🟠 CVE-2026-26990 - High (8.8)

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is suppl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26990/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26990 - High (8.8)

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is suppl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26990/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26980 - Critical (9.4)

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26980 - Critical (9.4)

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL vuln: calibre <9.3.0 (CVE-2026-26065) allows arbitrary file writes via path traversal in PDB reader. Risks: code execution, DoS. Patch to 9.3.0+ ASAP! No known exploits yet. https://radar.offseq.com/threat/cve-2026-26065-cwe-22-improper-limitation-of-a-pat-53326093 #OffSeq #Vuln #Calibre #InfoSec

⚠️ CRITICAL vuln: calibre <9.3.0 (CVE-2026-26065) allows arbitrary file writes via path traversal in PDB reader. Risks: code execution, DoS. Patch to 9.3.0+ ASAP! No known exploits yet. https://radar.offseq.com/threat/cve-2026-26065-cwe-22-improper-limitation-of-a-pat-53326093 #OffSeq #Vuln #Calibre #InfoSec

🎵 CVE-2026-26975: HIGH severity RCE in Music Assistant server <2.7.0. Unauthenticated attackers can write arbitrary files via playlist update API — root compromise possible if running as root. Upgrade to 2.7.0+ now! https://radar.offseq.com/threat/cve-2026-26975-cwe-73-external-control-of-file-nam-f0001b29 #OffSeq #Vuln #RCE #MusicAssistant

🟠 CVE-2026-26975 - High (8.8)

Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers to execute arbitrary code on affected installations. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26975/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🎵 CVE-2026-26975: HIGH severity RCE in Music Assistant server <2.7.0. Unauthenticated attackers can write arbitrary files via playlist update API — root compromise possible if running as root. Upgrade to 2.7.0+ now! https://radar.offseq.com/threat/cve-2026-26975-cwe-73-external-control-of-file-nam-f0001b29 #OffSeq #Vuln #RCE #MusicAssistant

🟠 CVE-2026-26975 - High (8.8)

Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers to execute arbitrary code on affected installations. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26975/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-30411 - Critical (10)

Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-30411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-30411 - Critical (10)

Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-30411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-30411 - Critical (10)

Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-30411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-30411 - Critical (10)

Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-30411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23544 - High (8.8)

Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through &lt;= 5.6.3.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23544 - High (8.8)

Deserialization of Untrusted Data vulnerability in codetipi Valenti valenti allows Object Injection.This issue affects Valenti: from n/a through &lt;= 5.6.3.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-23542 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through &lt;= 7.0.10.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23542/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-23542 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through &lt;= 7.0.10.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23542/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21535 - High (8.2)

Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21535/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21535 - High (8.2)

Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21535/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26321 - High (7.5)

OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly. If an attacker can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26321/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26321 - High (7.5)

OpenClaw is a personal AI assistant. Prior to OpenClaw version 2026.2.14, the Feishu extension previously allowed `sendMediaFeishu` to treat attacker-controlled `mediaUrl` values as local filesystem paths and read them directly. If an attacker can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26321/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-0573 - Critical (9)

An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-0573 - Critical (9)

An URL redirection vulnerability was identified in GitHub Enterprise Server that allowed attacker-controlled redirects to leak sensitive authorization tokens. The repository_pages API insecurely followed HTTP redirects when fetching artifact URLs,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-23549 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through &lt;= 5.1.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23549/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-23549 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through &lt;= 5.1.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23549/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-13590 - Critical (9.1)

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution.

By leveraging the vulnerability, a ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-13590 - Critical (9.1)

A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution.

By leveraging the vulnerability, a ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27013 - High (7.6)

Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27013/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27013 - High (7.6)

Fabric.js is a Javascript HTML5 canvas library. Prior to version 7.2.0, Fabric.js applies `escapeXml()` to text content during SVG export (`src/shapes/Text/TextSVGExportMixin.ts:186`) but fails to apply it to other user-controlled string values th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27013/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26280 - High (8.4)

systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26280/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26280 - High (8.4)

systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26280/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26267 - High (7.5)

soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up function calls. `#[contractimpl]` generates code that uses `MyContract::value()` style ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26267/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26267 - High (7.5)

soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the `#[contractimpl]` macro contains a bug in how it wires up function calls. `#[contractimpl]` generates code that uses `MyContract::value()` style ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26267/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27476 - Critical (9.8)

RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization. Attackers can send crafted hex-encoded payloads containing system com...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27476/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27476 - Critical (9.8)

RustFly 2.0.0 contains a command injection vulnerability in its remote UI control mechanism that accepts hex-encoded instructions over UDP port 5005 without proper sanitization. Attackers can send crafted hex-encoded payloads containing system com...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27476/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27052 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for WooCommerce and WordPress sctv-sales-countdown-timer allows PHP Local File Inclusion.This...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27052/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27052 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for WooCommerce and WordPress sctv-sales-countdown-timer allows PHP Local File Inclusion.This...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27052/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25378 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Blind SQL Injection.This issue affects Nelio AB Testing: from n/a through &lt;= 8.2.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25378 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Blind SQL Injection.This issue affects Nelio AB Testing: from n/a through &lt;= 8.2.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: Pterodactyl Panel <1.12.1 has an auth bypass (CVE-2026-26016). Wings node token = full access to all servers, data loss risk. Upgrade to 1.12.1 ASAP & secure tokens! https://radar.offseq.com/threat/cve-2026-26016-cwe-639-authorization-bypass-throug-e8901bb1 #OffSeq #Pterodactyl #CVE202626016 #Vulnerability

⚠️ CRITICAL: Pterodactyl Panel <1.12.1 has an auth bypass (CVE-2026-26016). Wings node token = full access to all servers, data loss risk. Upgrade to 1.12.1 ASAP & secure tokens! https://radar.offseq.com/threat/cve-2026-26016-cwe-639-authorization-bypass-throug-e8901bb1 #OffSeq #Pterodactyl #CVE202626016 #Vulnerability

🔴 CVE-2026-24834 - Critical (9.3)

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.27.0, an issue in Kata with Cloud Hypervisor allows a user of the container ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24834/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24834 - Critical (9.3)

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.27.0, an issue in Kata with Cloud Hypervisor allows a user of the container ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24834/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25242 - Critical (9.8)

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25242/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25242 - Critical (9.8)

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25242/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25232 - High (8.8)

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25232/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25232 - High (8.8)

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25232/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24708 - High (8.2)

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qem...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24708/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24708 - High (8.2)

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qem...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24708/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-14009 - Critical (10)

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14009/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-14009 - Critical (10)

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14009/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-14009 - Critical (10)

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14009/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-14009 - Critical (10)

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14009/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26318 - High (8.8)

systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26318/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26318 - High (8.8)

systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26318/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26278 - High (7.5)

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26278 - High (7.5)

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70148 - High (7.5)

Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card data of arbitrary users via direct requests with a manipulated id parame...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70148/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70148 - High (7.5)

Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card data of arbitrary users via direct requests with a manipulated id parame...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70148/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25474 - High (7.5)

OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token header. In dep...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25474/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25474 - High (7.5)

OpenClaw is a personal AI assistant. In versions 2026.1.30 and below, if channels.telegram.webhookSecret is not set when in Telegram webhook mode, OpenClaw may accept webhook HTTP requests without verifying Telegram’s secret token header. In dep...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25474/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Unbelievable.... https://digg.com/cybersecurity/yCL5Ang/critical-alert-cve-2026-26030-microsoft

⚠️ CRITICAL RCE: CVE-2026-26030 in Microsoft Semantic Kernel (<1.39.4) lets remote attackers execute code via InMemoryVectorStore filter. Upgrade to 1.39.4+ ASAP or avoid this component in prod. Details: https://radar.offseq.com/threat/cve-2026-26030-cwe-94-improper-control-of-generati-8c490551
#OffSeq #CVE #infosec #Python #AIsecurity

🔴 CVE-2026-26030 - Critical (9.9)

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26030/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Unbelievable.... https://digg.com/cybersecurity/yCL5Ang/critical-alert-cve-2026-26030-microsoft

