🟠 CVE-2026-32530 - High (8.8)

Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through <= 1.1.18.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32530/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30457 - Critical (9.8)

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30457 - Critical (9.8)

An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30458 - Critical (9.1)

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30458/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30458 - Critical (9.1)

An issue in Daylight Studio FuelCMS v1.5.2 allows attackers to exfiltrate users' password reset tokens via a mail splitting attack.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30458/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-33669: SiYuan (<3.6.2) has a CRITICAL out-of-bounds read flaw (CVSS 9.8). No auth/user interaction needed — remote attackers can leak sensitive memory. Upgrade to 3.6.2 ASAP! https://radar.offseq.com/threat/cve-2026-33669-cwe-125-out-of-bounds-read-in-siyua-064aace2 #OffSeq #Vulnerability #SiYuan #Cybersecurity

🟠 CVE-2026-4862 - High (8.8)

A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file /goform/formConfigDnsFilterGlobal of the component Parameter Handler. Such manipulation of the argument Gr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4862/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📢 CVE-2026-3098 : faille de lecture de fichiers dans Smart Slider 3 expose 500 000 sites WordPress
📝 ## 🔍 Contexte

Publié le 29 mars 2026 par BleepingComputer, cet a...
📖 cyberveille : https://cyberveille.ch/posts/2026-03-30-cve-2026-3098-faille-de-lecture-de-fichiers-dans-smart-slider-3-expose-500-000-sites-wordpress/
🌐 source : https://www.bleepingcomputer.com/news/security/file-read-flaw-in-smart-slider-plugin-impacts-500k-wordpress-sites/
#CVE_2026_3098 #IOC #Cyberveille

🟠 CVE-2026-33697 - High (7.5)

Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulnerable to a relay attack affecting all versions from v0.4.0 through v0.8.2. This vulnerability is present in both the AMD SEV-SNP...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33697 - High (7.5)

Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulnerable to a relay attack affecting all versions from v0.4.0 through v0.8.2. This vulnerability is present in both the AMD SEV-SNP...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33718 - High (7.6)

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33718 - High (7.6)

OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4906 - High (8.8)

A vulnerability was determined in Tenda AC5 15.03.06.47. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-ba...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4906/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4906 - High (8.8)

A vulnerability was determined in Tenda AC5 15.03.06.47. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-ba...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4906/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22743 - High (7.5)

Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22743/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22743 - High (7.5)

Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as a filter expression key in Neo4jVectorFilterExpressionConverter of spring-ai-neo4...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22743/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32678 - High (7.5)

Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings without authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32678/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32678 - High (7.5)

Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings without authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32678/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32669 - High (8.8)

Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary code may be executed on the products.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32669/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32669 - High (8.8)

Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary code may be executed on the products.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32669/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27650 - High (8.8)

OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary OS command may be executed on the products.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27650 - High (8.8)

OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary OS command may be executed on the products.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

- Syncthing got a 2.0 release and switched from LevelDB to SQLite https://github.com/syncthing/syncthing/releases
- macOS did that weird (a) Upgrade https://support.apple.com/de-de/126604 and is now at 2.6.4 with 8 (eight!) new emojis https://support.apple.com/en-us/122868
- Grafana security fix 12.4.1 -> 12.4.2 https://grafana.com/blog/grafana-security-release-critical-and-high-severity-security-fixes-for-cve-2026-27876-and-cve-2026-27880/
- TandoorRecipes got shared shopping lists and pantry inventory with 2.6.0 and an security update to 2.6.1 https://github.com/TandoorRecipes/recipes/releases
- Grist, qbittorrent and smokeping got updates for their containers. I haven't figured out what changed. https://hub.docker.com/r/gristlabs/grist https://github.com/linuxserver/docker-qbittorrent/releases https://github.com/linuxserver/docker-smokeping/releases
- Redis 8.6.2 with some bugfixes https://github.com/redis/redis/releases
- Home Assistant 2026.3.3 -> 2026.3.4. Nothing interesting. https://github.com/home-assistant/core/releases
- oh-my-zsh with tiny changes https://github.com/ohmyzsh/ohmyzsh/commits/master/
- Next section is done by homebrew. I don't even know what half of the stuff is used for. Don't judge for having fish and zsh.
ffmpeg 8.0.1_4 -> 8.1
pandoc 3.9 -> 3.9.0.2
nghttp2 1.68.0_1 -> 1.68.1
simdjson 4.4.0 -> 4.4.2
freetype 2.14.2 -> 2.14.3
cryptography 46.0.5 -> 46.0.6
ipython 9.11.0 -> 9.12.0
libavif 1.4.0 -> 1.4.1
harfbuzz 13.1.1 -> 13.2.1
glib 2.86.4 -> 2.88.0
aom 3.13.1 -> 3.13.2
svt-av1 4.0.1 -> 4.1.0
libnghttp2 1.68.0 -> 1.68.1
openexr 3.4.6 -> 3.4.8
ca-certificates 2025-12-02 -> 2026-03-19
esphome 2026.2.4 -> 2026.3.1
jupyterlab 4.5.6 -> 4.5.6_1
ada-url 3.4.3 -> 3.4.4
node 25.8.1_1 -> 25.8.2
fish 4.5.0 -> 4.6.0
icu4c@78 78.2 -> 78.3
jpeg-turbo 3.1.3 -> 3.1.4
- tailscale 1.96.2 now with easy file transfers "taildrop" https://tailscale.com/changelog
- Xcode 26.4 https://developer.apple.com/documentation/xcode-release-notes/xcode-26_4-release-notes

I haven't touched my desktop yet and probably won't.

Edit 1
I missed the Nextcloud update because I use that weird Nextcloud All-In-One container. nextcloud.com/changelog/

Edit 2
How did I miss the Mastodon upgrade from 4.5.7 to 4.5.8. I may be gone for a moment. https://github.com/mastodon/mastodon/releases

Edit 3
Why do I run a server in the garage?
evcc 0.209.6 -> 0.303.2 https://github.com/evcc-io/evcc/releases

🟠 CVE-2026-27880 - High (7.5)

The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27880/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-34374 in WWBN AVideo ≤26.0 allows unauthenticated SQL injection via stream key lookup during RTMP authentication. No patch out yet. Restrict access, use WAFs, & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-34374-cwe-89-improper-neutralization-of-s-171f2208 #OffSeq #SQLInjection #WWBN #VideoSecurity

🔴 CVE-2026-34374 - Critical (9.1)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` method constructs a SQL query by interpolating a stream key directly into the query string without parameterization. This method i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34374/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27858 - High (7.5)

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory.
Attacker can force managesieve-login to be unavailable by repeatedly crashing the process. Protect access to manag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-27858 (HIGH, 7.5): OX Dovecot Pro’s managesieve is at risk of remote DoS via unauthenticated memory exhaustion. Restrict access, monitor logs, and patch ASAP. No public exploits yet, but stay alert. https://radar.offseq.com/threat/cve-2026-27858-uncontrolled-resource-consumption-i-4ea18f33 #OffSeq #Dovecot #EmailSecurity

🟠 CVE-2026-29871 - High (7.5)

A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19) in the Beifong AI News and Podcast Agent backend in FastAPI backend, stream-audio endpoint, in file routers/podca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29871/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33755 - High (8.8)

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, and 26.0.17, an authenticated SQL Injection vulnerability in the JMAP `Contact/query` endpoint allows any authenticated user wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-15381 - High (8.1)

In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15381/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28368 - High (8.7)

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28368/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4960 - High (8.8)

A vulnerability was determined in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4960/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32241 - High (7.5)

Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension bac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32241/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32241 - High (7.5)

Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension bac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32241/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31943 - High (8.5)

LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth/domain.ts` fails to detect IPv4-mapped IPv6 addresses in their hex-normalized form, allowing any authenticated user to bypass ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31943/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Tenable Research Advisories have listed several vulnerabilities, three of them high-severity.

High: CVE-2026-5027: Langflow - Path Traversal Arbitrary File Write via upload_user_file https://www.tenable.com/security/research/tra-2026-26

High: CVE-2026-5026: Langflow - Stored XSS via Malicious SVG Upload https://www.tenable.com/security/research/tra-2026-25

High: CVE-2026-4984: Botpress - Credential Disclosure via Twilio Webhook Handler https://www.tenable.com/security/research/tra-2026-22

More here: https://www.tenable.com/security/research @tenable #infosec #vulnerability

⚠️ CRITICAL: CVE-2026-33728 in DataDog dd-trace-java (0.40.0 - <1.60.3) allows unauth RCE via unsafe deserialization if JMX/RMI port is exposed on JDK ≤16. Upgrade to 1.60.3+ & restrict access! https://radar.offseq.com/threat/cve-2026-33728-cwe-502-deserialization-of-untruste-d41c376a #OffSeq #Java #Infosec #CVE202633728

🔴 CVE-2026-5128 - Critical (10)

A sensitive information exposure vulnerability exists in ArthurFiorette steam-trader 2.1.1. An unauthenticated attacker can send a request to the /users API endpoint to retrieve highly sensitive Steam account data, including the account username,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5128 - Critical (10)

A sensitive information exposure vulnerability exists in ArthurFiorette steam-trader 2.1.1. An unauthenticated attacker can send a request to the /users API endpoint to retrieve highly sensitive Steam account data, including the account username,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-4415 (CRITICAL, CVSS 9.2) hits Gigabyte Control Center: unauth’d remote attackers can write files anywhere if pairing is enabled. No patch yet — disable pairing & monitor for anomalies. https://radar.offseq.com/threat/cve-2026-4415-cwe-23-relative-path-traversal-in-gi-d148431b #OffSeq #Vuln #Gigabyte #Infosec

🟠 CVE-2026-4415 - High (8.1)

Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is enabled, unauthenticated remote attackers can write arbitrary files to any location on the underlying operating system, leading to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4415/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-4415 (CRITICAL, CVSS 9.2) hits Gigabyte Control Center: unauth’d remote attackers can write files anywhere if pairing is enabled. No patch yet — disable pairing & monitor for anomalies. https://radar.offseq.com/threat/cve-2026-4415-cwe-23-relative-path-traversal-in-gi-d148431b #OffSeq #Vuln #Gigabyte #Infosec

🟠 CVE-2026-4415 - High (8.1)

Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is enabled, unauthenticated remote attackers can write arbitrary files to any location on the underlying operating system, leading to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4415/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15379 - Critical (10)

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15379/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15379 - Critical (10)

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15379/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3945 - High (7.5)

An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3945/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3945 - High (7.5)

An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version 1.11.3 allows an unauthenticated remote attacker to cause a denial of service (DoS). The issue occurs because chunk size values...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3945/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2328 - High (7.5)

An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2328/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2026-010
WAGO: Multiple Vulnerabilities in WAGO Solution Builder and WAGO Device Sphere

Multiple vulnerabilities have been identified in WAGO Solution Builder and WAGO Device Sphere that affect components responsible for authentication and system communication.
#CVE CVE-2025-55315, CVE-2026-2328

https://certvde.com/en/advisories/vde-2026-010/

#CSAF https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-010.json

🟠 CVE-2026-2328 - High (7.5)

An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2328/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2026-010
WAGO: Multiple Vulnerabilities in WAGO Solution Builder and WAGO Device Sphere

Multiple vulnerabilities have been identified in WAGO Solution Builder and WAGO Device Sphere that affect components responsible for authentication and system communication.
#CVE CVE-2025-55315, CVE-2026-2328

https://certvde.com/en/advisories/vde-2026-010/

#CSAF https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-010.json

⚠️ CVE-2026-5046 (HIGH): Tenda FH1201 v1.2.0.14(408) suffers stack-based buffer overflow via /goform/WrlExtraSet. Public exploit available — restrict remote access, monitor logs, and segment affected devices. https://radar.offseq.com/threat/cve-2026-5046-stack-based-buffer-overflow-in-tenda-7d25f76d #OffSeq #Infosec #RouterSecurity

🟠 CVE-2026-5046 - High (8.8)

A flaw has been found in Tenda FH1201 1.2.0.14(408). Affected is the function formWrlExtraSet of the file /goform/WrlExtraSet of the component Parameter Handler. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5046/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-5046 (HIGH): Tenda FH1201 v1.2.0.14(408) suffers stack-based buffer overflow via /goform/WrlExtraSet. Public exploit available — restrict remote access, monitor logs, and segment affected devices. https://radar.offseq.com/threat/cve-2026-5046-stack-based-buffer-overflow-in-tenda-7d25f76d #OffSeq #Infosec #RouterSecurity

🟠 CVE-2026-5046 - High (8.8)

A flaw has been found in Tenda FH1201 1.2.0.14(408). Affected is the function formWrlExtraSet of the file /goform/WrlExtraSet of the component Parameter Handler. Executing a manipulation of the argument GO can lead to stack-based buffer overflow. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5046/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15036 - Critical (9.6)

A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the la...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15036/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15036 - Critical (9.6)

A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the la...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15036/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-0560: HIGH-severity SSRF in parisneo/lollms (<2.2.0) allows remote attackers to access internal network/cloud endpoints via /api/files/export-content. Patch to 2.2.0+ or block unsafe URLs now! https://radar.offseq.com/threat/cve-2026-0560-cwe-918-server-side-request-forgery--5103940b #OffSeq #SSRF #Vuln #AppSec

🟠 CVE-2026-0560 - High (7.5)

A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0560/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-0560: HIGH-severity SSRF in parisneo/lollms (<2.2.0) allows remote attackers to access internal network/cloud endpoints via /api/files/export-content. Patch to 2.2.0+ or block unsafe URLs now! https://radar.offseq.com/threat/cve-2026-0560-cwe-918-server-side-request-forgery--5103940b #OffSeq #SSRF #Vuln #AppSec

🟠 CVE-2026-0560 - High (7.5)

A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails to validat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0560/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 HIGH severity: CVE-2026-0558 in parisneo/lollms (≤2.2.0) — /api/files/extract-text allows unauthenticated file uploads, risking DoS & info leaks. Restrict access, enforce auth, and monitor activity. No patch yet. https://radar.offseq.com/threat/cve-2026-0558-cwe-287-improper-authentication-in-p-51fddf90 #OffSeq #Vuln #AppSec

🟠 CVE-2026-0558 - High (7.5)

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-relate...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 HIGH severity: CVE-2026-0558 in parisneo/lollms (≤2.2.0) — /api/files/extract-text allows unauthenticated file uploads, risking DoS & info leaks. Restrict access, enforce auth, and monitor activity. No patch yet. https://radar.offseq.com/threat/cve-2026-0558-cwe-287-improper-authentication-in-p-51fddf90 #OffSeq #Vuln #AppSec

🟠 CVE-2026-0558 - High (7.5)

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other file-relate...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5045 - High (8.8)

A vulnerability was detected in Tenda FH1201 1.2.0.14(408). This impacts the function WrlclientSet of the file /goform/WrlclientSet of the component Parameter Handler. Performing a manipulation of the argument GO results in stack-based buffer over...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5045/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5045 - High (8.8)

A vulnerability was detected in Tenda FH1201 1.2.0.14(408). This impacts the function WrlclientSet of the file /goform/WrlclientSet of the component Parameter Handler. Performing a manipulation of the argument GO results in stack-based buffer over...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5045/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32915 - High (8.8)

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege sandboxed leaf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32915/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32915 - High (8.8)

OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability allowing leaf subagents to access the subagents control surface and resolve against parent requester scope instead of their own session tree. A low-privilege sandboxed leaf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32915/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32924 - Critical (9.8)

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass grou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32924 - Critical (9.8)

OpenClaw before 2026.3.12 contains an authorization bypass vulnerability where Feishu reaction events with omitted chat_type are misclassified as p2p conversations instead of group chats. Attackers can exploit this misclassification to bypass grou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32978 - High (8)

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32978/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32978 - High (8)

OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32978/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32975 - Critical (9.8)

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to allowlisted groups t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32975/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32975 - Critical (9.8)

OpenClaw before 2026.3.12 contains a weak authorization vulnerability in Zalouser allowlist mode that matches mutable group display names instead of stable group identifiers. Attackers can create groups with identical names to allowlisted groups t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32975/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5044 - High (8.8)

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. Such manipulation of the argument webpage leads to st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5044 - High (8.8)

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. Such manipulation of the argument webpage leads to st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5044 - High (8.8)

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. Such manipulation of the argument webpage leads to st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5044 - High (8.8)

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. Such manipulation of the argument webpage leads to st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33572 - High (8.4)

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information includ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33572/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33572 - High (8.4)

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information includ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33572/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-5041 (MEDIUM): Command injection in Chamber of Commerce Membership Mgmt System v1.0 via admin/pageMail.php. High privileges needed, public exploit exists. Input validation & patching advised. https://radar.offseq.com/threat/cve-2026-5041-command-injection-in-code-projects-c-82c5a99c #OffSeq #Vuln #CommandInjection #InfoSec

⚠️ CVE-2026-5041 (MEDIUM): Command injection in Chamber of Commerce Membership Mgmt System v1.0 via admin/pageMail.php. High privileges needed, public exploit exists. Input validation & patching advised. https://radar.offseq.com/threat/cve-2026-5041-command-injection-in-code-projects-c-82c5a99c #OffSeq #Vuln #CommandInjection #InfoSec

🚨 CVE-2026-5036: HIGH severity stack buffer overflow in Tenda 4G06 (04.06.01.29) enables remote code execution. Exploit code is public — patch or mitigate now. Watch for attacks on /goform/DhcpListClient. https://radar.offseq.com/threat/cve-2026-5036-stack-based-buffer-overflow-in-tenda-210df5d9 #OffSeq #CVE20265036 #RouterSecurity

🟠 CVE-2026-5036 - High (8.8)

A vulnerability was found in Tenda 4G06 04.06.01.29. This vulnerability affects the function fromDhcpListClient of the file /goform/DhcpListClient of the component Endpoint. Performing a manipulation of the argument page results in stack-based buf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5036/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-5036: HIGH severity stack buffer overflow in Tenda 4G06 (04.06.01.29) enables remote code execution. Exploit code is public — patch or mitigate now. Watch for attacks on /goform/DhcpListClient. https://radar.offseq.com/threat/cve-2026-5036-stack-based-buffer-overflow-in-tenda-210df5d9 #OffSeq #CVE20265036 #RouterSecurity

🟠 CVE-2026-5036 - High (8.8)

A vulnerability was found in Tenda 4G06 04.06.01.29. This vulnerability affects the function fromDhcpListClient of the file /goform/DhcpListClient of the component Endpoint. Performing a manipulation of the argument page results in stack-based buf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5036/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-5033 (MEDIUM): SQL injection in code-projects Accounting System 1.0 (/view_costumer.php, cos_id) is being actively exploited. Remote risk — monitor and patch as soon as fixes arrive. More: https://radar.offseq.com/threat/cve-2026-5033-sql-injection-in-code-projects-accou-9e1a8bbd #OffSeq #SQLInjection #VulnResearch

🚨 CVE-2026-5033 (MEDIUM): SQL injection in code-projects Accounting System 1.0 (/view_costumer.php, cos_id) is being actively exploited. Remote risk — monitor and patch as soon as fixes arrive. More: https://radar.offseq.com/threat/cve-2026-5033-sql-injection-in-code-projects-accou-9e1a8bbd #OffSeq #SQLInjection #VulnResearch

🔴 CVE-2026-5024: HIGH-severity stack buffer overflow in D-Link DIR-513 (v1.10). Remote, no auth needed, public exploit released. Replace ASAP or isolate device & restrict access. No patch from vendor. https://radar.offseq.com/threat/cve-2026-5024-stack-based-buffer-overflow-in-d-lin-e70f155a #OffSeq #Vulnerability #RouterSecurity

🟠 CVE-2026-5024 - High (8.8)

A vulnerability was found in D-Link DIR-513 1.10. This issue affects the function formSetEmail of the file /goform/formSetEmail. Performing a manipulation of the argument curTime results in stack-based buffer overflow. The attack is possible to be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5024/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5024: HIGH-severity stack buffer overflow in D-Link DIR-513 (v1.10). Remote, no auth needed, public exploit released. Replace ASAP or isolate device & restrict access. No patch from vendor. https://radar.offseq.com/threat/cve-2026-5024-stack-based-buffer-overflow-in-d-lin-e70f155a #OffSeq #Vulnerability #RouterSecurity

🟠 CVE-2026-5024 - High (8.8)

A vulnerability was found in D-Link DIR-513 1.10. This issue affects the function formSetEmail of the file /goform/formSetEmail. Performing a manipulation of the argument curTime results in stack-based buffer overflow. The attack is possible to be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5024/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-4987 (HIGH): SureForms plugin for WordPress lets attackers bypass payment amount validation by setting form_id to 0 — no auth needed, all versions <=2.5.2 at risk. Patch or mitigate now! https://radar.offseq.com/threat/cve-2026-4987-cwe-20-improper-input-validation-in--6438ea07 #OffSeq #WordPress #Vuln #PaymentSecurity

🟠 CVE-2026-4987 - High (7.5)

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a paym...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4987/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-4987 (HIGH): SureForms plugin for WordPress lets attackers bypass payment amount validation by setting form_id to 0 — no auth needed, all versions <=2.5.2 at risk. Patch or mitigate now! https://radar.offseq.com/threat/cve-2026-4987-cwe-20-improper-input-validation-in--6438ea07 #OffSeq #WordPress #Vuln #PaymentSecurity

🟠 CVE-2026-4987 - High (7.5)

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a paym...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4987/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-4987 (HIGH): SureForms for WordPress lets unauthenticated attackers bypass payment validation via form_id=0. All versions vulnerable — financial loss risk. Patch when available or apply server-side validation. https://radar.offseq.com/threat/cve-2026-4987-cwe-20-improper-input-validation-in--6438ea07 #OffSeq #WordPress #Vuln

🚨 CVE-2026-33976 (CRITICAL, CVSS 9.7): Notesnook Web/Desktop <3.3.11 vulnerable to stored XSS → RCE via Web Clipper. Patch ASAP & review Electron settings. Details: https://radar.offseq.com/threat/cve-2026-33976-cwe-79-improper-neutralization-of-i-cedece5d #OffSeq #Cybersecurity #Infosec #Vulnerability

🚨 CVE-2026-33976 (CRITICAL, CVSS 9.7): Notesnook Web/Desktop <3.3.11 vulnerable to stored XSS → RCE via Web Clipper. Patch ASAP & review Electron settings. Details: https://radar.offseq.com/threat/cve-2026-33976-cwe-79-improper-neutralization-of-i-cedece5d #OffSeq #Cybersecurity #Infosec #Vulnerability

🔴 CVE-2026-33976 - Critical (9.6)

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper prese...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33976 - Critical (9.6)

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a stored XSS in the Web Clipper rendering flow can be escalated to remote code execution in the desktop app. The root cause is that the clipper prese...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨CRITICAL: CVE-2026-33976 in Notesnook Web/Desktop <3.3.11 — stored XSS in Web Clipper leads to RCE via Electron misconfig. Patch ASAP & review Electron security settings. More: https://radar.offseq.com/threat/cve-2026-33976-cwe-79-improper-neutralization-of-i-cedece5d #OffSeq #XSS #CyberSecurity #RCE

🚨 CVE-2026-33875 (CRITICAL, CVSS 9.3): gematik app-Authenticator <4.16.0 is vulnerable to authentication hijack via malicious deep links. No workarounds — update to 4.16.0+ urgently! https://radar.offseq.com/threat/cve-2026-33875-cwe-940-improper-verification-of-so-189b5f61 #OffSeq #CVE202633875 #HealthIT #VulnAlert

🔴 CVE-2026-33875 - Critical (9.3)

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33875/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33875 - Critical (9.3)

Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to authentication flow hijacking, potentially allowing attackers to authenticate with the identities of victim use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33875/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33939 - High (7.5)

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33943 - High (8.8)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to achieve Remote Code Execution (R...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33943/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33989 - High (8.1)

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33989 - High (8.1)

Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33980 - High (8.3)

Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants to execute KQL queries and explore Azure Data Explorer (ADX/Kusto) databases through standardized interfaces. Versions up to and including 0.1.1 con...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33955 - High (8.6)

Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop, a cross-site scripting vulnerability stored in the note history comparison viewer can escalate to remote code execution in a desktop application. The issue is triggered when a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33955/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33895 - High (7.5)

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the grou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33895/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33895 - High (7.5)

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the grou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33895/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4976 - High (8.8)

A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid results in buffer overflow. The attack can be launch...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4974 - High (8.8)

A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of the component POST Request Handler. Executing a manipulation of the argument Time can lead to stack-based bu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4416 - High (7.8)

The Performance Library component of Gigabyte Control Center has an Insecure Deserialization vulnerability. Authenticated local attackers can send a malicious serialized payload to the EasyTune Engine service, resulting in privilege escalation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4416/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4416 - High (7.8)

The Performance Library component of Gigabyte Control Center has an Insecure Deserialization vulnerability. Authenticated local attackers can send a malicious serialized payload to the EasyTune Engine service, resulting in privilege escalation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4416/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-4176 (HIGH): Perl Compress::Raw::Zlib uses a vulnerable zlib, risking memory corruption or code execution. Affects 5.9.4 – 5.43.0. Update to Compress::Raw::Zlib 2.221+ ASAP! https://radar.offseq.com/threat/cve-2026-4176-cwe-1395-dependency-on-vulnerable-th-556b643e #OffSeq #Perl #Vuln #SysAdmin

⚠️ CVE-2026-4176 (HIGH): Perl Compress::Raw::Zlib uses a vulnerable zlib, risking memory corruption or code execution. Affects 5.9.4 – 5.43.0. Update to Compress::Raw::Zlib 2.221+ ASAP! https://radar.offseq.com/threat/cve-2026-4176-cwe-1395-dependency-on-vulnerable-th-556b643e #OffSeq #Perl #Vuln #SysAdmin

🛑 CVE-2026-3124: HIGH-severity IDOR in wpchill Download Monitor (all versions) lets unauth attackers finalize orders by reusing PayPal tokens — digital goods can be stolen. Patch or apply strict validation ASAP! https://radar.offseq.com/threat/cve-2026-3124-cwe-639-authorization-bypass-through-6397300c #OffSeq #WordPress #Vulnerability #IDOR

🟠 CVE-2026-3124 - High (7.5)

The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible fo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛑 CVE-2026-3124: HIGH-severity IDOR in wpchill Download Monitor (all versions) lets unauth attackers finalize orders by reusing PayPal tokens — digital goods can be stolen. Patch or apply strict validation ASAP! https://radar.offseq.com/threat/cve-2026-3124-cwe-639-authorization-bypass-through-6397300c #OffSeq #WordPress #Vulnerability #IDOR

🟠 CVE-2026-3124 - High (7.5)

The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible fo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2370 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2370/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2370 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 affecting Jira Connect installations that could have allowed an authenticated user with minimal workspace p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2370/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33894 - High (7.5)

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can fo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33894/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33894 - High (7.5)

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can fo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33894/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛑 CVE-2026-4946: HIGH severity OS command injection in Ghidra <12.0.3. Crafted binaries can trigger arbitrary code via clickable @Execute annotations in the UI. Upgrade now & analyze unknown files in sandboxes. https://radar.offseq.com/threat/cve-2026-4946-cwe-78-improper-neutralization-of-sp-c53cae64 #OffSeq #Ghidra #BlueTeam

🟠 CVE-2026-4946 - High (8.8)

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4946/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛑 CVE-2026-4946: HIGH severity OS command injection in Ghidra <12.0.3. Crafted binaries can trigger arbitrary code via clickable @Execute annotations in the UI. Upgrade now & analyze unknown files in sandboxes. https://radar.offseq.com/threat/cve-2026-4946-cwe-78-improper-neutralization-of-sp-c53cae64 #OffSeq #Ghidra #BlueTeam

🟠 CVE-2026-4946 - High (8.8)

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data, resulting in arbitrary command execution when an analyst interacts with the UI. Specifically, the @execute annotation (which ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4946/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 CVE-2026-34005 (HIGH): Xiongmai DVR/NVR (v4.03.R11) root OS command injection via DVRIP (port 34567). Authenticated attackers can fully compromise devices. Restrict access, monitor, and segment ASAP. https://radar.offseq.com/threat/cve-2026-34005-cwe-78-improper-neutralization-of-s-b117df4c #OffSeq #Xiongmai #Infosec #Vuln

🟠 CVE-2026-34005 - High (8.8)

In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34005/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 CVE-2026-34005 (HIGH): Xiongmai DVR/NVR (v4.03.R11) root OS command injection via DVRIP (port 34567). Authenticated attackers can fully compromise devices. Restrict access, monitor, and segment ASAP. https://radar.offseq.com/threat/cve-2026-34005-cwe-78-improper-neutralization-of-s-b117df4c #OffSeq #Xiongmai #Infosec #Vuln

🟠 CVE-2026-34005 - High (8.8)

In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via an authenticated DVRIP protocol (TCP port 34567) request to the NetWork.NetCommon...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34005/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-0562 (HIGH, CVSS 8.3) in parisneo/lollms ≤2.2.0: Authenticated users can accept/reject others' friend requests via IDOR in /api/friends/requests/{friendship_id}. Upgrade to 2.2.0+ and audit API auth now! https://radar.offseq.com/threat/cve-2026-0562-cwe-863-incorrect-authorization-in-p-77e45474 #OffSeq #CVE20260562 #IDOR #AppSec

🟠 CVE-2026-0562 - High (8.3)

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function in `backend/routers/friends.py` does not impleme...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-0562 (HIGH, CVSS 8.3) in parisneo/lollms ≤2.2.0: Authenticated users can accept/reject others' friend requests via IDOR in /api/friends/requests/{friendship_id}. Upgrade to 2.2.0+ and audit API auth now! https://radar.offseq.com/threat/cve-2026-0562-cwe-863-incorrect-authorization-in-p-77e45474 #OffSeq #CVE20260562 #IDOR #AppSec

🟠 CVE-2026-0562 - High (8.3)

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function in `backend/routers/friends.py` does not impleme...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22744 - High (7.5)

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value directly into the @field:{VALUE} RediSearch TAG block without escaping ch...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22744 - High (7.5)

In RedisFilterExpressionConverter of spring-ai-redis-store, when a user-controlled string is passed as a filter value for a TAG field, stringValue() inserts the value directly into the @field:{VALUE} RediSearch TAG block without escaping ch...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22742 - High (8.6)

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22742/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22742 - High (8.6)

Spring AI's spring-ai-bedrock-converse contains a Server-Side Request Forgery (SSRF) vulnerability in BedrockProxyChatModel when processing multimodal messages that include user-supplied media URLs. Insufficient validation of those URLs allows ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22742/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22738 - Critical (9.8)

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22738/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22738 - Critical (9.8)

In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. Only applications that use SimpleVectorStor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22738/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-22738 in Spring AI SimpleVectorStore allows unauth RCE via SpEL injection (1.0.0 – 1.0.4, 1.1.0 – 1.1.3). Patch to 1.0.5/1.1.4 when released. Validate input now! https://radar.offseq.com/threat/cve-2026-22738-vulnerability-in-spring-spring-ai-473dec2d #OffSeq #SpringAI #infosec #CVE202622738

🟠 CVE-2026-33573 - High (8.8)

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override workspace boundaries by supplying attacker-controlled spawnedBy and wo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33573 - High (8.8)

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override workspace boundaries by supplying attacker-controlled spawnedBy and wo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33573 - High (8.8)

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override workspace boundaries by supplying attacker-controlled spawnedBy and wo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33573 - High (8.8)

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with operator.write permission to override workspace boundaries by supplying attacker-controlled spawnedBy and wo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32980 - High (7.5)

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32980 - High (7.5)

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32980 - High (7.5)

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32980 - High (7.5)

OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33575 - High (7.5)

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can rec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33575 - High (7.5)

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can rec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33575 - High (7.5)

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can rec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33575 - High (7.5)

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can rec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32987 - Critical (9.8)

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32987/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32987 - Critical (9.8)

OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. Attackers can verify a valid bootstrap code multiple times before approval to escalate pending pairing scope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32987/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32922 - Critical (9.9)

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32922 - Critical (9.9)

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32922 - Critical (9.9)

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32922 - Critical (9.9)

OpenClaw before 2026.3.11 contains a privilege escalation vulnerability in device.token.rotate that allows callers with operator.pairing scope to mint tokens with broader scopes by failing to constrain newly minted scopes to the caller's current s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32974 - High (8.6)

OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32973 - Critical (9.8)

OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that overmatches on POSIX paths. Attackers can exploit the ? wildcard mat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32973/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32914 - High (8.8)

OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner-only surfaces. Attackers with command authorization can read or mo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32914 - High (8.8)

OpenClaw before 2026.3.12 contains an insufficient access control vulnerability in the /config and /debug command handlers that allows command-authorized non-owners to access owner-only surfaces. Attackers with command authorization can read or mo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32918 - High (8.4)

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify sess...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32918/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32918 - High (8.4)

OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify sess...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32918/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34226 - High (7.5)

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { crede...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5043 - High (8.8)

A weakness has been identified in Belkin F9K1122 1.00.33. The impacted element is the function formSetPassword of the file /goform/formSetPassword of the component Parameter Handler. This manipulation of the argument webpage causes stack-based buf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5043/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5043 - High (8.8)

A weakness has been identified in Belkin F9K1122 1.00.33. The impacted element is the function formSetPassword of the file /goform/formSetPassword of the component Parameter Handler. This manipulation of the argument webpage causes stack-based buf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5043/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5042 - High (8.8)

A security flaw has been discovered in Belkin F9K1122 1.00.33. The affected element is the function formCrossBandSwitch of the file /goform/formCrossBandSwitch of the component Parameter Handler. The manipulation of the argument webpage results in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5042 - High (8.8)

A security flaw has been discovered in Belkin F9K1122 1.00.33. The affected element is the function formCrossBandSwitch of the file /goform/formCrossBandSwitch of the component Parameter Handler. The manipulation of the argument webpage results in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ MEDIUM severity SQL Injection (CVE-2026-5035) found in code-projects Accounting System 1.0 (/view_work.php, Parameter Handler). Public exploit available — review your systems and restrict access if possible. https://radar.offseq.com/threat/cve-2026-5035-sql-injection-in-code-projects-accou-b844fbad #OffSeq #SQLInjection #Vuln

⚠️ MEDIUM severity SQL Injection (CVE-2026-5035) found in code-projects Accounting System 1.0 (/view_work.php, Parameter Handler). Public exploit available — review your systems and restrict access if possible. https://radar.offseq.com/threat/cve-2026-5035-sql-injection-in-code-projects-accou-b844fbad #OffSeq #SQLInjection #Vuln

🔎 HIGH: CVE-2026-5021 in Tenda F453 v1.0.0.3 enables remote stack buffer overflow via /goform/PPTPUserSetting — no auth needed! PoC is public; patch/mitigate now to block total device compromise. https://radar.offseq.com/threat/cve-2026-5021-stack-based-buffer-overflow-in-tenda-f1fb8811 #OffSeq #CVE20265021 #Infosec #Router

🟠 CVE-2026-5021 - High (8.8)

A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. This manipulation of the argument delno causes stack-based buffer overflow. Remote exploitation ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5021/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 HIGH: CVE-2026-5021 in Tenda F453 v1.0.0.3 enables remote stack buffer overflow via /goform/PPTPUserSetting — no auth needed! PoC is public; patch/mitigate now to block total device compromise. https://radar.offseq.com/threat/cve-2026-5021-stack-based-buffer-overflow-in-tenda-f1fb8811 #OffSeq #CVE20265021 #Infosec #Router

🟠 CVE-2026-5021 - High (8.8)

A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. This manipulation of the argument delno causes stack-based buffer overflow. Remote exploitation ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5021/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

@offseq

CRITICAL: CVE-2026-4851 affects CASIANO GRID::Machine

... which is abandonware last updated in 2011.

⚠️ CRITICAL: CVE-2026-4851 affects CASIANO GRID::Machine (≤0.127). Malicious remote hosts can trigger client-side RCE via unsafe eval() deserialization. Only connect to trusted hosts & review code paths. Details: https://radar.offseq.com/threat/cve-2026-4851-cwe-502-deserialization-of-untrusted-4ee6eb90 #OffSeq #CVE20264851 #Perl #Security

@offseq

CRITICAL: CVE-2026-4851 affects CASIANO GRID::Machine

... which is abandonware last updated in 2011.

⚠️ CRITICAL: CVE-2026-4851 affects CASIANO GRID::Machine (≤0.127). Malicious remote hosts can trigger client-side RCE via unsafe eval() deserialization. Only connect to trusted hosts & review code paths. Details: https://radar.offseq.com/threat/cve-2026-4851-cwe-502-deserialization-of-untrusted-4ee6eb90 #OffSeq #CVE20264851 #Perl #Security

⚠️ CVE-2026-5019: SQL injection in code-projects Simple Food Order System 1.0 (all-orders.php, Status param). MEDIUM severity, public exploit available — remote attackers at risk. Monitor and restrict exposure. https://radar.offseq.com/threat/cve-2026-5019-sql-injection-in-code-projects-simpl-bb8230db #OffSeq #SQLi #Vuln

⚠️ CVE-2026-5019: SQL injection in code-projects Simple Food Order System 1.0 (all-orders.php, Status param). MEDIUM severity, public exploit available — remote attackers at risk. Monitor and restrict exposure. https://radar.offseq.com/threat/cve-2026-5019-sql-injection-in-code-projects-simpl-bb8230db #OffSeq #SQLi #Vuln

🚨 HIGH severity buffer overflow in Wavlink WL-WN579X3-C (231124): Remote attackers can exploit UPnP Handler to run code. No patch from vendor. Disable UPnP & block remote access immediately. CVE-2026-5004 https://radar.offseq.com/threat/cve-2026-5004-stack-based-buffer-overflow-in-wavli-7ae39014 #OffSeq #Infosec #RouterSecurity #CVE20265004

🟠 CVE-2026-5004 - High (8.8)

A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This impacts the function sub_4019FC of the file /cgi-bin/firewall.cgi of the component UPNP Handler. Executing a manipulation of the argument UpnpEnabled can lead to stack-based buffe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5004/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack