldi) schon wieder Updates erhalten, hier ist die Erklärung. Ein Sicherheitsunternehmen hat entdeckt, dass mindestens vier Gruppen von Cybergangstern eine Kette von Sicherheitslücken nutzen, um in Institution (Firmen, Behörden) vor allem in den USA und Südostasien einzudringen. Die Angreifer verketten zwei Sicherheitslücken in Chrome (CVE-2026-85046 und ein Sandkasten-Ausbruch ohne CVE-Nummer) mit einer in Windows (CVE-2026-85880). Die Lücke in Windows wurde gerade geflickt. ... Weiterlesen:

pc-fluesterer.info/wordpress/2

#0day #browser #chrome #cybercrime #exploits #Microsoft #sicherheit #spionage #unplugMicrosoft #UnplugTrump #windows

##

CVE-2026-80883
(0 None)

EPSS: 0.16%

updated 2026-09-07T15:17:33.310000

1 posts

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered The host1x_client_register() function is called just prior to register map initialization loop, making the device available to userspace. This may result in userspace attempting to submits a job before the register map is initialized. Addres

hugovalters@mastodon.social at 2026-09-13T03:30:34.000Z ##

CVE-2026-80883: Linux kernel flaw in drm/tegra gr2d/gr3d. Potential race condition lets userspace submit jobs before register map init—can lead to crashes or privilege issues. Unpatched; impact uncertain. If you run Tegra, test valtersit.com/cve/CVE-2026-808

##

CVE-2026-85636
(5.3 MEDIUM)

EPSS: 0.43%

updated 2026-09-04T18:31:46

1 posts

A vulnerability was identified in jofpin trape 1.0.0. Affected by this vulnerability is an unknown functionality of the file core/stats.py of the component Login Endpoint. The manipulation leads to missing authentication. The attack may be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not respo

hugovalters@mastodon.social at 2026-09-13T11:20:02.000Z ##

CVE-2026-85636: Missing authentication in Trape 1.0.0 (core/stats.py Login Endpoint). Remote exploit is public; project unpatched and unresponsive. CVSS 5.3. If you run Trape, assume compromise and isolate now. Details: valtersit.com/cve/CVE-2026-856 #CVE #infosec

##

CVE-2026-80909(CVSS UNKNOWN)

EPSS: 0.17%

updated 2026-09-04T18:31:46

1 posts

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reject UVD message with invalid number of h265 refs Same change as for h264, avoids overflow later when calculating min dpb size. (cherry picked from commit a4b0720e4f1601f97f59a2be9c1b4b94fa6527d5)

hugovalters@mastodon.social at 2026-09-13T05:10:12.000Z ##

CVE-2026-80909 affects Linux kernel drm/amdgpu: UVD messages with invalid h265 refs can trigger an overflow. Potential for local DoS or memory corruption. CVSS not assigned, patch unknown. Update your kernel once a fix is available. valtersit.com/cve/CVE-2026-809

##

CVE-2026-80901(CVSS UNKNOWN)

EPSS: 0.16%

updated 2026-09-04T18:31:46

1 posts

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix the checksum validations ip_vs_in_icmp_v6() is missing checksum validation for ICMPv6 packets from clients. In fact, as for TCP/UDP we should validate the checksum for ICMP packets only when we mangle the packets on MASQ or on reply for tunnel. Also, Sashiko points out that handle_response_icmp() being common for IPv4

hugovalters@mastodon.social at 2026-09-13T03:30:01.000Z ##

CVE-2026-80901: Linux kernel IPVS flaw allows unvalidated ICMPv6 checksums, risking packet manipulation in MASQ/tunnel setups. Unpatched & unknown CVSS—treat as high risk. Patch status unclear, so audit your kernel now. Details: valtersit.com/cve/CVE-2026-809 #CVE

##

CVE-2026-80890(CVSS UNKNOWN)

EPSS: 0.18%

updated 2026-09-04T18:31:46

1 posts

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp_unpack_cookie() skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing association, Section 5.2.4 permits an expired State Cookie only when both Verification Tags in th

hugovalters@mastodon.social at 2026-09-12T18:10:13.000Z ##

CVE-2026-80890: Linux kernel SCTP flaw allows stale cookies with mismatched verification tags to bypass checks, risking connection hijacking or DoS. CVSS N/A, unpatched. Patch when available; audit SCTP exposure now. valtersit.com/cve/CVE-2026-808 #CVE #infosec #Li

##

CVE-2026-80907(CVSS UNKNOWN)

EPSS: 0.16%

updated 2026-09-04T18:31:46

1 posts

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix UVD dpb min size calculation for H264 This should use actual number of references from the decode message, instead of maximum derived from level. (cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856)

hugovalters@mastodon.social at 2026-09-12T04:00:03.000Z ##

CVE-2026-80907: Linux kernel amdgpu UVD dpb size miscalc for H264 could trigger memory corruption. Unpatched—CVSS N/A. If you run AMD GPUs, verify your kernel build now. valtersit.com/cve/CVE-2026-809 #CVE #Linux #infosec

##

CVE-2026-80880(CVSS UNKNOWN)

EPSS: 0.16%

updated 2026-09-04T18:31:40

1 posts

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Properly support implicit ODP rereg_mr Due to all the child mkeys in the implicit ODP configuration we cannot change anything in place for the parent mkey. Instead the whole thing needs to be rebuilt if any change is requested. If the user does not specify a translation then force the implicit values which will then fal

hugovalters@mastodon.social at 2026-09-12T16:30:03.000Z ##

CVE-2026-80880: Linux kernel flaw in IB/mlx5 implicit ODP mkey handling. Exploitable to corrupt memory or crash systems—impact not fully disclosed. CVSS N/A, no patch available. Track this actively; test mitigations, restrict valtersit.com/cve/CVE-2026-808

##

CVE-2026-17444
(5.3 MEDIUM)

EPSS: 0.29%

updated 2026-09-04T18:31:40

1 posts

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection.

hugovalters@mastodon.social at 2026-09-12T13:30:02.000Z ##

CVE-2026-17444: XXE in IBM App Connect Enterprise & Integration Bus (CVSS 5.3). Remote authenticated attacker can leak sensitive data via XML injection. Impact hits versions 13.0.1.0-13.0.8.1, 12.0.1.0-12.0.12.28, & z/OS 10.1.0.x. valtersit.com/cve/CVE-2026-174

##

CVE-2026-17622
(6.5 MEDIUM)

EPSS: 0.49%

updated 2026-09-04T18:31:40

1 posts

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

hugovalters@mastodon.social at 2026-09-12T05:40:02.000Z ##

CVE-2026-17622 IBM Langflow 1.0.0-1.10.2: path traversal flaw lets remote authenticated attackers read sensitive files. CVSS 6.5. Unpatched—assume risk now. Restrict access or isolate instances immediately. Details: valtersit.com/cve/CVE-2026-176 #CVE #infosec #IBM

##

CVE-2026-16689
(6.2 MEDIUM)

EPSS: 0.11%

updated 2026-09-04T18:31:39

1 posts

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials.

hugovalters@mastodon.social at 2026-09-12T11:50:56.000Z ##

CVE-2026-16689: IBM App Connect Enterprise & Integration Bus log credentials improperly, letting local attackers steal sensitive info. CVSS 6.2. Unpatched—check your versions now. Patch immediately. valtersit.com/cve/CVE-2026-166 #CVE #ibm #infosec

##

CVE-2026-80871(CVSS UNKNOWN)

EPSS: 0.15%

updated 2026-09-04T18:31:34

1 posts

In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx-trng - Remove crypto_rng interface Implementing the crypto_rng interface has no purpose, as it isn't used in practice. It's being removed from other drivers too. Just remove it. This leaves hwrng, which is actually used. Tagging with 'Cc stable' due to the bugs that this removes: - xtrng_trng_generate() som

hugovalters@mastodon.social at 2026-09-12T19:40:06.000Z ##

CVE-2026-80871: Linux kernel crypto/xilinx-trng bug—removed crypto_rng interface that could return success without filling buffers. Potential data integrity risk. CVSS: N/A. Patch status unclear—check your kernel. Details: valtersit.com/cve/CVE-2026-808 Update kern

##

CVE-2026-18073
(4.4 MEDIUM)

EPSS: 0.10%

updated 2026-09-04T18:31:31

1 posts

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements.

hugovalters@mastodon.social at 2026-09-13T16:00:01.000Z ##

CVE-2026-18073 IBM i 7.3-7.6: local authenticated attacker can inject parameters into a CL command (improper input neutralization). CVSS 4.4. No patch yet—assume risk. Restrict local access & monitor. Details: valtersit.com/cve/CVE-2026-180 #CVE #IBM #infosec

##

CVE-2026-80913
(0 None)

EPSS: 0.17%

updated 2026-09-04T18:18:01.200000

1 posts

In the Linux kernel, the following vulnerability has been resolved: selinux: require every boolean value to be defined p_bools.nprim comes from the policy image independently of how many booleans follow it, and cond_index_bool() fills bool_val_to_struct[] at value - 1, so a count larger than the values present leaves NULL entries. Every user of that array then walks it by index and dereferences

hugovalters@mastodon.social at 2026-09-13T08:10:01.000Z ##

CVE-2026-80913: Linux kernel SELinux flaw – missing boolean definition check can lead to NULL deref. Potential crash/privilege issues. CVSS: N/A. Patch status unknown – treat as unpatched. Review & update kernels now. valtersit.com/cve/CVE-2026-809 #CVE #Linux #inf

##

CVE-2026-80912
(0 None)

EPSS: 0.16%

updated 2026-09-04T18:18:01.047000

1 posts

In the Linux kernel, the following vulnerability has been resolved: selinux: reject an unclaimed class value in security_get_classes() security_get_classes() sizes an array by p_classes.nprim and fills it at value - 1, so a class value the policy never defines leaves a NULL. sel_make_classes() passes every entry to sel_make_dir(), reaching the same d_alloc_name() dereference as the permission ar

hugovalters@mastodon.social at 2026-09-13T20:50:05.000Z ##

CVE-2026-80912: Linux kernel SELinux flaw—a NULL deref via an unclaimed class value can crash the system. CVSS: N/A, unpatched. If you run SELinux, review your policy and wait for the fix. Patch ASAP when available. valtersit.com/cve/CVE-2026-809 #CVE #Linux #infos

##

CVE-2026-80904
(0 None)

EPSS: 0.16%

updated 2026-09-04T18:17:59.983000

1 posts

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tls_sw_splice_read() after a failed async decrypt When an async decrypt fails, tls_decrypt_done() records the error in ctx->async_wait.err and calls tls_err_abort(), which stores it in sk_err. tls_sw_recvmsg() and tls_sw_read_sock() each read async_wait.err once they hold the reader lock and fail the call: a record

hugovalters@mastodon.social at 2026-09-13T19:10:14.000Z ##

CVE-2026-80904 Linux kernel TLS flaw: failed async decrypt can bypass splice_read check, breaking connection authentication. CVSS N/A, unpatched. If you rely on kernel TLS splicing, audit exposure now. Update once fix lands. valtersit.com/cve/CVE-2026-809 #CVE #inf

##

CVE-2026-80894
(0 None)

EPSS: 0.17%

updated 2026-09-04T18:17:57.603000

1 posts

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace iommufd_hwpt_replace_device() calls: iommufd_auto_response_faults(hwpt, old_handle); passing the *new* hwpt together with the handle of the device's *old* domain. This should be a parameter mismatch: 1. Semantically, iommufd_auto_response_faults(x, han

hugovalters@mastodon.social at 2026-09-13T06:40:18.000Z ##

CVE-2026-80894: Linux kernel iommufd flaw passes wrong hwpt on device replace, causing fault response mismatches. Impact unclear; CVSS N/A. Patch status unknown—assume risk. Check your kernel version and update immediately if a fix valtersit.com/cve/CVE-2026-808

##

CVE-2026-20212
(9.8 CRITICAL)

EPSS: 0.53%

updated 2026-09-02T18:32:26

1 posts

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with&nbsp;root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device and

1 repos

https://github.com/HORKimhab/CVE-2026-20212

dgchultaeiz@hachyderm.io at 2026-09-13T13:26:24.000Z ##

¿Seguimos confiando demasiado?

Anderson hablaba de confianza en seguridad informática a comienzos de los años 70.

Más de cincuenta años después tenemos Cloud, SaaS, Zero Trust, MFA, PAM, EDR y tecnologías que en aquella época hubieran parecido ciencia ficción.

Entonces me hice una pregunta:

¿El problema también cambió?

En lugar de buscar la respuesta en otro paper, decidí mirar algunas vulnerabilidades recientes:

CVE-2026-20079
CVE-2026-19490
CVE-2025-25249
CVE-2026-20212

Authentication bypass, problemas de memoria, componentes de infraestructura...

Vulnerabilidades técnicamente muy diferentes.

Pero hay una pregunta interesante que podemos hacerle a cada una:

¿Qué tuvo que asumir el sistema para que esa vulnerabilidad pudiera existir?

De eso hablaremos próximamente

¿Seguimos confiando demasiado? —
De Anderson a la Inteligencia Artificial

##

threatnoir at 2026-09-12T01:05:51.850Z ##

⚠️ CRITICAL: Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers are chaining multiple JFrog Artifactory vulnerabilities (CVE-2026-42018, CVE-2026-42016, CVE-2026-82329) to escalate from anonymous users to administrator control on self-hosted instances. This grants them ability to plant backdoors and execute arbitrary shell commands in your build pipel…

threatnoir.com/focus

🤖 AI generated summary

##

threatnoir@infosec.exchange at 2026-09-12T01:05:51.000Z ##

⚠️ CRITICAL: Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors

Attackers are chaining multiple JFrog Artifactory vulnerabilities (CVE-2026-42018, CVE-2026-42016, CVE-2026-82329) to escalate from anonymous users to administrator control on self-hosted instances. This grants them ability to plant backdoors and execute arbitrary shell commands in your build pipel…

threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

##

cyberworldops@infosec.exchange at 2026-09-11T18:30:01.000Z ##

Active exploitation chains CVE-2026-42018 and CVE-2026-42016 to bypass authentication on self-hosted JFrog Artifactory and deploy a Rust backdoor with C2. CVE-2026-82329 is also abused to create admin tokens. This enables full server takeover and supply chain compromise. #JFrog #Artifactory #SupplyChainSecurity

cyberworldops.eu/en/attackers-

##

CVE-2026-46331
(7.8 HIGH)

EPSS: 0.58%

updated 2026-09-02T13:17:55.903000

2 posts

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb

14 repos

https://github.com/Quaerendir/cve-2026-46331-audit

https://github.com/cherrycherrymay/PoC-CVE-2026-46331

https://github.com/MarwahHadi/CVE-2026-46331-pedit-cow

https://github.com/sgkdev/packet_edit_meme

https://github.com/V0IDNETWORK/CVE-2026-46331

https://github.com/rjt-gupta/page-cache-corruption-lpes

https://github.com/g0thamRabb1t/CVE-2026-46331-pedit-COW-detection

https://github.com/vulnquest58/dirtyclone-exploit

https://github.com/seguridadentrerios/CVE-2026-46331

https://github.com/yanxinwu946/CVE-2026-46331

https://github.com/douglasmun/pagecache-lpe-containment-kit

https://github.com/0xBlackash/CVE-2026-46331

https://github.com/HORKimhab/CVE-2026-46331

https://github.com/nawalacheker1/CVE-2026-46331

CVE-2026-81578
(9.8 CRITICAL)

EPSS: 1.62%

updated 2026-08-31T21:31:56

1 posts

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.

2 repos

https://github.com/yora1928/PaperCut-CVE-2026-81578-82078

https://github.com/virologi-info/papercut-toolkit

offseq@infosec.exchange at 2026-09-11T09:00:25.000Z ##

PaperCut NG/MF hit by CRITICAL zero-days (CVE-2026-82078, CVE-2026-81578) exploited in AI-driven attacks. Remote code exec, credential theft, & domain admin escalation seen on 440+ deployments. Patch ASAP. Details: radar.offseq.com/threat/paperc #OffSeq #PaperCut #ZeroDay #BlueTeam

##

CVE-2026-82078
(9.1 CRITICAL)

EPSS: 1.69%

updated 2026-08-31T21:31:56

1 posts

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on

2 repos

https://github.com/yora1928/PaperCut-CVE-2026-81578-82078

https://github.com/virologi-info/papercut-toolkit

offseq@infosec.exchange at 2026-09-11T09:00:25.000Z ##

PaperCut NG/MF hit by CRITICAL zero-days (CVE-2026-82078, CVE-2026-81578) exploited in AI-driven attacks. Remote code exec, credential theft, & domain admin escalation seen on 440+ deployments. Patch ASAP. Details: radar.offseq.com/threat/paperc #OffSeq #PaperCut #ZeroDay #BlueTeam

##

CVE-2026-59310
(9.8 CRITICAL)

EPSS: 45.88%

updated 2026-08-18T18:32:52

2 posts

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

2 repos

https://github.com/BiuTrap/CVE-2026-59310

https://github.com/HORKimhab/CVE-2026-59310

kev_Stalker at 2026-09-12T13:15:13.740Z ##

CVE-2026-59310 - Changed to Known Ransomware Status

Broadcom VMware vCenter Path Traversal VulnerabilityVendor: BroadcomProduct: VMware vCenterBroadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.Status changed from Unknown to Known for ransomware campaign usage.Flip detected on: September 11, 2026 at 16:08:17 UTCDate Added to KEV: nvd.nist.gov/vuln/detail/CVE-2

##

kev_Stalker@infosec.exchange at 2026-09-12T13:15:13.000Z ##

CVE-2026-59310 - Changed to Known Ransomware Status

Broadcom VMware vCenter Path Traversal VulnerabilityVendor: BroadcomProduct: VMware vCenterBroadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.Status changed from Unknown to Known for ransomware campaign usage.Flip detected on: September 11, 2026 at 16:08:17 UTCDate Added to KEV: nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2026-50768
(9.8 CRITICAL)

EPSS: 0.45%

updated 2026-08-17T21:32:25

1 posts

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function.

DO3EET@mastodon.hams.social at 2026-09-13T09:50:43.000Z ##

@bsi Update zum Klärungsversuch bzgl. CVE-2026-50768:
Im Henkel-Repo heißt es zwar freundlich "For any inquiries or further details, feel free to reach out to us." – in der Praxis sind PRs, Issues & Diskussionen dicht und Kontaktinfos fehlen völlig.

Wie betreibt man eigentlich #ResponsibleDisclosure, wenn man offiziell zum Dialog einlädt, aber sämtliche Feedback-Türen fest verriegelt? 😉

#HenkelAG #Henkel #CyberSecurity #InfoSec #AppSec #ITSec #GitHub #Sicherheit #BugBounty #CVE

##

CVE-2026-61511
(9.8 CRITICAL)

EPSS: 70.77%

updated 2026-08-07T06:16:56.993000

2 posts

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style

Nuclei template

5 repos

https://github.com/tc4dy/CVE-2026-61511-PoC-Exploit

https://github.com/codeb0ssx/Ultimate-CVE-2026-61511

https://github.com/puj790201-lab/cve-2026-61511

https://github.com/HORKimhab/CVE-2026-61511

https://github.com/shootcannon/CVE-2026-61511

_r_netsec at 2026-09-13T17:43:13.028Z ##

[CVE-2026-61511] vBulletin <= 6.2.1 (runMaths) Pre-Auth RCE Vulnerability karmainsecurity.com/KIS-2026-13

##

_r_netsec@infosec.exchange at 2026-09-13T17:43:13.000Z ##

[CVE-2026-61511] vBulletin <= 6.2.1 (runMaths) Pre-Auth RCE Vulnerability karmainsecurity.com/KIS-2026-13

##

CVE-2026-20316
(5.3 MEDIUM)

EPSS: 11.15%

updated 2026-07-29T21:31:00

1 posts

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presence of static user credentials for a low-privileged&nbsp;account. An attacker could exploit this vuln

kev_Stalker@infosec.exchange at 2026-09-11T11:36:27.000Z ##

CVE-2026-20316 - Changed to Known Ransomware Status

Cisco Secure Firewall Management Center Use of Hard-coded Password VulnerabilityVendor: CiscoProduct: Secure Firewall Management Center (FMC)Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged nvd.nist.gov/vuln/detail/CVE-2

##

CVE-2026-50458
(7.8 HIGH)

EPSS: 0.26%

updated 2026-07-22T16:17:59.653000

2 posts

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

CVE-2026-49176
(7.8 HIGH)

EPSS: 0.47%

updated 2026-07-22T16:17:28.753000

2 posts

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

2 repos

https://github.com/DavidCarliez/CVE-2026-49176_LPE_POC

https://github.com/777erp/CVE-2026-49176_BOF

CVE-2026-15409
(10.0 CRITICAL)

EPSS: 84.54%

updated 2026-07-14T21:32:22

1 posts

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

Nuclei template

6 repos

https://github.com/Ch4120N/CVE-2026-15409

https://github.com/MrRawBit/SonicWall-SMA1000-Zero-Day-IoC-Check

https://github.com/remmons-r7/rapid7-CVE-2026-15409

https://github.com/tc4dy/CVE-2026-15409-15410-Framework

https://github.com/0xBlackash/CVE-2026-15409

https://github.com/HORKimhab/CVE-2026-15409

cyberworldops@infosec.exchange at 2026-09-11T20:30:00.000Z ##

Borough Council of King's Lynn and West Norfolk incident linked with moderate confidence to mass exploitation of CVE-2026-15409 in SonicWall SMA1000. Unauthenticated SSRF in WorkPlace WebSocket proxy chains to RCE and LDAP credential theft, enabling pivot into internal networks. Exposed systems require immediate patching and compromise hunting. #SonicWall #Sma1000 #InfoSec

cyberworldops.eu/en/uk-council

##

CVE-2026-50013
(7.5 HIGH)

EPSS: 0.27%

updated 2026-07-14T18:03:10

1 posts

### Summary: When Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed concurrently (the normal case for any proxy), the concurrent map writes trigger Go's built-in race detector which causes a `fatal error: concurrent map read and map write`, immediately killing the e

thehackerwire@mastodon.social at 2026-09-11T23:00:09.000Z ##

🟠 CVE-2026-50013 - High (7.5)

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests ...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-54174
(8.3 HIGH)

EPSS: 0.10%

updated 2026-07-10T21:43:06

1 posts

Previously, Apko verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.

thehackerwire@mastodon.social at 2026-09-11T21:59:51.000Z ##

🟠 CVE-2026-54174 - High (8.3)

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never ver...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-52777(CVSS UNKNOWN)

EPSS: 0.21%

updated 2026-07-09T21:02:59

1 posts

## Details ### Sink `tools/bazar/services/CSVManager.php` line 372-399: ``` public function importEntry(array $importedEntries, string $formId): ?array { if (!$this->importdone) { // ... foreach ($importedEntries as $entry) { $entry = unserialize(base64_decode($entry)); // <-- SINK $entry = array_map('strval', $entry); // ... ``` There

hugovalters@mastodon.social at 2026-09-12T01:20:02.000Z ##

CVE-2026-52777: Authenticated PHP object injection via unserialize in YesWiki's BazarImportAction. CVSS N/A, unpatched pre-4.6.6. Attackers can exploit to execute arbitrary code. Update immediately to 4.6.6. valtersit.com/cve/CVE-2026-527 #CVE #infosec #YesWiki

##

CVE-2026-57239
(8.2 HIGH)

EPSS: 0.17%

updated 2026-07-09T15:33:27

2 posts

The user-controllable executable files will be directly executed by high-privilege processes, allowing low-privilege users to have the opportunity to elevate their privileges to NT AUTHORITY\SYSTEM.

1 repos

https://github.com/Paradoxis/CVE-2026-57239

CVE-2026-49464
(8.1 HIGH)

EPSS: 0.20%

updated 2026-07-08T21:12:01

1 posts

## Impact In versions from 1.5.0 up to and including 3.0.0, any authenticated portal user could complete and tamper with another user's open task by submitting it on their behalf. The task submission endpoint accepted a task ID and a payload, but it never checked whether the task actually belonged to the user making the call. An attacker who held a valid login (a normal `burger` OAuth token) and

thehackerwire@mastodon.social at 2026-09-11T22:00:00.000Z ##

🟠 CVE-2026-49464 - High (8.1)

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 through 3.0.0 fails to verify own...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-28576
(5.5 MEDIUM)

EPSS: 0.15%

updated 2026-06-17T16:43:32.927000

1 posts

In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

1 repos

https://github.com/mobilehackinglab/CVE-2026-28576-poc

CVE-2024-1813
(9.8 CRITICAL)

EPSS: 1.22%

updated 2026-06-17T07:05:03.993000

2 posts

The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could al

1 repos

https://github.com/MobetaSec/CVE-2024-1813-POC

_r_netsec at 2026-09-13T17:43:15.196Z ##

Simple Job Board ≤ 2.11.0 - Unauthenticated RCE (CVE-2024-1813) mobeta.fr/simple-job-board-una

##

_r_netsec@infosec.exchange at 2026-09-13T17:43:15.000Z ##

Simple Job Board ≤ 2.11.0 - Unauthenticated RCE (CVE-2024-1813) mobeta.fr/simple-job-board-una

##

CVE-2026-4986
(5.3 MEDIUM)

EPSS: 0.20%

updated 2026-06-09T15:33:16

2 posts

The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticated attackers to forge webhook payloads and manipulate the payment state of arbitrary transactions.

2 repos

https://github.com/Ap0dexMe0/CVE-2026-49869

https://github.com/cyeezy08/Kimai-CVE-2026-49865-POC

CVE-2026-39987
(9.8 CRITICAL)

EPSS: 98.95%

updated 2026-04-27T16:30:09

1 posts

## Summary Marimo (19.6k stars) has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint `/terminal/ws` lacks authentication validation, allowing an unauthenticated attacker to obtain a full PTY shell and execute arbitrary system commands. Unlike other WebSocket endpoints (e.g., `/ws`) that correctly call `validate_auth()` for authentication, the `/terminal/ws` endpoint only checks the

Nuclei template

25 repos

https://github.com/rootdirective-sec/CVE-2026-39987-Lab

https://github.com/M3PH1569/CVE-2026-39987-POC

https://github.com/fevar54/marimo_CVE-2026-39987_RCE_PoC

https://github.com/h3raklez/CVE-2026-39987

https://github.com/MADA0L/CVE-2026-39987-Poc

https://github.com/HORKimhab/CVE-2026-39987

https://github.com/stapat1245/CVE-2026-39987-PoC

https://github.com/jasonbernier/CVE-2026-39987

https://github.com/Clara-M-Grossl/Exploit-Marimo

https://github.com/dodeepsink/CVE-2026-39987.py

https://github.com/vanhari/CVE-2026-39987

https://github.com/mki9/CVE-2026-39987_exploit

https://github.com/0xBlackash/CVE-2026-39987

https://github.com/Ghxstsec/CVE-2026-39987

https://github.com/0xdeadroot/CVE-2026-39987-marimo-rce

https://github.com/julichaan/CVE-2026-39987_POC

https://github.com/gbuyssens/CVE-2026-39987

https://github.com/iapetus12/cohort-htb

https://github.com/matesz44/cve-2026-39987

https://github.com/alreadyClosed/CVE-2026-39987

https://github.com/Dhiaelhak-Rached/CVE-2026-39987-lab-or-marimo-cve-lab

https://github.com/Nxploited/CVE-2026-39987

https://github.com/keraattin/CVE-2026-39987

https://github.com/K3ysTr0K3R/CVE-2026-39987

https://github.com/Wind010/CVE-2026-39987_PoC

undercodenews@mastodon.social at 2026-09-12T01:03:02.000Z ##

CVE-2026-39987 Turns Marimo Into a Fast-Track Gateway to SSH and Cloud Credentials + Video

CVE-2026-39987 Turns Marimo Into a Fast-Track Gateway to SSH and Cloud Credentials A Critical Marimo Flaw Is Becoming a Real-World Attack Weapon A vulnerability in the open-source marimo project has evolved from a serious software flaw into a practical intrusion route for attackers targeting cloud infrastructure. CVE-2026-39987 is a critical pre-authentication remote code…

undercodenews.com/cve-2026-399

##

tati@eldritch.cafe at 2026-09-12T06:56:03.000Z ##

wait, it's not a shitpost over on my other channel?? there's really an RCE in notepad ?!

cve.org/CVERecord?id=CVE-2026-

##

CVE-2026-51990
(0 None)

EPSS: 0.00%

6 posts

N/A

1 repos

https://github.com/HORKimhab/CVE-2026-51990

security_crawler_carl at 2026-09-13T18:52:46.501Z ##

🏆 New Achievement! One Click to the Food Chain Bottom!

Here, in the wild habitat of Windows enterprise environments, we observe the Sogou Input Method — a text entry tool installed by millions — standing perfectly still as UNC3569, a China-aligned espionage group, approaches from the brush. CVE-2026-51990 is a critical one-click remote code execution flaw exploiting an unsandboxed Chromium chain. The creature does not run. It simply... accepts the GrayRabbit backdoor. (1/2)

##

oversecurity@mastodon.social at 2026-09-13T15:20:36.000Z ##

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method...

🔗️ [Bleepingcomputer] link.is.it/DXBwPD

##

Analyst207@mastodon.social at 2026-09-13T14:33:00.000Z ##

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Hackers are actively exploiting a critical flaw in Tencent's Sogou Input Method for Windows, using a clever one-click trick to deploy the GrayRabbit backdoor; researchers warn that this vulnerability, tracked as CVE-2026-51990, is being used to deliver malware to unsuspecting victims.

osintsights.com/hackers-exploi

#GrayrabbitMalware #Tencent #Cve202651990 #RemoteCodeExecution #Windows

##

security_crawler_carl@infosec.exchange at 2026-09-13T18:52:46.000Z ##

🏆 New Achievement! One Click to the Food Chain Bottom!

Here, in the wild habitat of Windows enterprise environments, we observe the Sogou Input Method — a text entry tool installed by millions — standing perfectly still as UNC3569, a China-aligned espionage group, approaches from the brush. CVE-2026-51990 is a critical one-click remote code execution flaw exploiting an unsandboxed Chromium chain. The creature does not run. It simply... accepts the GrayRabbit backdoor. (1/2)

##

oversecurity@mastodon.social at 2026-09-13T15:20:36.000Z ##

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method...

🔗️ [Bleepingcomputer] link.is.it/DXBwPD

##

VirusBulletin@infosec.exchange at 2026-09-11T10:23:05.000Z ##

Gen Threat Labs discovered a critical remote code execution vulnerability (CVE-2026-51990) in Sogou Input Method. The vulnerability is actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link. gendigital.com/blog/insights/r

##

CVE-2026-63030
(0 None)

EPSS: 97.27%

2 posts

N/A

Nuclei template

85 repos

https://github.com/gagaltotal/CVE-2026-63030-CVE-2026-60137-wp2shell-poc

https://github.com/Lukols-Dev/wp-cve-2026-63030-check

https://github.com/mcipekci/wp2shell

https://github.com/ivanesk315/CVE-2026-60137-and-CVE-2026-63030

https://github.com/dinosn/wp2shell-lab

https://github.com/mrx-arafat/CVE-2026-63030-POC

https://github.com/vulnquest58/PressVector

https://github.com/Dungsocool/CVE-2026-60137_CVE-2026-63030

https://github.com/CybersecSpirit/CVE-2026-63030

https://github.com/michael-kanda/Wp2shell-ioc-scanner

https://github.com/skelersecurity/wordpress-skelersecurity-core-security-CVE-2026-63030

https://github.com/Iqbalx7/wp2shell

https://github.com/bahartanir/wp2shell-scanner

https://github.com/administrator-01001/CVE-2026-63030

https://github.com/johnlodan/wp2shell-rce

https://github.com/0xsha/wp2shell

https://github.com/Senanfurkan/wordpress-cve-2026-63030

https://github.com/sowarma/wp2shell-PoC

https://github.com/fullhunt/wp2shell-scan

https://github.com/Colere-Sys/wp2shell-poc

https://github.com/Lutfifakee-Project/wp2shell

https://github.com/NULL200OK/WP2Shell

https://github.com/shinthink/CVE-2026-63030

https://github.com/own2pwn-fr/wp2shell-detect

https://github.com/ZephrFish/wp2shell-scanner

https://github.com/zi3lak/wp2shell_scanner

https://github.com/Icex0/wp2shell-poc

https://github.com/GhostInExile/CVE-2026-63030-Wp2Shell

https://github.com/Bhanunamikaze/WP2Shell-CVE-2026-63030-POC

https://github.com/Ch4120N/CVE-2026-63030

https://github.com/attackercan/wp2shell-poc2

https://github.com/JohenLastGen-JLG/wp2shell

https://github.com/J4ck3LSyN-Gen2/CVE-2026-63030-wp2r00t

https://github.com/4B3R4M4-607D/CVE-2026-63030-POC

https://github.com/razureink/cve-2026-63030_60137-wordpress_rce_reproduction

https://github.com/AnggaTechI/CVE-2026-63030

https://github.com/mhassani97/cve-2026-63030-lab

https://github.com/securelayer7/WordPresShell

https://github.com/M4xSec/wp2shell-Exploit-Waf-Bypass

https://github.com/TomorrowX6/CVE-2026-63030-poc

https://github.com/Sec-Dan/WP2Shell-Scanner

https://github.com/joaovicdev/EXPLOIT-CVE-2026-63030

https://github.com/mhtsec/CVE-2026-63030

https://github.com/SentinelXofficial/sxwp2shell

https://github.com/eyesecurity/wp2shell-compromise-scanner-plugin

https://github.com/Industri4l-H3ll-Xpl0it3rs/CVE-2026-63030-WP2Shell

https://github.com/raphy76/wp2shell-poc-fulljs

https://github.com/h4cd0c/wp2shell

https://github.com/c0gnit00/Wp2Shell

https://github.com/ebrasha/abdal-cve-2026-63030

https://github.com/mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress

https://github.com/DeadExpl0it/wp2shell-poc

https://github.com/ZenithGenius/wordpress-batch-rce-lab

https://github.com/Giangdurian/CVE-2026-63030-CVE-2026-60137

https://github.com/Adrees-Basheer/wp2shell-vulnerability-scanner

https://github.com/ekomsSavior/wp2shell

https://github.com/AkbarWiraN/holy-wp2shell

https://github.com/InstaWP/wp2shell-scan

https://github.com/0xWhoknows/wp2shell

https://github.com/TranDongA3/POC-CVE-2026-63030-CVE-2026-60137-

https://github.com/g0d150ne/WP2Shell

https://github.com/Crypto-Cat/wp2shell

https://github.com/ikow/wp2shell

https://github.com/yuag/wp2shell

https://github.com/kulichr/wp2shell

https://github.com/x-znn/CVE-2026-63030

https://github.com/0xh7ml/CVE-2026-63030

https://github.com/Madelleimproved411/wp-to-code

https://github.com/hidden-investigations/wp2shell-scanner

https://github.com/Procjevt/CVE-2026-63030

https://github.com/HackingLZ/wp2shell_stock_chain

https://github.com/47Cid/wp2shell-lab

https://github.com/0xBlackash/CVE-2026-63030

https://github.com/zeroc00I/CVE-2026-63030

https://github.com/imXur/WordPress-CVE-2026-63030-Analysis

https://github.com/mverschu/CVE-2026-63030

https://github.com/BytesPulse-OE/wp2shell-Hestia-Scanner

https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause

https://github.com/codeb0ssx/Ultimate-wp2shell

https://github.com/4minx/CVE-2026-63030

https://github.com/0xjessie21/wp2shell-checker

https://github.com/ananay/wp2shell-lab

https://github.com/ChiefYoru/CVE-2026-63030_PoC

https://github.com/gbrsh/CVE-2026-63030

https://github.com/lucifer0xf/wp2shell-Wordpress-TOWN

_r_netsec at 2026-09-13T17:43:06.691Z ##

wp2shell (CVE-2026-63030): Pre-Auth RCE Chain in WordPress Core - Analysis and Open-Source Scanner fullhunt.io/blog/2026/07/17/wp

##

_r_netsec@infosec.exchange at 2026-09-13T17:43:06.000Z ##

wp2shell (CVE-2026-63030): Pre-Auth RCE Chain in WordPress Core - Analysis and Open-Source Scanner fullhunt.io/blog/2026/07/17/wp

##

CVE-2026-53761
(0 None)

EPSS: 0.34%

1 posts

N/A

hugovalters@mastodon.social at 2026-09-13T13:00:03.000Z ##

CVE-2026-53761: Authentication bypass in Frappe CRM via logged invitation keys, affecting versions before 1.73.0. CVSS N/A, but unpatched installs are at risk of unauthorized access. Patch immediately! Details: valtersit.com/cve/CVE-2026-537 #CVE #cybersecurity #Fr

##

CVE-2026-53758
(0 None)

EPSS: 0.26%

1 posts

N/A

hugovalters@mastodon.social at 2026-09-13T03:20:02.000Z ##

CVE-2026-53758: Stored XSS in Emlog ≤2.6.29 via Parsedown raw HTML. Unpatched—attacker can inject scripts into articles, hitting all visitors. No CVSS assigned. Patch unknown; restrict Markdown input or disable HTML now. Details: valtersit.com/cve/CVE-2026-537 #CVE

##

CVE-2026-54135
(0 None)

EPSS: 0.55%

1 posts

N/A

thehackerwire@mastodon.social at 2026-09-11T22:01:54.000Z ##

🟠 CVE-2026-54135 - High (7.5)

AirSane is a SANE frontend, and a scanner server that supports Apple's AirScan protocol. Versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation of AirSane that allows a remote unauthenticated attacker to cause a Den...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-89066
(0 None)

EPSS: 0.16%

1 posts

N/A

thehackerwire@mastodon.social at 2026-09-11T17:00:48.000Z ##

🟠 CVE-2026-89066 - High (7.8)

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration r...

🔗 thehackerwire.com/vulnerabilit

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

##

CVE-2026-16338
(0 None)

EPSS: 0.00%

1 posts

N/A

CVE-2026-70416
(0 None)

EPSS: 0.00%

1 posts

N/A

CVE-2026-63695
(0 None)

EPSS: 0.00%

1 posts

N/A

DailyCyberSecurity@infosec.exchange at 2026-09-11T01:32:54.000Z ##

Dell patched critical Dell Networking OS10 vulnerabilities, including CVE-2026-63695. Update your Dell SmartFabric OS10 switches to prevent session theft.

#DellNetworking #Cybersecurity #Vulnerabilities #CVE202663695 #InfoSec

securityonline.info/dell-netwo

##

Visit counter For Websites