⚠️ CRITICAL RCE: CVE-2026-26030 in Microsoft Semantic Kernel (<1.39.4) lets remote attackers execute code via InMemoryVectorStore filter. Upgrade to 1.39.4+ ASAP or avoid this component in prod. Details: https://radar.offseq.com/threat/cve-2026-26030-cwe-94-improper-control-of-generati-8c490551
#OffSeq #CVE #infosec #Python #AIsecurity

🔴 CVE-2026-26030 - Critical (9.9)

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26030/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25940 - High (8.1)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: CVE-2026-25940 in jsPDF (<4.2.0) allows arbitrary PDF object injection via Acroform, leading to code execution on user interaction. Patch to 4.2.0+ & sanitize inputs now! https://radar.offseq.com/threat/cve-2026-25940-cwe-116-improper-encoding-or-escapi-3b5e393d #OffSeq #jsPDF #vuln #AppSec

🟠 CVE-2026-25940 - High (8.1)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: CVE-2026-25940 in jsPDF (<4.2.0) allows arbitrary PDF object injection via Acroform, leading to code execution on user interaction. Patch to 4.2.0+ & sanitize inputs now! https://radar.offseq.com/threat/cve-2026-25940-cwe-116-improper-encoding-or-escapi-3b5e393d #OffSeq #jsPDF #vuln #AppSec

🟠 CVE-2026-27475 - High (8.1)

SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior acces...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27475/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27475 - High (8.1)

SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior acces...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27475/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25418 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bitpressadmin Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through &lt;= 2.21.10.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25418 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bitpressadmin Bit Form bit-form allows SQL Injection.This issue affects Bit Form: from n/a through &lt;= 2.21.10.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2648 - High (8.8)

Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2648 - High (8.8)

Heap buffer overflow in PDFium in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-2409 in Delinea Cloud Suite (<25.2 HF1) enables remote SQL Injection by low-priv users — risking sensitive data. Patch urgently, validate inputs, and monitor DB activity! https://radar.offseq.com/threat/cve-2026-2409-cwe-89-improper-neutralization-of-sp-62e3fd17 #OffSeq #SQLInjection #Delinea #Vuln

🚨 CRITICAL: CVE-2026-2409 in Delinea Cloud Suite (<25.2 HF1) enables remote SQL Injection by low-priv users — risking sensitive data. Patch urgently, validate inputs, and monitor DB activity! https://radar.offseq.com/threat/cve-2026-2409-cwe-89-improper-neutralization-of-sp-62e3fd17 #OffSeq #SQLInjection #Delinea #Vuln

🟠 CVE-2026-1581 - High (7.5)

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1581/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1581 - High (7.5)

The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1581/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2232 - High (7.5)

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied paramet...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2232/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2232 - High (7.5)

The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 4.6.2 due to insufficient escaping on the user supplied paramet...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2232/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26337 - High (8.2)

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolute path traversal.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26337/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26337 - High (8.2)

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolute path traversal.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26337/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26362 - High (8.1)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26362 - High (8.1)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26362 - High (8.1)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26362 - High (8.1)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26362 - High (8.1)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26362 - High (8.1)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71250 - High (8.1)

SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior acces...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71250 - High (8.1)

SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior acces...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71250 - High (8.1)

SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior acces...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71250 - High (8.1)

SPIP before 4.4.9 allows Insecure Deserialization in the public area through the table_valeur filter and the DATA iterator, which accept serialized data. An attacker who can place malicious serialized content (a pre-condition requiring prior acces...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26358 - High (8.8)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26358/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26358 - High (8.8)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26358/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26358 - High (8.8)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26358/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚩 CVE-2026-26358 (HIGH): Dell Unisphere for PowerMax 10.2 has a missing auth check. Remote low-priv users can access restricted storage functions. Restrict access, enforce MFA, and monitor logs. No patch yet. https://radar.offseq.com/threat/cve-2026-26358-cwe-862-missing-authorization-in-de-3cb4a373 #OffSeq #Dell #Vuln #InfoSec

🔒 CVE-2026-26358: HIGH severity flaw in Dell Unisphere for PowerMax v10.2 allows remote low-priv attackers to bypass authorization — potential access to sensitive storage functions. Restrict access & monitor systems. Patch ASAP when available. https://radar.offseq.com/threat/cve-2026-26358-cwe-862-missing-authorization-in-de-3cb4a373 #OffSeq #Vuln #Dell

🟠 CVE-2026-26358 - High (8.8)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26358/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26358 - High (8.8)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26358/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26358 - High (8.8)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26358/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚩 CVE-2026-26358 (HIGH): Dell Unisphere for PowerMax 10.2 has a missing auth check. Remote low-priv users can access restricted storage functions. Restrict access, enforce MFA, and monitor logs. No patch yet. https://radar.offseq.com/threat/cve-2026-26358-cwe-862-missing-authorization-in-de-3cb4a373 #OffSeq #Dell #Vuln #InfoSec

🔒 CVE-2026-26358: HIGH severity flaw in Dell Unisphere for PowerMax v10.2 allows remote low-priv attackers to bypass authorization — potential access to sensitive storage functions. Restrict access & monitor systems. Patch ASAP when available. https://radar.offseq.com/threat/cve-2026-26358-cwe-862-missing-authorization-in-de-3cb4a373 #OffSeq #Vuln #Dell

🔴 CVE-2025-12107 - Critical (10)

Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates.

Successful exploitation of this vulnerability could allow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12107/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-12107 - Critical (10)

Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates.

Successful exploitation of this vulnerability could allow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12107/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-8350 - Critical (9.8)

Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting.This issue affects BiEticaret CMS: from 2.1.13...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8350/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-8350 - Critical (9.8)

Execution After Redirect (EAR), Missing Authentication for Critical Function vulnerability in Inrove Software and Internet Services BiEticaret CMS allows Authentication Bypass, HTTP Response Splitting.This issue affects BiEticaret CMS: from 2.1.13...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8350/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26359 - High (8.8)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the ability to overwrite arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26359 - High (8.8)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to the ability to overwrite arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-9953 - Critical (9.8)

Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows SQL Injection.This issue affects Databank Accreditation Software: through 19022026.

NO...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-9953/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-9953 - Critical (9.8)

Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows SQL Injection.This issue affects Databank Accreditation Software: through 19022026.

NO...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-9953/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26360 - High (8.1)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to delete arbitrary files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26360/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26360 - High (8.1)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to delete arbitrary files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26360/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛑 HIGH severity: Dell Unisphere for PowerMax v10.2 (CVE-2026-26360) has a network-based vulnerability — low-priv attackers can remotely delete files, risking data & availability. Restrict access, monitor logs, back up configs. https://radar.offseq.com/threat/cve-2026-26360-cwe-73-external-control-of-file-nam-58de98ef #OffSeq #Dell #Vuln #StorageSecurity

🔒 HIGH severity: Dell Unisphere for PowerMax 10.2 is vulnerable (CVE-2026-26360) to external control of file name/path. Remote, low privilege attackers could delete arbitrary files. Watch for patches! https://radar.offseq.com/threat/cve-2026-26360-cwe-73-external-control-of-file-nam-58de98ef #OffSeq #Dell #Vuln #Infosec

🟠 CVE-2026-26360 - High (8.1)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to delete arbitrary files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26360/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26360 - High (8.1)

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to delete arbitrary files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26360/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛑 HIGH severity: Dell Unisphere for PowerMax v10.2 (CVE-2026-26360) has a network-based vulnerability — low-priv attackers can remotely delete files, risking data & availability. Restrict access, monitor logs, back up configs. https://radar.offseq.com/threat/cve-2026-26360-cwe-73-external-control-of-file-nam-58de98ef #OffSeq #Dell #Vuln #StorageSecurity

🔒 HIGH severity: Dell Unisphere for PowerMax 10.2 is vulnerable (CVE-2026-26360) to external control of file name/path. Remote, low privilege attackers could delete arbitrary files. Watch for patches! https://radar.offseq.com/threat/cve-2026-26360-cwe-73-external-control-of-file-nam-58de98ef #OffSeq #Dell #Vuln #Infosec

🔴 CVE-2026-1994 - Critical (9.8)

The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1994/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-1994 (CRITICAL, CVSS 9.8): All s2Member WordPress plugin versions up to 260127 allow unauthenticated password resets — admin takeover possible! Disable plugin, enforce MFA, audit accounts. No patch yet. https://radar.offseq.com/threat/cve-2026-1994-cwe-269-improper-privilege-managemen-8fe39267 #OffSeq #WordPress #Vuln

🔴 CVE-2026-1994 - Critical (9.8)

The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1994/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-1994 (CRITICAL, CVSS 9.8): All s2Member WordPress plugin versions up to 260127 allow unauthenticated password resets — admin takeover possible! Disable plugin, enforce MFA, audit accounts. No patch yet. https://radar.offseq.com/threat/cve-2026-1994-cwe-269-improper-privilege-managemen-8fe39267 #OffSeq #WordPress #Vuln

🟠 CVE-2025-4521 - High (8.8)

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_profile() function in versions 2.1.5 to 2.1.9. This makes it poss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-4521/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-4521 - High (8.8)

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the idonate_donor_profile() function in versions 2.1.5 to 2.1.9. This makes it poss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-4521/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-4960 - High (7.8)

The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple flaws in its implementation. It fails to properly authenticate clients over the XPC protoc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-4960/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-4960 - High (7.8)

The com.epson.InstallNavi.helper tool, deployed with the EPSON printer driver installer, contains a local privilege escalation vulnerability due to multiple flaws in its implementation. It fails to properly authenticate clients over the XPC protoc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-4960/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-0926 - Critical (9.8)

The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.9 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arb...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0926/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-0926 (CRITICAL): Prodigy Commerce plugin for WordPress allows unauth LFI & RCE via 'parameters[template_name]'. All versions affected, no patch yet. Disable plugin, monitor file uploads, and audit systems. https://radar.offseq.com/threat/cve-2026-0926-cwe-98-improper-control-of-filename--2995b72c #OffSeq #WordPress #Vuln

🔴 CVE-2026-0926 - Critical (9.8)

The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.9 via the 'parameters[template_name]' parameter. This makes it possible for unauthenticated attackers to include and read arb...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0926/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-0926 (CRITICAL): Prodigy Commerce plugin for WordPress allows unauth LFI & RCE via 'parameters[template_name]'. All versions affected, no patch yet. Disable plugin, monitor file uploads, and audit systems. https://radar.offseq.com/threat/cve-2026-0926-cwe-98-improper-control-of-filename--2995b72c #OffSeq #WordPress #Vuln

🔴 CVE-2025-13851 - Critical (9.8)

The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13851/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-13851 - Critical (9.8)

The Buyent Classified plugin for WordPress (bundled with Buyent theme) is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.0.7. This is due to the plugin not validating or restricting the user role d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13851/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0912 - High (8.8)

The Toret Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'trman_save_option' function and on the 'trman_save_option_items' in all versi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0912/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0912 - High (8.8)

The Toret Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'trman_save_option' function and on the 'trman_save_option_items' in all versi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0912/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-12707 - High (7.5)

The Library Management System plugin for WordPress is vulnerable to SQL Injection via the 'bid' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12707/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-12707 - High (7.5)

The Library Management System plugin for WordPress is vulnerable to SQL Injection via the 'bid' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12707/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-12882 - Critical (9.8)

The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new accounts to set their own role by supplying the 'listing_user_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-12882 - Critical (9.8)

The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new accounts to set their own role by supplying the 'listing_user_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-12845 - High (8.8)

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the get_table_data() fu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12845/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-12845 - High (8.8)

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the get_table_data() fu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12845/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-13563 - Critical (9.8)

The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza_lms_pro_register_user_front_end' function not restricting what user roles a user can register with....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13563/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-13563 - Critical (9.8)

The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza_lms_pro_register_user_front_end' function not restricting what user roles a user can register with....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13563/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26339 - Critical (9.8)

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26339/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 CRITICAL: CVE-2026-26339 in Hyland Alfresco Transformation Service (Enterprise) enables unauthenticated SSRF → RCE. Restrict access, monitor for abuse, patch ASAP. All versions at risk. https://radar.offseq.com/threat/cve-2026-26339-cwe-918-server-side-request-forgery-f1de4ab8 #OffSeq #CVE202626339 #SSRF #RCE #Alfresco

🔴 CVE-2026-26339 - Critical (9.8)

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve remote code execution through the argument injection vulnerability, which exists in the document processing functionality.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26339/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 CRITICAL: CVE-2026-26339 in Hyland Alfresco Transformation Service (Enterprise) enables unauthenticated SSRF → RCE. Restrict access, monitor for abuse, patch ASAP. All versions at risk. https://radar.offseq.com/threat/cve-2026-26339-cwe-918-server-side-request-forgery-f1de4ab8 #OffSeq #CVE202626339 #SSRF #RCE #Alfresco

🟠 CVE-2026-26336 - High (7.5)

Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26336/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26336 - High (7.5)

Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26336/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71243 - Critical (9.8)

The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71243/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71243 - Critical (9.8)

The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71243/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-65791 - Critical (9.8)

ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-65791/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-65791 - Critical (9.8)

ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-65791/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-11754 - High (7.5)

The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'gdpr/v1/settings' REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11754/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-11754 - High (7.5)

The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'gdpr/v1/settings' REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11754/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-12821 - High (8.8)

The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.6.1. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12821/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-12821 - High (8.8)

The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.6.1. This is due to missing or incorrect nonce validation on the newsblogger_install_and_activate_plugin() function. This makes it possible...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12821/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13603 - High (8.8)

The WP AUDIO GALLERY plugin for WordPress is vulnerable to Unauthorized Arbitrary File Read in all versions up to, and including, 2.0. This is due to insufficient capability checks and lack of nonce verification on the "wpag_htaccess_callback" fun...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13603/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13603 - High (8.8)

The WP AUDIO GALLERY plugin for WordPress is vulnerable to Unauthorized Arbitrary File Read in all versions up to, and including, 2.0. This is due to insufficient capability checks and lack of nonce verification on the "wpag_htaccess_callback" fun...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13603/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0974 - High (8.8)

The Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the 'install_plugin' function in all versions up to,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0974 - High (8.8)

The Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the 'install_plugin' function in all versions up to,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-2686 in SECCN Dingcheng G10 (v3.1.0.181203) enables unauthenticated remote OS command injection via the 'User' param in /cgi-bin/session_login.cgi. Exploit code is public. Restrict access & monitor! https://radar.offseq.com/threat/cve-2026-2686-os-command-injection-in-seccn-dingch-6d02b310 #OffSeq #CVE20262686 #IoTSec

🔴 CVE-2026-2686 - Critical (9.8)

A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-2686 in SECCN Dingcheng G10 (v3.1.0.181203) enables unauthenticated remote OS command injection via the 'User' param in /cgi-bin/session_login.cgi. Exploit code is public. Restrict access & monitor! https://radar.offseq.com/threat/cve-2026-2686-os-command-injection-in-seccn-dingch-6d02b310 #OffSeq #CVE20262686 #IoTSec

🔴 CVE-2026-2686 - Critical (9.8)

A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. The manipulation of the argument User leads to os command injection. The attack is possible to be ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

MajorDoMo (all versions) faces a CRITICAL OS command injection (CVE-2026-27175, CVSS 9.2). Unauthenticated RCE via rc/index.php & cycle_execs.php. No patch yet — restrict endpoints, sanitize input, and monitor activity! https://radar.offseq.com/threat/cve-2026-27175-improper-neutralization-of-special--9a0f14bf #OffSeq #CVE202627175 #Infosec

🔴 CVE-2026-27175 - Critical (9.8)

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg()....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27175/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

MajorDoMo (all versions) faces a CRITICAL OS command injection (CVE-2026-27175, CVSS 9.2). Unauthenticated RCE via rc/index.php & cycle_execs.php. No patch yet — restrict endpoints, sanitize input, and monitor activity! https://radar.offseq.com/threat/cve-2026-27175-improper-neutralization-of-special--9a0f14bf #OffSeq #CVE202627175 #Infosec

🔴 CVE-2026-27175 - Critical (9.8)

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg()....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27175/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27180 - Critical (9.8)

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27180 in sergejey MajorDoMo allows unauthenticated RCE via poisoned update URLs. Attackers can deploy arbitrary PHP files to webroot with 2 GETs. Patch urgently! https://radar.offseq.com/threat/cve-2026-27180-download-of-code-without-integrity--99709b79 #OffSeq #CVE #infosec #remotecodeexecution

🔴 CVE-2026-27180 - Critical (9.8)

MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27180 in sergejey MajorDoMo allows unauthenticated RCE via poisoned update URLs. Attackers can deploy arbitrary PHP files to webroot with 2 GETs. Patch urgently! https://radar.offseq.com/threat/cve-2026-27180-download-of-code-without-integrity--99709b79 #OffSeq #CVE #infosec #remotecodeexecution

🟠 CVE-2026-0874 - High (7.8)

A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0874/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0874 - High (7.8)

A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0874/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-1405 - Critical (9.8)

The Slider Future plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'slider_future_handle_image_upload' function in all versions up to, and including, 1.0.5. This makes it possible for unauthen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1405/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-1405 - Critical (9.8)

The Slider Future plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'slider_future_handle_image_upload' function in all versions up to, and including, 1.0.5. This makes it possible for unauthen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1405/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22267 - High (8.1)

Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22267/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔔 CVE-2026-22267 (HIGH): Dell PowerProtect Data Manager <19.22 lets remote low-priv users escalate privileges. Urgently restrict remote access, enforce least privilege, and monitor logs. No patch yet. https://radar.offseq.com/threat/cve-2026-22267-cwe-266-incorrect-privilege-assignm-254d0ded #OffSeq #CyberSecurity #Vuln #Dell

🟠 CVE-2026-22267 - High (8.1)

Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22267/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔔 CVE-2026-22267 (HIGH): Dell PowerProtect Data Manager <19.22 lets remote low-priv users escalate privileges. Urgently restrict remote access, enforce least privilege, and monitor logs. No patch yet. https://radar.offseq.com/threat/cve-2026-22267-cwe-266-incorrect-privilege-assignm-254d0ded #OffSeq #CyberSecurity #Vuln #Dell

🟠 CVE-2026-25755 - High (8.1)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25755 - High (8.1)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27179 - High (8.2)

MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitizati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27179 - High (8.2)

MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly interpolates the $_GET['parent'] parameter into multiple SQL queries without sanitizati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27182 - High (8.4)

Saturn Remote Mouse Server contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending specially crafted UDP JSON frames to port 27000. Attackers on the local network can send malformed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27182/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27182 - High (8.4)

Saturn Remote Mouse Server contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending specially crafted UDP JSON frames to port 27000. Attackers on the local network can send malformed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27182/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27181 - High (7.5)

MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of execution, mak...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27181/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27181 - High (7.5)

MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin() method reads gr('mode') from $_REQUEST and assigns it to $this->mode at the start of execution, mak...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27181/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛑 CVE-2026-2649: HIGH severity integer overflow in Chrome V8 pre-145.0.7632.109 lets remote attackers trigger heap corruption via crafted HTML. Update ASAP to patch! https://radar.offseq.com/threat/cve-2026-2649-integer-overflow-in-google-chrome-1776d2df #OffSeq #Chrome #Vuln #Security

🟠 CVE-2026-2649 - High (8.8)

Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2649/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛑 CVE-2026-2649: HIGH severity integer overflow in Chrome V8 pre-145.0.7632.109 lets remote attackers trigger heap corruption via crafted HTML. Update ASAP to patch! https://radar.offseq.com/threat/cve-2026-2649-integer-overflow-in-google-chrome-1776d2df #OffSeq #Chrome #Vuln #Security

🟠 CVE-2026-2649 - High (8.8)

Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2649/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-2650: HIGH severity heap buffer overflow in Google Chrome before 145.0.7632.109. Remote attackers can exploit via malicious HTML for code execution. Patch ASAP! https://radar.offseq.com/threat/cve-2026-2650-heap-buffer-overflow-in-google-chrom-0bc72c99 #OffSeq #Chrome #Vuln #CVE20262650

🟠 CVE-2026-2650 - High (8.8)

Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-2650: HIGH severity heap buffer overflow in Google Chrome before 145.0.7632.109. Remote attackers can exploit via malicious HTML for code execution. Patch ASAP! https://radar.offseq.com/threat/cve-2026-2650-heap-buffer-overflow-in-google-chrom-0bc72c99 #OffSeq #Chrome #Vuln #CVE20262650

🟠 CVE-2026-2650 - High (8.8)

Heap buffer overflow in Media in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-27174 in MajorDoMo enables unauth RCE via vulnerable PHP handler — no user interaction needed. Full system compromise possible. Restrict panel access, patch, & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-27174-improper-control-of-generation-of-c-e7d5bad6 #OffSeq #CVE202627174 #RCE #HomeAutomation #Infosec

🔴 CVE-2026-27174 - Critical (9.8)

MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27174/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-27174 in MajorDoMo enables unauth RCE via vulnerable PHP handler — no user interaction needed. Full system compromise possible. Restrict panel access, patch, & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-27174-improper-control-of-generation-of-c-e7d5bad6 #OffSeq #CVE202627174 #RCE #HomeAutomation #Infosec

🔴 CVE-2026-27174 - Critical (9.8)

MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27174/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⛔ New security advisory:

CVE-2019-25360 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://yazoul.net/advisory/cve/cve-2019-25360

#Cybersecurity #SecurityPatching #HackerNews

🟠 CVE-2026-22860 - High (7.5)

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the ta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22860/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22860 - High (7.5)

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the ta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22860/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

If you're using firebase/php-jwt v6, surprise!

GitHub Advisory GHSA for CVE-2025-45769 ignores NVD "Disputed" status, blocks all php-jwt v6 users.

Details here:

https://github.com/firebase/php-jwt/issues/620

#PHP #CVE

If you're using firebase/php-jwt v6, surprise!

GitHub Advisory GHSA for CVE-2025-45769 ignores NVD "Disputed" status, blocks all php-jwt v6 users.

Details here:

https://github.com/firebase/php-jwt/issues/620

#PHP #CVE

🔴 CVE-2025-70146 - Critical (9.1)

Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized administrative operations (e.g.,adding records, deleting records) via d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70146/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70146 - Critical (9.1)

Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized administrative operations (e.g.,adding records, deleting records) via d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70146/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⛔ New security advisory:

CVE-2026-1435 affects Graylog Graylog.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://yazoul.net/advisory/cve/cve-2026-1435

#Cybersecurity #PatchNow #InfoSecCommunity

🔴 CVE-2026-1435 - Critical (9.8)

Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessionId' each time a user authenticates, but does not ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1435/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-1435 (CRITICAL): Graylog Web Interface 2.2.3 fails to expire old sessions, enabling token reuse & unauthorized access. Restrict access, enable MFA, and monitor sessions until patch is released. Details: https://radar.offseq.com/threat/cve-2026-1435-cwe-613-insufficient-session-expirat-34761982 #OffSeq #Graylog #Vuln #Security

⛔ New security advisory:

CVE-2026-1435 affects Graylog Graylog.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://yazoul.net/advisory/cve/cve-2026-1435

#Cybersecurity #PatchNow #InfoSecCommunity

🔴 CVE-2026-1435 - Critical (9.8)

Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessionId' each time a user authenticates, but does not ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1435/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-1435 (CRITICAL): Graylog Web Interface 2.2.3 fails to expire old sessions, enabling token reuse & unauthorized access. Restrict access, enable MFA, and monitor sessions until patch is released. Details: https://radar.offseq.com/threat/cve-2026-1435-cwe-613-insufficient-session-expirat-34761982 #OffSeq #Graylog #Vuln #Security

🟠 CVE-2025-1272 - High (7.7)

The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode disabled without any warning. This may allow an attacker to gain access to sensitive information such kernel memory mappings, I/O ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-1272/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-1272 - High (7.7)

The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode disabled without any warning. This may allow an attacker to gain access to sensitive information such kernel memory mappings, I/O ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-1272/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0875 - High (7.8)

A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0875/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0875 - High (7.8)

A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0875/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70064 - High (8.8)

PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator Dashboard and all sub-modules (e.g., User Logs, Doctor Management) by manually browsing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70064/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70064 - High (8.8)

PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability. A low-privileged user (Patient) can directly access the Administrator Dashboard and all sub-modules (e.g., User Logs, Doctor Management) by manually browsing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70064/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70149 - Critical (9.8)

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack