🟠 CVE-2026-47871 - High (8.8)

VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks.

Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 3...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47871/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47871 - High (8.8)

VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory traversal attacks.

Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 3...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47871/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47869 - High (8.7)

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code.

Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47869/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47869 - High (8.7)

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code.

Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixed in 31.2.2...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47869/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47868 - High (7.8)

VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root.

Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47868/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47868 - High (7.8)

VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root.

Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2 (fixe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47868/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47867 - High (8.7)

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely.

Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47867/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47867 - High (8.7)

VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi Control plane and execute code remotely.

Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 through 31.2.2...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47867/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47866 - High (8.3)

VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization.

Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 throug...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47866/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47866 - High (8.3)

VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization.

Affected versions:
32.1.1 (fixed in 32.1.2)
31.1.1 throug...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47866/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-47865 - Critical (9.8)

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.

Affected versions:
31.1.1 through 31.2.2 (fixed ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47865/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-47865 - Critical (9.8)

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.

Affected versions:
31.1.1 through 31.2.2 (fixed ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47865/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Broadcom Patches Seven Critical and High-Severity Flaws in VMware Avi Load Balancer

Broadcom patched seven vulnerabilities in VMware Avi Load Balancer, including a critical authentication bypass (CVE-2026-47865) that allows unauthenticated network attackers to take over the control plane. The updates also fix flaws enabling remote code execution, privilege escalation, and directory traversal across multiple software versions.

**If you use VMware Avi Load Balancer, make sure its management interface is isolated from the internet and reachable only from trusted admin networks. A flaw lets attackers take it over without any password. Then update ASAP to the patched versions (32.1.2, 31.2.2-2p3, or 30.2.7).**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/broadcom-patches-seven-critical-and-high-severity-flaws-in-vmware-avi-load-balancer-v-l-p-w-v/gD2P6Ple2L

Broadcom patched seven severe flaws including CVE-2026-47865, a CVSS 9.8 authentication bypass letting any network-adjacent attacker waltz straight into your Avi control plane without credentials — think of it as the cursed skeleton key from Oblivion, except real and in your infrastructure.

Also afflicted: remote code execution, privilege escalation, and directory traversal bugs. (2/3)

🐧 SIGINT // Linux Watch — 2026-07-18

A KVM bug that matters if you run nested virtualization anywhere near Ubuntu hosts. Check your patch levels before someone else checks them for you.

🔗 https://quasa.io/media/januscape-cve-2026-53359-kvm-vulnerability-patches-and-mitigations

#Linux #OpenSource #FOSS

From now on all #CVe #CVEAlert additional to #yara #Sigma and #Suricate rules will have #Splunk #Wazuh rules all for FREE no tracking no registration, no payments! #cybersecurity #devsecops #devops #infosec #redteam #blueteam #github #gitlab #git #developers #developer info source and follow for more updates as there will be more EX: https://www.valtersit.com/cve/CVE-2026-9734/

wp2shell (CVE-2026-63030 + CVE-2026-60137): Independent Root Cause Analysis https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause

🔴 New security advisory:

CVE-2026-63030 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-63030-wordpress-rest-api-unauth-rce-poc

#Cybersecurity #VulnerabilityManagement #CyberSec

Two critical SQLi vulnerabilities in WordPress

WordPress 7.0.2는 치명적 SQL 인젝션 취약점 1건과 고위험 보안 이슈 1건을 수정하는 긴급 보안 릴리스다. CVE-2026-60137은 촉진된 SQL 인젝션 문제이며, CVE-2026-63030은 REST API 배치 라우트 혼동을 악용한 SQL 인젝션으로 원격 코드 실행(RCE)까지 이어질 수 있다. 영향을 받는 6.9 계열은 6.9.5, 6.8 계열은 6.8.6으로 업데이트해야 하며, 7.1 beta도 beta2에서 수정됐다. WordPress 운영 환경이나 해당 CMS를 통한 AI 서비스·콘텐츠 파이프라인을 운영한다면 강제 자동 업데이트 여부를 확인하고 즉시 패치 및 노...

https://wordpress.org/news/2026/07/wordpress-7-0-2-release/

WordPress pre-auth RCE CVE-2026-63030 chains a REST batch bug with SQL injection. Details and a public PoC are out. Update to WordPress 7.0.2 now.

#WordPress #PreAuthRCE #CVE202663030 #SQLInjection #wp2shell #WebSecurity #InfoSec

https://securityonline.info/wordpress-pre-auth-rce-cve-2026-63030/?utm_source=mastodon&utm_medium=jetpack_social

‼️🚨 CVE-2026-63030 // wp2shell-poc: Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion.

PoC: https://github.com/Icex0/wp2shell-poc

@shellsharks New fodder for vulnerability.garden: wp2shell is CVE-2026-63030 / https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q

wp2shell (CVE-2026-63030 + CVE-2026-60137): Independent Root Cause Analysis https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause

WordPress pre-auth RCE CVE-2026-63030 chains a REST batch bug with SQL injection. Details and a public PoC are out. Update to WordPress 7.0.2 now.

#WordPress #PreAuthRCE #CVE202663030 #SQLInjection #wp2shell #WebSecurity #InfoSec

https://securityonline.info/wordpress-pre-auth-rce-cve-2026-63030/?utm_source=mastodon&utm_medium=jetpack_social

‼️🚨 CVE-2026-63030 // wp2shell-poc: Proof-of-concept for an unauthenticated SQL injection in WordPress core that chains to remote code execution, via REST batch route confusion.

PoC: https://github.com/Icex0/wp2shell-poc

@shellsharks New fodder for vulnerability.garden: wp2shell is CVE-2026-63030 / https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q

wp2shell (CVE-2026-63030 + CVE-2026-60137): Independent Root Cause Analysis https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause

「WordPressコアに新たなwp2shellの脆弱性が発見され、認証されていない攻撃者がコードを実行できるようになった。 」： #TheHackerNews

「匿名HTTPリクエストによって、WordPressサイト上でコードを実行できる脆弱性が発見されました。このバグはコア部分に存在するため、プラグインを一切インストールしていない状態でも悪用可能です。WordPressが6.9.5と7.0.2をリリースし、自動更新システムによる強制更新機能を有効にした金曜日までは、6.9および7.0バージョンのすべてのサイトが影響を受けていました。

wp2shell は1つのバグではなく、2つのバグから成り立っており、どちらにもCVE IDが付与されています。CVE -2026-63030 はREST APIのバッチルーティングの混同に関する脆弱性、 CVE-2026-60137 はWordPressコアにおけるSQLインジェクションの脆弱性です。 」

https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html

#prattohome

Two critical SQLi vulnerabilities in WordPress

WordPress 7.0.2는 치명적 SQL 인젝션 취약점 1건과 고위험 보안 이슈 1건을 수정하는 긴급 보안 릴리스다. CVE-2026-60137은 촉진된 SQL 인젝션 문제이며, CVE-2026-63030은 REST API 배치 라우트 혼동을 악용한 SQL 인젝션으로 원격 코드 실행(RCE)까지 이어질 수 있다. 영향을 받는 6.9 계열은 6.9.5, 6.8 계열은 6.8.6으로 업데이트해야 하며, 7.1 beta도 beta2에서 수정됐다. WordPress 운영 환경이나 해당 CMS를 통한 AI 서비스·콘텐츠 파이프라인을 운영한다면 강제 자동 업데이트 여부를 확인하고 즉시 패치 및 노...

https://wordpress.org/news/2026/07/wordpress-7-0-2-release/

🚨 EUVD-2026-45280

📊 Score: n/a
📦 Product: WordPress, WordPress
🏢 Vendor: WordPress
📅 Updated: 2026-07-17

📝 WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve R...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45280

#cybersecurity #infosec #euvd #cve #vulnerability

wp2shell (CVE-2026-63030 + CVE-2026-60137): Independent Root Cause Analysis https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause

「WordPressコアに新たなwp2shellの脆弱性が発見され、認証されていない攻撃者がコードを実行できるようになった。 」： #TheHackerNews

「匿名HTTPリクエストによって、WordPressサイト上でコードを実行できる脆弱性が発見されました。このバグはコア部分に存在するため、プラグインを一切インストールしていない状態でも悪用可能です。WordPressが6.9.5と7.0.2をリリースし、自動更新システムによる強制更新機能を有効にした金曜日までは、6.9および7.0バージョンのすべてのサイトが影響を受けていました。

wp2shell は1つのバグではなく、2つのバグから成り立っており、どちらにもCVE IDが付与されています。CVE -2026-63030 はREST APIのバッチルーティングの混同に関する脆弱性、 CVE-2026-60137 はWordPressコアにおけるSQLインジェクションの脆弱性です。 」

https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html

#prattohome

CVE-2026-55445: Qinglong <2.20.1 has a CRITICAL improper authentication bug (CVSS 9.3). Attackers can reset admin credentials on initialized systems via /open/user/init. Upgrade to 2.20.1 ASAP. https://radar.offseq.com/threat/cve-2026-55445-cwe-287-improper-authentication-in--3a378a9a77ee78d0 #OffSeq #CVE202655445 #Vuln #Qinglong

🔴 CVE-2026-8505 - Critical (9.8)

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8505/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL (CVSS 9.8): CVE-2026-8505 in IBM Langflow OSS 1.0.0 – 1.10.0 enables unauthenticated RCE via default webhook auth config. Set WEBHOOK_AUTH_ENABLE=True to mitigate until official fix. Details: https://radar.offseq.com/threat/cve-2026-8505-vulnerability-in-ibm-langflow-oss-6558aceea84f8b7d #OffSeq #CVE20268505 #RCE #IBM

🔴 CVE-2026-8505 - Critical (9.8)

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8505/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL (CVSS 9.8): CVE-2026-8505 in IBM Langflow OSS 1.0.0 – 1.10.0 enables unauthenticated RCE via default webhook auth config. Set WEBHOOK_AUTH_ENABLE=True to mitigate until official fix. Details: https://radar.offseq.com/threat/cve-2026-8505-vulnerability-in-ibm-langflow-oss-6558aceea84f8b7d #OffSeq #CVE20268505 #RCE #IBM

CVE-2026-56740 - DoS in JLine Telnet server. Unauthenticated attackers can flood env variables to exhaust JVM heap memory. CVSS 7.5. No patch yet - disable telnet module if possible. #CVE #infosec #Java

https://www.valtersit.com/cve/CVE-2026-56740/

🟠 CVE-2026-56740 - High (7.5)

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and Te...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56740/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56740 - High (7.5)

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and Te...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56740/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9171 - High (7.5)

IBM PowerVM Novalink are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9171/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9171 - High (7.5)

IBM PowerVM Novalink are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9171/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-9135 - Critical (9.9)

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_component...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9135/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-9135 - Critical (9.9)

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_component...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9135/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-54498 - High (8.7)

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base#around_render can return HTML-unsafe strings that bypass the escaping behavior applied t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54498/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-54498 - High (8.7)

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Base#around_render can return HTML-unsafe strings that bypass the escaping behavior applied t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54498/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-48062 - Critical (9.8)

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a resu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48062/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-48062 - Critical (9.8)

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a resu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48062/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44891 - High (7.5)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative siz...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44891 - High (7.5)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative siz...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-13446 - Critical (9.8)

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13446/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-13446: IBM Langflow OSS 1.0.0 – 1.10.1 contains hard-coded credentials (CRITICAL, CVSS 9.8). Total system compromise possible. No patch yet — restrict access, monitor activity. More: https://radar.offseq.com/threat/cve-2026-13446-cwe-798-use-of-hard-coded-credentia-e33f708cc1420dc3 #OffSeq #Vuln #Cybersecurity #IBM

🔴 CVE-2026-13446 - Critical (9.8)

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13446/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-13446: IBM Langflow OSS 1.0.0 – 1.10.1 contains hard-coded credentials (CRITICAL, CVSS 9.8). Total system compromise possible. No patch yet — restrict access, monitor activity. More: https://radar.offseq.com/threat/cve-2026-13446-cwe-798-use-of-hard-coded-credentia-e33f708cc1420dc3 #OffSeq #Vuln #Cybersecurity #IBM

🟠 CVE-2026-13445 - High (8.1)

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13445/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-13445 - High (8.1)

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13445/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-8635 - Critical (9.9)

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8635/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-8635 - Critical (9.9)

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8635/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-13448 - Unauthenticated RCE in IBM Langflow OSS 1.0.0-1.10.1. Incomplete denylist allows code execution via build endpoint. CVSS 8.1. No patch available. Disable or restrict access immediately. #CVE #IBM #infosec

https://www.valtersit.com/cve/CVE-2026-13448/

Broadcom has new advisories addressing two high-severity vulnerabilities that were fist published on the 15th https://support.broadcom.com/web/ecx/security-advisory

Cisco:

Medium Severity: CVE-2025-20204and CVE-2025-20205 Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-42tgsdMG @TalosSecurity

And if you missed this yesterday, CISA added two Fortinet vulnerabilities to the catalogue:

CISA:

CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-39808

CVE-2026-25089: Fortinet FortiSandbox OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-25089

And a Microsoft vulnerability:

CISA: CVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-58644 #Microsoft #CISA #Fortinet #infosec #vulnerability #Cisco #Broadcom

🔴 CVE-2026-9103 - Critical (9.8)

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9103/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-9103 - Critical (9.8)

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9103/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

MohibShaikh clawvet API server <0.7.5 (CVE-2026-62241) suffers a CRITICAL flaw: hard-coded JWT secret enables unauthenticated user data access and session cookie forgery. Change secrets & limit endpoint access. https://radar.offseq.com/threat/cve-2026-62241-missing-authentication-for-critical-b8ebafbae06b4bce #OffSeq #CVE202662241 #vuln

CVE-2026-44436 - High-severity DoS in Quicly (H2O HTTP server). Connection ID handling flaw can corrupt state. CVSS 7.5. No patch available yet. Monitor for updates. #CVE #infosec #cybersecurity

https://www.valtersit.com/cve/CVE-2026-44436/

🟠 CVE-2026-55173 - High (8.1)

WWBN AVideo is an open source video platform. Versions 29.0 and below remain vulnerable to OS command injection because the fix for CVE-2026-33482 was incomplete and still does not neutralize a single & ( the shell background operator). CVE-2026-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55173/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-62232 (CRITICAL): getgrav Grav <2.0.4 has a 2FA bypass flaw — attackers knowing a user's password can overwrite the 2FA secret, reducing protection to password-only. Monitor & restrict access. Patch status pending. https://radar.offseq.com/threat/cve-2026-62232-missing-authorization-in-getgrav-gr-604d58721f0c378d #OffSeq #CVE202662232 #2FA #infosec

CVE-2026-11961 (CRITICAL): User Registration & Membership plugin (pre-5.2.3) allows unauthenticated users to assign arbitrary membership tiers, including admin, during signup. Disable or restrict registration until fixed. https://radar.offseq.com/threat/cve-2026-11961-cwe-269-improper-privilege-manageme-20cb46cff61ded54 #OffSeq #WordPress #CVE2026

CVE-2026-59117 - Integer overflow in Wraparound Windows Terminal enables network-based RCE. CVSS 7.5. No patch available. Monitor systems and restrict network access. #CVE #infosec #cybersecurity

https://www.valtersit.com/cve/CVE-2026-59117/

🔴 CVE-2026-15982 - Critical (9.8)

The Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.8.4. This is due to due to a missing capability check on the 'a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-15982 | CodeRevolution Aimogen Pro (≤2.8.4) has a CRITICAL privilege escalation flaw — attackers can leverage missing capability checks to create admin accounts. Urgent patching advised. https://radar.offseq.com/threat/cve-2026-15982-cwe-269-improper-privilege-manageme-e0b1a13e8364d483 #OffSeq #WordPress #Vulnerability #Infosec

CRITICAL: CVE-2026-63305 impacts WWBN AVideo ≤29.0. OS command injection in ffmpeg.json.php allows arbitrary command execution as the web-server user. No patch yet — restrict access & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-63305-improper-neutralization-of-special--2152563144062b29 #OffSeq #Vuln #WWBN #CVE202663305

Broadcom has new advisories addressing two high-severity vulnerabilities that were fist published on the 15th https://support.broadcom.com/web/ecx/security-advisory

Cisco:

Medium Severity: CVE-2025-20204and CVE-2025-20205 Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-42tgsdMG @TalosSecurity

And if you missed this yesterday, CISA added two Fortinet vulnerabilities to the catalogue:

CISA:

CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-39808

CVE-2026-25089: Fortinet FortiSandbox OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-25089

And a Microsoft vulnerability:

CISA: CVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-58644 #Microsoft #CISA #Fortinet #infosec #vulnerability #Cisco #Broadcom

CISA KEV catalog adds three actively exploited flaws: FortiSandbox CVE-2026-25089, CVE-2026-39808, and SharePoint CVE-2026-58644. Patch by July 19.

#CISA #KEV #Fortinet #FortiSandbox #SharePoint #CVE202658644 #ActivelyExploited #CyberSecurity

https://securityonline.info/cisa-kev-fortisandbox-sharepoint/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0716] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0716)

CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-25089 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-25089)
- Name: Fortinet FortiSandbox OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiSandbox
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-141 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-25089

⚠️ CVE-2026-39808 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-39808)
- Name: Fortinet FortiSandbox OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiSandbox
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808

⚠️ CVE-2026-58644 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58644)
- Name: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: SharePoint
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-58644

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260716 #cisa20260716 #cve_2026_25089 #cve_2026_39808 #cve_2026_58644 #cve202625089 #cve202639808 #cve202658644

CVE ID: CVE-2026-25089
Vendor: Fortinet
Product: FortiSandbox
Date Added: 2026-07-16
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25089

📢 Zoom : vulnérabilité critique CVE-2026-53412 permettant la prise de contrôle de comptes
📝 ## 🔍 Contexte

Source : BleepingComputer — publié le 15 juillet 2026.
📖 cyberveille : https://cyberveille.ch/posts/2026-07-18-zoom-vulnerabilite-critique-cve-2026-53412-permettant-la-prise-de-controle-de-comptes/
🌐 source : https://www.bleepingcomputer.com/news/security/zoom-warns-of-critical-account-takeover-vulnerability/
#CVE_2026_53409 #CVE_2026_53410 #Cyberveille

A Zoom critical vulnerability (CVE-2026-53412, CVSS 9.8) lets attackers hijack accounts on Windows with no user interaction. Update your client now.

#Zoom #CVE202653412 #Vulnerability #CyberSecurity #Windows #AccountTakeover

https://securityexpress.info/cve-2026-53412-zoom/?utm_source=mastodon&utm_medium=jetpack_social

Zoom Patches Critical Windows Flaw Enabling Account Takeover

Zoom has released security updates to fix CVE-2026-53412, a critical Improper Input Validation vulnerability affecting its Windows software, which...

🔗️ [Thecyberexpress] https://link.is.it/17cS6R

"Zoom is warning of a critical vulnerability in its desktop client and software development kit for Windows that could be exploited by an unauthenticated party to hijack accounts.

Discovered internally, the security issue is tracked as CVE-2026-53412 and received a severity score of 9.8 out of 10.

In an advisory this week, the messaging platform says that the flaw affects Zoom Workplace for Windows before version 7.0.0, the Windows VDI Client before versions 7.0.10, 6.6.15, and 6.5.18, and the Meeting SDK for Windows before version 7.0.0."

https://www.bleepingcomputer.com/news/security/zoom-warns-of-critical-account-takeover-vulnerability/

Zoom Fixes CVE-2026-53412, a Critical Account Takeover Bug
https://securityaffairs.com/195454/security/zoom-fixes-cve-2026-53412-a-critical-account-takeover-bug.html

「Zoomがアカウント乗っ取りの重大な脆弱性について警告 」： #BLEEPINGCOMPUTER

「Zoomは、Windows向けデスクトップクライアントおよびソフトウェア開発キットに重大な脆弱性が存在すると警告している。この脆弱性を悪用すれば、認証されていない第三者がアカウントを乗っ取る可能性がある。

社内で発見されたこのセキュリティ問題は、CVE-2026-53412として追跡されており、深刻度スコアは10点満点中9.8点と評価されています。

今週発表された勧告によると、この脆弱性は、Windows版Zoom Workplaceのバージョン7.0.0未満、Windows VDI Clientのバージョン7.0.10未満、6.6.15未満、6.5.18未満、およびWindows版Meeting SDKのバージョン7.0.0未満に影響するとのことです。 」

https://www.bleepingcomputer.com/news/security/zoom-warns-of-critical-account-takeover-vulnerability/

#prattohome

Oh my

Zoom Workplace for Windows - Improper Input Validation

Bulletin: ZSB-26014
CVEID: CVE-2026-53412
CVSS Severity: Critical
CVSS Score: 9.8

Description:

Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.

https://www.zoom.com/en/trust/security-bulletin/zsb-26014/

#zoom #cybersecurity

Zoom vulnerability CVE-2026-53412 (CVSS 9.8) allows unauthenticated account takeover over the network. Update Zoom Workplace for Windows to 7.0.0 now.

#Zoom #CVE202653412 #AccountTakeover #Windows #CyberSecurity

https://securityonline.info/zoom-account-takeover-flaw/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-53409 - High (7.8)

Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of privilege via local access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53409/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-62378 - Critical (9)

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTM...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-52870 - High (7.6)

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52870/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62312 - High (8.8)

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62312/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-48352 - High (7.5)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service conditio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-48351 - High (7.5)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service conditio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48351/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Broadcom has new advisories addressing two high-severity vulnerabilities that were fist published on the 15th https://support.broadcom.com/web/ecx/security-advisory

Cisco:

Medium Severity: CVE-2025-20204and CVE-2025-20205 Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-42tgsdMG @TalosSecurity

And if you missed this yesterday, CISA added two Fortinet vulnerabilities to the catalogue:

CISA:

CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-39808

CVE-2026-25089: Fortinet FortiSandbox OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-25089

And a Microsoft vulnerability:

CISA: CVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-58644 #Microsoft #CISA #Fortinet #infosec #vulnerability #Cisco #Broadcom

CISA KEV catalog adds three actively exploited flaws: FortiSandbox CVE-2026-25089, CVE-2026-39808, and SharePoint CVE-2026-58644. Patch by July 19.

#CISA #KEV #Fortinet #FortiSandbox #SharePoint #CVE202658644 #ActivelyExploited #CyberSecurity

https://securityonline.info/cisa-kev-fortisandbox-sharepoint/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0716] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0716)

CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-25089 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-25089)
- Name: Fortinet FortiSandbox OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiSandbox
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-141 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-25089

⚠️ CVE-2026-39808 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-39808)
- Name: Fortinet FortiSandbox OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiSandbox
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808

⚠️ CVE-2026-58644 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58644)
- Name: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: SharePoint
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-58644

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260716 #cisa20260716 #cve_2026_25089 #cve_2026_39808 #cve_2026_58644 #cve202625089 #cve202639808 #cve202658644

CVE ID: CVE-2026-39808
Vendor: Fortinet
Product: FortiSandbox
Date Added: 2026-07-16
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39808

Latest 24-hour summary:

Geopolitical: US strikes Iran for a sixth night, escalating conflict and impacting the Strait of Hormuz.
Technology: IBM unveils a sub-1nm chip, Japan achieves 6G, and AI chip demand surges amidst a deepening tech selloff.
Cybersecurity: CISA warns of an actively exploited SharePoint RCE zero-day (CVE-2026-58644), urging immediate patching. New BL4CK SP1D3R ransomware threats are also detected.

#AnonNews_irc #Cybersecurity #News

Latest 24-hour summary:

Geopolitical: US strikes Iran for a sixth night, escalating conflict and impacting the Strait of Hormuz.
Technology: IBM unveils a sub-1nm chip, Japan achieves 6G, and AI chip demand surges amidst a deepening tech selloff.
Cybersecurity: CISA warns of an actively exploited SharePoint RCE zero-day (CVE-2026-58644), urging immediate patching. New BL4CK SP1D3R ransomware threats are also detected.

#AnonNews_irc #Cybersecurity #News

Broadcom has new advisories addressing two high-severity vulnerabilities that were fist published on the 15th https://support.broadcom.com/web/ecx/security-advisory

Cisco:

Medium Severity: CVE-2025-20204and CVE-2025-20205 Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-42tgsdMG @TalosSecurity

And if you missed this yesterday, CISA added two Fortinet vulnerabilities to the catalogue:

CISA:

CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-39808

CVE-2026-25089: Fortinet FortiSandbox OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-25089

And a Microsoft vulnerability:

CISA: CVE-2026-58644: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-58644 #Microsoft #CISA #Fortinet #infosec #vulnerability #Cisco #Broadcom

CVE-2026-58644: CRITICAL RCE in Microsoft SharePoint enables remote, authenticated Site Owners to execute code via deserialization. Exploited in the wild — patch now (July 2026 updates). Details: https://radar.offseq.com/threat/fresh-sharepoint-vulnerability-exploited-soon-afte-951942a1c69ed88b #OffSeq #SharePoint #Vuln #KEV #Infosec

CISA KEV catalog adds three actively exploited flaws: FortiSandbox CVE-2026-25089, CVE-2026-39808, and SharePoint CVE-2026-58644. Patch by July 19.

#CISA #KEV #Fortinet #FortiSandbox #SharePoint #CVE202658644 #ActivelyExploited #CyberSecurity

https://securityonline.info/cisa-kev-fortisandbox-sharepoint/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0716] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0716)

CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-25089 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-25089)
- Name: Fortinet FortiSandbox OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiSandbox
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-141 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-25089

⚠️ CVE-2026-39808 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-39808)
- Name: Fortinet FortiSandbox OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiSandbox
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808

⚠️ CVE-2026-58644 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58644)
- Name: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: SharePoint
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58644 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-58644

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260716 #cisa20260716 #cve_2026_25089 #cve_2026_39808 #cve_2026_58644 #cve202625089 #cve202639808 #cve202658644

CVE ID: CVE-2026-58644
Vendor: Microsoft
Product: SharePoint
Date Added: 2026-07-16
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-58644

CISA Issues Urgent Warning on SharePoint Server Exploitation

CISA warns of active exploitation of three SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) used by threat actors to deploy malware and steal IIS machine keys. The agency also reports two additional critical flaws (CVE-2026-55040 and CVE-2026-58644) that pose a high risk for remote code execution and authentication bypass.

**If you run on-premise SharePoint Server (2016, 2019, or Subscription Edition), apply the latest Microsoft security updates immediately. Three of these flaws are being actively exploited to deploy ransomware. Then check your servers for signs of breach before rotating your IIS machine keys, and block direct internet access to SharePoint (especially the Central Administration interface) by placing it behind a reverse proxy.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-issues-urgent-warning-on-sharepoint-server-exploitation-o-9-u-8-x/gD2P6Ple2L

CVE-2026-12525: Redux Framework <4.5.13 (WordPress) allows Subscribers to escalate to Admin by abusing the user-profile extension. Severity: CRITICAL. Disable the feature or restrict editing until a patch lands. https://radar.offseq.com/threat/cve-2026-12525-cwe-269-improper-privilege-manageme-e022e7bb11713010 #OffSeq #WordPress #CVE202612525 #PrivilegeEscalation

@jerry Microsoft may be doing some creative counting on vulnerabilities. To what end, I dunno.
Example: I looked at the 3 "Windows USB Audio Class Driver Information Disclosure" vulnerabilities.
CVE-2026-58528
CVE-2026-50453
CVE-2026-49794
All three are:
Information disclosure only
Max severity = important
Exploitation assessment = exploitation less likely
weakness = CWE-125: Out-of-bounds Read
require physical access
exploit code maturity = unproven
Acknowledgement to Jonghoi Kim at Patchpoint.io
Sure, they could be 3 totally unique ways to exploit USB audio all found by the same researcher in the same month... but that definitely feels like they're all three the same core issue and could have been a single CVE.

CRITICAL: CVE-2026-46339 impacts decolua 9Router (<0.4.37). OS command injection via exposed API lets unauth attackers gain full control. Patch to 0.4.37 now! https://radar.offseq.com/threat/cve-2026-46339-cwe-78-improper-neutralization-of-s-96ae550cea593bb1 #OffSeq #CVE202646339 #infosec #security

Ubuntu Pro Client vulnerability CVE-2026-11386 (CVSS 9.0) lets a spoofed contract server inject APT sources and run code with root privileges.

#Ubuntu #UbuntuPro #CVE202611386 #Canonical #RCE #Linux #CyberSecurity

http://securityonline.info/ubuntu-pro-client-cve-2026-11386/?utm_source=mastodon&utm_medium=jetpack_social

Ubuntu Pro Client vulnerability CVE-2026-11386 (CVSS 9.0) lets a spoofed contract server inject APT sources and run code with root privileges.

#Ubuntu #UbuntuPro #CVE202611386 #Canonical #RCE #Linux #CyberSecurity

http://securityonline.info/ubuntu-pro-client-cve-2026-11386/?utm_source=mastodon&utm_medium=jetpack_social

CRITICAL vuln in ubuntu-pro-client <37.2ubuntu~22.04.1: contract server manipulation can inject malicious APT config & install arbitrary packages as root. Preinstalled on Ubuntu Pro images. Patch status TBD. Details: https://radar.offseq.com/threat/ubuntu-cve-2026-11386-a076c116b384b281 #OffSeq #Ubuntu #LinuxSec #Vulnerability

🔴 CVE-2026-52887 - Critical (10)

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filter[latestM...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52887/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-22752: CRITICAL auth bypass in Spring Authorization Server (CVSS 9.6). Low-priv attackers can fully compromise confidentiality & integrity. No patch or workaround — monitor vendor updates. https://radar.offseq.com/threat/cve-2026-22752-vulnerability-in-spring-security-sp-73162920d784b7e4 #OffSeq #SpringSecurity #CVE202622752 #infosec

CVE-2026-15013 | CRITICAL vuln in cyberlord92 SAML SSO Login (≤5.4.3): Signature verification flaw enables authentication bypass & admin account takeover. Disable plugin until patched. https://radar.offseq.com/threat/cve-2026-15013-cwe-347-improper-verification-of-cr-9c8a5e33bdf9b83d #OffSeq #WordPress #CVE202615013 #SAML #Vuln

🟠 CVE-2026-56687 - High (7.8)

Dell ThinOS 10, versions prior to 2605_10.2100, contain an Obsolete Feature in UI vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56687/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-50130 - High (8.8)

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50130/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL ALERT: CVE-2026-46817 allows unauthenticated takeover of Oracle E-Business Suite. With active exploitation verified, your perimeter is at risk. Get the forensic indicators, detection queries, and hardening playbooks you need to secure your infrastructure. https://thecybermind.co/k8ae

#CyberSecurity #Oracle #TCM

Oracle E-Business Suite flaw (CVE-2026-46817, CRITICAL) enables unauthenticated takeover of Oracle Payments via HTTP. Exploited in the wild — patches available since May 2026. CISA requires federal patching by 7/18/26. Details: https://radar.offseq.com/threat/cisa-orders-feds-to-patch-actively-exploited-oracl-9835f0a6d8af730f #OffSeq #Oracle #Infosec #CVE202646817

CISA KEV catalog now lists CVE-2026-46817, a critical Oracle E-Business Suite flaw, and CVE-2023-4346 in KNX devices. Both are exploited in the wild.

#CISA #KEV #CVE202646817 #Oracle #KNX

https://securityonline.info/cisa-kev-cve-2026-46817-cve-2023-4346/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0715] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0715)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2023-4346 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-4346)
- Name: KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: KNX Association
- Product: KNX Protocol Connection Authorization Option 1
- Notes: https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-4346

⚠️ CVE-2026-46817 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-46817)
- Name: Oracle E-Business Suite Improper Privilege Management Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Oracle
- Product: E-Business Suite
- Notes: https://www.oracle.com/security-alerts/cspumay2026.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-46817

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260715 #cisa20260715 #cve_2023_4346 #cve_2026_46817 #cve20234346 #cve202646817

CISA has updated the KEV catalogue:

- CVE-2023-4346: KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-4346

- CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-46817

Press release:

CISA and Partners Publish Guidance to Help Software Manufacturers and Online Service Providers Work With Security Researchers https://www.cisa.gov/news-events/news/cisa-and-partners-publish-guidance-help-software-manufacturers-and-online-service-providers-work

Here's the guidance: https://www.cisa.gov/sites/default/files/2026-07/joint-guide-establishing-a-cvd-program-to-work-with-security-researchers_508c.pdf #CISA #infosec #vulnerability

CVE ID: CVE-2026-46817
Vendor: Oracle
Product: E-Business Suite
Date Added: 2026-07-15
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46817

Splunk patched three Splunk Enterprise vulnerabilities: CVE-2026-20296 CSRF, CVE-2026-20297 path traversal, and CVE-2026-20298 credential exposure.

#Splunk #CVE202620296 #CSRF #Vulnerability #InfoSec

https://securityonline.info/splunk-enterprise-vulnerabilities-cve-2026-20296/?utm_source=mastodon&utm_medium=jetpack_social

⚠️ CRITICAL: Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

Two zero-day vulnerabilities in SonicWall SMA 1000 appliances are actively exploited in the wild. CVE-2026-15409 is an SSRF flaw, while CVE-2026-15410 allows unauthenticated attackers to execute arbitrary commands as admin. Organizations using these devices face immediate risk of full appliance com…

https://threatnoir.com/focus

#infosec #cybersecurity

‼️ CVE-2026-15409: PoC exploit for CVE-2026-15409 that achieves non-root remote code execution on SonicWall SMA 1000 appliances.

GitHub: https://github.com/remmons-r7/rapid7-CVE-2026-15409

SonicWall SMA1000 vulnerability CVE-2026-15409 (CVSS 10.0) is exploited in the wild. Public PoC enables remote code execution patch now.

#SonicWall #SMA1000 #CVE202615409 #RCE #ZeroDay #CyberSecurity

https://securityonline.info/sonicwall-sma1000-vulnerability-cve-2026-15409/?utm_source=mastodon&utm_medium=jetpack_social

SonicWall has addressed a critical vulnerability. This was posted yesterday:

CVE-2026-15409 and CVE-2026-15410 https://psirt.global.sonicwall.com/vuln-list #infosec #SonicWall #vulnerability

⚠️Alerte CERT-FR⚠️

Les vulnérabilités CVE-2026-15409 et CVE-2026-15410 affectent les SMA 1000 et permettent une SSRF ainsi que d'exécuter du code arbitraire à distance.
Elles sont activement exploitées.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-006/

⚠️ 📢 Sicherheitshinweis: Am 14. Juli 2026 veröffentlichte das Unternehmen #SonicWall ein Advisory zu seiner SMA1000-Produktserie und führte darin aus, dass die Modelle 6210, 7210 und 8200v durch zwei neu entdeckte Zero-Day #Schwachstellen (CVE-2026-15409, CVE-2026-1541) verwundbar sind.

❗️ Das Unternehmen verweist im Advisory darauf, dass "zahlreiche Fälle" vorliegen, die auf eine Ausnutzung der Schwachstellen schließen lassen.

Mehr dazu hier: ➡️ https://www.bsi.bund.de/dok/1203248

@certbund

CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation

Security researchers have identified two critical vulnerabilities, CVE-2026-15409 and CVE-2026-15410, affecting SonicWall SMA1000 Series...

🔗️ [Thecyberexpress] https://link.is.it/dwrlPe

🚨 Two actively exploited zero-days affecting SonicWall SMA1000 appliances: CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2)

I’ve created vulnerability detection templates here (with confidence levels):
CVE-2026-15409: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-15409.yaml
CVE-2026-15410: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-15410.yaml

CVE-2026-15409 is remotely exploitable without authentication, while CVE-2026-15410 requires an authenticated administrator.

🏆 New Achievement! Step Right Up and Get Exploited!

Ladies and gentlemen, gather round and feast your eyes on the most ASTONISHING spectacle of unpatched network appliances this side of the midway! SonicWall — yes, THAT SonicWall — is hollering from the rooftops that threat actors are actively exploiting not one but TWO zero-day vulnerabilities in SMA1000 appliances, CVE-2026-15409 and CVE-2026-15410, in the wild, right now, as you read this! (1/2)

SonicWall SMA1000 SSRF flaw CVE-2026-15409 (CVSS 10.0) is exploited in the wild. Upgrade to hotfix 12.4.3-03453 or 12.5.0-02835 now.

#SonicWall #SMA1000 #SSRF #CVE202615409 #CyberSecurity

https://securityonline.info/sonicwall-sma1000-ssrf/?utm_source=mastodon&utm_medium=jetpack_social

SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now

SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day...

🔗️ [Bleepingcomputer] https://link.is.it/KLZmPI

CVE ID: CVE-2026-15409
Vendor: SonicWall
Product: SMA1000 Appliances
Date Added: 2026-07-14
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-15409

ASUS routers face CRITICAL risk (CVE-2026-13385, CVSS 9.5) due to improper integrity and certificate checks. MITM attackers can execute arbitrary commands. No patch yet — monitor ASUS advisories. https://radar.offseq.com/threat/cve-2026-13385-cwe-354-improper-validation-of-inte-022c4477d04d4a24 #OffSeq #ASUS #infosec #CVE #vuln

Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days

Tag
CVE ID
CVE Title
Severity
.NET
CVE-2026-50649
.NET Remote Code Execution Vulnerability
Important
.NET
CVE-2026-50525
.NET Denial…
#NewsBeep #News #US #USA #UnitedStates #UnitedStatesOfAmerica #Technology
https://www.newsbeep.com/us/763025/

🟠 CVE-2026-50274 - High (7.5)

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-50274 - High (7.5)

Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling, and security monitoring. Prior to 2.8.1, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-50272 - High (7.5)

dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50272/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-50272 - High (7.5)

dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/text_map.js parsed incoming baggage HTTP headers without enforcing DD_T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50272/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-50271 - High (7.5)

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50271/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-50271 - High (7.5)

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50271/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-15895: OS command injection in jsii-diff in AWS jsii

Bulletin ID: 2026-057-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 07/15/2026 12:00 PM PDT
Description:
jsii-diff is a command line tool to compare the API differences between two jsii assemblies...

https://aws.amazon.com/security/security-bulletins/rss/2026-057-aws/

#aws #security

🟠 CVE-2026-53517 - High (8.1)

Better Auth is an authentication and authorization library for TypeScript. From 1.4.8-beta.7 until 1.6.11, the @better-auth/oauth-provider POST /oauth2/token endpoint on the refresh_token grant performs a non-atomic read, validate, revoke, and min...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53517/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61835 - High (7.7)

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0 because api/src/request/is-denied-ip.ts trea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61835/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-50148 - Critical (10)

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a database connection can achieve remo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50148/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62351 - High (7.5)

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, source/libs/transport/src/transComm.c transDecompressMsg() read STransCompMsg.contLen when pHead->comp == 1 without first validating that the RPC packe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62351/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

JetBrains vulnerabilities patched: CVE-2026-62422 (CVSS 10) YouTrack authentication bypass, IntelliJ IDEA RCE CVE-2026-59792, and four TeamCity flaws.

#JetBrains #YouTrack #IntelliJIDEA #TeamCity #CVE

http://securityonline.info/jetbrains-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-46485 - High (8.2)

Dashy is a self-hostable personal dashboard. Prior to 4.0.8, Dashy deployments using OIDC can allow unauthenticated users or non-admin authenticated users to write changes to the main config.yaml through the config-saving functionality despite con...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46485/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

F5 patched the NGINX code execution flaw CVE-2026-42533, along with CVE-2026-60005 and CVE-2026-56434. Update NGINX Plus and Open Source builds now.

#NGINX #CVE202642533 #CodeExecution #F5 #Vulnerability

https://securityonline.info/nginx-code-execution-cve-2026-42533/?utm_source=mastodon&utm_medium=jetpack_social

Broadcom has a long list of advisories addressing several critical vulnerabilities, among others not quite as privileged https://socket.dev/blog/11-malicious-nuget-tools-pose-as-game-cheats

Don't forget Cisco:

Cisco: High severity: CVE-2026-20150 and CVE-2026-20153: Cisco RoomOS Security Hardening Release: July 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq

Midium Severity: CVE-2026-20146: Cisco Identity Services Engine Path Traversal Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-traversal-xNt7wb2Y @TalosSecurity #Cisco #infosec #vulnerability #Broadcom

🚨 ALERT: CVE-2023-4346 allows attackers to purge and lock KNX industrial control devices. If you manage building automation, your perimeter is at risk. Get the forensic indicators and hardening playbooks you need to secure your assets. https://thecybermind.co/m6eo

#CyberSecurity #ICS #KNX #TCM #IndustrialSecurity

CISA KEV catalog now lists CVE-2026-46817, a critical Oracle E-Business Suite flaw, and CVE-2023-4346 in KNX devices. Both are exploited in the wild.

#CISA #KEV #CVE202646817 #Oracle #KNX

https://securityonline.info/cisa-kev-cve-2026-46817-cve-2023-4346/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0715] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0715)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2023-4346 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-4346)
- Name: KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: KNX Association
- Product: KNX Protocol Connection Authorization Option 1
- Notes: https://www.cisa.gov/news-events/ics-advisories/icsa-23-236-01 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-4346

⚠️ CVE-2026-46817 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-46817)
- Name: Oracle E-Business Suite Improper Privilege Management Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Oracle
- Product: E-Business Suite
- Notes: https://www.oracle.com/security-alerts/cspumay2026.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-46817

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260715 #cisa20260715 #cve_2023_4346 #cve_2026_46817 #cve20234346 #cve202646817

CISA has updated the KEV catalogue:

- CVE-2023-4346: KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-4346

- CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-46817

Press release:

CISA and Partners Publish Guidance to Help Software Manufacturers and Online Service Providers Work With Security Researchers https://www.cisa.gov/news-events/news/cisa-and-partners-publish-guidance-help-software-manufacturers-and-online-service-providers-work

Here's the guidance: https://www.cisa.gov/sites/default/files/2026-07/joint-guide-establishing-a-cvd-program-to-work-with-security-researchers_508c.pdf #CISA #infosec #vulnerability

CVE ID: CVE-2023-4346
Vendor: KNX Association
Product: KNX Protocol Connection Authorization Option 1
Date Added: 2026-07-15
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-4346

Splunk patched three Splunk Enterprise vulnerabilities: CVE-2026-20296 CSRF, CVE-2026-20297 path traversal, and CVE-2026-20298 credential exposure.

#Splunk #CVE202620296 #CSRF #Vulnerability #InfoSec

https://securityonline.info/splunk-enterprise-vulnerabilities-cve-2026-20296/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-58658 - High (8.2)

GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58658/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62389 - High (7.5)

ws before 8.21.1 contains a memory exhaustion vulnerability in lib/receiver.js where the fragment guard only triggers when fragment count reaches maxFragments, allowing attackers to exhaust memory by sending incomplete fragmented WebSocket message...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62389/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59258 - High (8.3)

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59258/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Splunk patched three Splunk Enterprise vulnerabilities: CVE-2026-20296 CSRF, CVE-2026-20297 path traversal, and CVE-2026-20298 credential exposure.

#Splunk #CVE202620296 #CSRF #Vulnerability #InfoSec

https://securityonline.info/splunk-enterprise-vulnerabilities-cve-2026-20296/?utm_source=mastodon&utm_medium=jetpack_social

F5 patched the NGINX code execution flaw CVE-2026-42533, along with CVE-2026-60005 and CVE-2026-56434. Update NGINX Plus and Open Source builds now.

#NGINX #CVE202642533 #CodeExecution #F5 #Vulnerability

https://securityonline.info/nginx-code-execution-cve-2026-42533/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-60005 - High (8.2)

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-60005/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Broadcom has a long list of advisories addressing several critical vulnerabilities, among others not quite as privileged https://socket.dev/blog/11-malicious-nuget-tools-pose-as-game-cheats

Don't forget Cisco:

Cisco: High severity: CVE-2026-20150 and CVE-2026-20153: Cisco RoomOS Security Hardening Release: July 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq

Midium Severity: CVE-2026-20146: Cisco Identity Services Engine Path Traversal Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-traversal-xNt7wb2Y @TalosSecurity #Cisco #infosec #vulnerability #Broadcom

Broadcom has a long list of advisories addressing several critical vulnerabilities, among others not quite as privileged https://socket.dev/blog/11-malicious-nuget-tools-pose-as-game-cheats

Don't forget Cisco:

Cisco: High severity: CVE-2026-20150 and CVE-2026-20153: Cisco RoomOS Security Hardening Release: July 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-roomos-AqNMbEq

Midium Severity: CVE-2026-20146: Cisco Identity Services Engine Path Traversal Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-traversal-xNt7wb2Y @TalosSecurity #Cisco #infosec #vulnerability #Broadcom

🟠 CVE-2026-62685 - High (8.1)

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62685/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Adobe ColdFusion 2025 is affected by a CRITICAL path traversal vuln (CVE-2026-48318, CVSS 9.9). Attackers can read arbitrary files — no user interaction. Restrict ColdFusion access & monitor logs until a patch is released. Details: https://radar.offseq.com/threat/cve-2026-48318-improper-limitation-of-a-pathname-t-89bd432b493aca98 #OffSeq #CVE202648318 #ColdFusion #Infosec

Google's Chrome security update 150.0.7871.124 fixes 15 flaws, including critical use-after-free bugs CVE-2026-15764 and CVE-2026-15765. Update now.

#Chrome #GoogleChrome #CVE #BrowserSecurity #CyberSecurity

http://securityonline.info/chrome-150-security-update/?utm_source=mastodon&utm_medium=jetpack_social

ASUS bsitf.sys (CVE-2026-13585): Arbitrary Physical Memory Mapping via Unvalidated IOCTL https://blog.ahmadz.ai/asus_bsitf_0_day_poc/

F5 patched the NGINX code execution flaw CVE-2026-42533, along with CVE-2026-60005 and CVE-2026-56434. Update NGINX Plus and Open Source builds now.

#NGINX #CVE202642533 #CodeExecution #F5 #Vulnerability

https://securityonline.info/nginx-code-execution-cve-2026-42533/?utm_source=mastodon&utm_medium=jetpack_social

That's a lot of Fixes introduced in: NONE.

https://my.f5.com/manage/s/article/K000162097

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. (CVE-2026-42533)

https://my.f5.com/manage/s/article/K000162097

Active exploitation of CVE-2026-56155 in Microsoft ADFS puts your identity perimeter at risk. Our latest TSUITE brief delivers the forensic indicators, detection queries, and compensating controls needed to neutralize this privilege escalation threat. Secure your architecture today. https://thecybermind.co/al3f

Regarding CVE-2026-56155, the in-the-wild ADFS vulnerability - the July patch just released does not fix the vulnerability.

Instead it adds an audit log. The changes to harden the service and enforce protection will only apply with October 2026’s update applied.

https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/07/kb5121391-cve-2026-56155-ad-fs-dkm-container-acl-hardening

Microsoft's July 2026 Patch Tuesday fixes 570 flaws. Zero-days CVE-2026-56155 and CVE-2026-56164 are exploited in the wild. Patch now.

#PatchTuesday #Microsoft #ZeroDay #CVE #CyberSecurity

https://securityonline.info/july-2026-patch-tuesday/?utm_source=mastodon&utm_medium=jetpack_social

CVE ID: CVE-2026-56155
Vendor: Microsoft
Product: Active Directory Federation Services
Date Added: 2026-07-14
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56155

🚨 [CISA-2026:0714] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0714)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-56155 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56155)
- Name: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Active Directory Federation Services
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56155

⚠️ CVE-2026-56164 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56164)
- Name: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: SharePoint Server
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56164

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260714 #cisa20260714 #cve_2026_56155 #cve_2026_56164 #cve202656155 #cve202656164

#CVE-2026-48309 - #Adobe #Audition Out Of Bounds Write #Vulnerability

#cybersecurity #technology #news #it #cybersec

https://3corns.com/articles/CVE-2026-48309-adobe.html

TP-Link Kasa vulnerability CVE-2026-9770 (CVSS 8.6) lets local attackers intercept admin credentials on EC70 and EC71 cameras. Update firmware now.

#TPLink #Kasa #IoTSecurity #CVE20269770 #InfoDisclosure

https://securityonline.info/tp-link-kasa-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

CRITICAL: CVE-2026-48334 impacts Adobe Illustrator Desktop 2026 (CVSS 9.3). Improper input validation lets attackers run code if a user opens a malicious file. No patch — open only trusted files. https://radar.offseq.com/threat/cve-2026-48334-improper-input-validation-cwe-20-in-92b003786ac4de7b #OffSeq #Adobe #Vuln #CVE202648334

CVE-2026-48336 - High severity out-of-bounds write in Illustrator. Could lead to arbitrary code execution. CVSS 7.8. Update immediately. #CVE #Adobe #infosec

https://www.valtersit.com/cve/CVE-2026-48336/

🟠 CVE-2026-48337 - High (7.8)

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48337/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New from RelayShield: four #AIsecurity checks for agents built with smolagents, published as an MCP server on @huggingface.

- MCP server reputation check before your agent connects
- Prompt-injection pattern detection on ingested content
- Tech-stack CVE monitoring (covers agent frameworks themselves — Langflow's CVE-2025-3248 was the initial-access vector in the first documented autonomous-agent ransomware op)
- Bulk identity-risk scoring

Self-serve, pay-per-call, no subscription.

https://huggingface.co/blog/relayshieldadmin/smolagents-agent-security-tools

#InfoSec #MCP #AgentSecurity #ThreatIntel

New from RelayShield: four #AIsecurity checks for agents built with smolagents, published as an MCP server on @huggingface.

- MCP server reputation check before your agent connects
- Prompt-injection pattern detection on ingested content
- Tech-stack CVE monitoring (covers agent frameworks themselves — Langflow's CVE-2025-3248 was the initial-access vector in the first documented autonomous-agent ransomware op)
- Bulk identity-risk scoring

Self-serve, pay-per-call, no subscription.

https://huggingface.co/blog/relayshieldadmin/smolagents-agent-security-tools

#InfoSec #MCP #AgentSecurity #ThreatIntel

Symantec, posted yesterday: Spirals: New Stealthy Ransomware Deployed Against Asian IT Company https://www.security.com/threat-intelligence/ransomware-spirals-extortion

Also from yesterday:

Tenable: CVE-2026-32201, CVE-2026-45659, CVE-2026-56164: Frequently Asked Questions About Active Exploitation of Microsoft SharePoint Server Vulnerabilities https://www.tenable.com/blog/cve-2026-32201-cve-2026-45659-cve-2026-56164-faq-sharepoint-server-exploitation #threatresearch #Microsoft #ransomware #infosec #SharePoint

These security flaws (tracked as CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) affect all supported self-hosted SharePoint Server versions. https://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-patch-actively-exploited-sharepoint-flaws/

CISA Issues Urgent Warning on SharePoint Server Exploitation

CISA warns of active exploitation of three SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) used by threat actors to deploy malware and steal IIS machine keys. The agency also reports two additional critical flaws (CVE-2026-55040 and CVE-2026-58644) that pose a high risk for remote code execution and authentication bypass.

**If you run on-premise SharePoint Server (2016, 2019, or Subscription Edition), apply the latest Microsoft security updates immediately. Three of these flaws are being actively exploited to deploy ransomware. Then check your servers for signs of breach before rotating your IIS machine keys, and block direct internet access to SharePoint (especially the Central Administration interface) by placing it behind a reverse proxy.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-issues-urgent-warning-on-sharepoint-server-exploitation-o-9-u-8-x/gD2P6Ple2L

CISA warns SharePoint vulnerabilities CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 are exploited in the wild. Patch and harden servers now.

#CISA #SharePoint #Microsoft #CVE #CyberSecurity

https://securityonline.info/cisa-sharepoint-hardening/?utm_source=mastodon&utm_medium=jetpack_social

Microsoft's July 2026 Patch Tuesday fixes 570 flaws. Zero-days CVE-2026-56155 and CVE-2026-56164 are exploited in the wild. Patch now.

#PatchTuesday #Microsoft #ZeroDay #CVE #CyberSecurity

https://securityonline.info/july-2026-patch-tuesday/?utm_source=mastodon&utm_medium=jetpack_social

CVE ID: CVE-2026-56164
Vendor: Microsoft
Product: SharePoint Server
Date Added: 2026-07-14
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56164

🚨 [CISA-2026:0714] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0714)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-56155 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56155)
- Name: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Active Directory Federation Services
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56155 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56155

⚠️ CVE-2026-56164 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56164)
- Name: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: SharePoint Server
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-56164 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56164

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260714 #cisa20260714 #cve_2026_56155 #cve_2026_56164 #cve202656155 #cve202656164

CVE-2026-48324 (CRITICAL, CVSS 9.1): Adobe ColdFusion 2025 suffers from an SQL Injection (CWE-89) allowing arbitrary code execution. No patch confirmed — restrict access & monitor SQL activity. https://radar.offseq.com/threat/cve-2026-48324-improper-neutralization-of-special--e4f7ad5cedb0440f #OffSeq #ColdFusion #SQLInjection #Vuln

Adobe ColdFusion 2025 hit by CRITICAL CVE-2026-48327: Incorrect Authorization (CVSS 9.0) enables arbitrary code execution — no user interaction needed. Restrict network access & limit privileges until patch released. https://radar.offseq.com/threat/cve-2026-48327-incorrect-authorization-cwe-863-in--27904a5083d83266 #OffSeq #ColdFusion #CVE202648327 #Infosec

Google's Chrome security update 150.0.7871.124 fixes 15 flaws, including critical use-after-free bugs CVE-2026-15764 and CVE-2026-15765. Update now.

#Chrome #GoogleChrome #CVE #BrowserSecurity #CyberSecurity

http://securityonline.info/chrome-150-security-update/?utm_source=mastodon&utm_medium=jetpack_social

⚠️ CRITICAL: Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

Two zero-day vulnerabilities in SonicWall SMA 1000 appliances are actively exploited in the wild. CVE-2026-15409 is an SSRF flaw, while CVE-2026-15410 allows unauthenticated attackers to execute arbitrary commands as admin. Organizations using these devices face immediate risk of full appliance com…

https://threatnoir.com/focus

#infosec #cybersecurity

SonicWall has addressed a critical vulnerability. This was posted yesterday:

CVE-2026-15409 and CVE-2026-15410 https://psirt.global.sonicwall.com/vuln-list #infosec #SonicWall #vulnerability

⚠️Alerte CERT-FR⚠️

Les vulnérabilités CVE-2026-15409 et CVE-2026-15410 affectent les SMA 1000 et permettent une SSRF ainsi que d'exécuter du code arbitraire à distance.
Elles sont activement exploitées.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-006/

CISA Adds SonicWall SMA1000 Vulnerabilities to KEV Catalog Following Active Exploitation

Security researchers have identified two critical vulnerabilities, CVE-2026-15409 and CVE-2026-15410, affecting SonicWall SMA1000 Series...

🔗️ [Thecyberexpress] https://link.is.it/dwrlPe

🚨 Two actively exploited zero-days affecting SonicWall SMA1000 appliances: CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2)

I’ve created vulnerability detection templates here (with confidence levels):
CVE-2026-15409: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-15409.yaml
CVE-2026-15410: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-15410.yaml

CVE-2026-15409 is remotely exploitable without authentication, while CVE-2026-15410 requires an authenticated administrator.

🏆 New Achievement! Step Right Up and Get Exploited!

Ladies and gentlemen, gather round and feast your eyes on the most ASTONISHING spectacle of unpatched network appliances this side of the midway! SonicWall — yes, THAT SonicWall — is hollering from the rooftops that threat actors are actively exploiting not one but TWO zero-day vulnerabilities in SMA1000 appliances, CVE-2026-15409 and CVE-2026-15410, in the wild, right now, as you read this! (1/2)

SonicWall warns of SMA1000 flaws exploited in zero-day attacks, patch now

SonicWall warns that threat actors have been exploiting two SMA1000 vulnerabilities, tracked as CVE-2026-15409 and CVE-2026-15410, in zero-day...

🔗️ [Bleepingcomputer] https://link.is.it/KLZmPI

CVE ID: CVE-2026-15410
Vendor: SonicWall
Product: SMA1000 Appliances
Date Added: 2026-07-14
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-15410

@brettagoge Ich hoffe du hast brav ein Backup.

Hier war ein Stelle von letzter Woche:

https://podlove.org/blog/security-release-cve-2026-13001

‘Podlove Publisher 4.5.2 fixes CVE-2026-13001, a critical vulnerability in the image cache that could allow unauthenticated remote code execution on affected installations.’

https://podlove.org/blog/security-release-cve-2026-13001

@jerry Microsoft may be doing some creative counting on vulnerabilities. To what end, I dunno.
Example: I looked at the 3 "Windows USB Audio Class Driver Information Disclosure" vulnerabilities.
CVE-2026-58528
CVE-2026-50453
CVE-2026-49794
All three are:
Information disclosure only
Max severity = important
Exploitation assessment = exploitation less likely
weakness = CWE-125: Out-of-bounds Read
require physical access
exploit code maturity = unproven
Acknowledgement to Jonghoi Kim at Patchpoint.io
Sure, they could be 3 totally unique ways to exploit USB audio all found by the same researcher in the same month... but that definitely feels like they're all three the same core issue and could have been a single CVE.

@jerry Microsoft may be doing some creative counting on vulnerabilities. To what end, I dunno.
Example: I looked at the 3 "Windows USB Audio Class Driver Information Disclosure" vulnerabilities.
CVE-2026-58528
CVE-2026-50453
CVE-2026-49794
All three are:
Information disclosure only
Max severity = important
Exploitation assessment = exploitation less likely
weakness = CWE-125: Out-of-bounds Read
require physical access
exploit code maturity = unproven
Acknowledgement to Jonghoi Kim at Patchpoint.io
Sure, they could be 3 totally unique ways to exploit USB audio all found by the same researcher in the same month... but that definitely feels like they're all three the same core issue and could have been a single CVE.

CVE-2026-54052: CRITICAL auth bypass in czlonkowski n8n-mcp <2.56.1. Multi-tenant HTTP mode allows tenants to access/delete others’ sensitive workflow backups. Patch to 2.56.1 ASAP. https://radar.offseq.com/threat/cve-2026-54052-cwe-639-authorization-bypass-throug-04ca76ef25ff4df2 #OffSeq #CVE #infosec #vuln

🔴 CVE-2026-54052 - Critical (9.9)

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's local workflow version history ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54052/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CISA Issues Urgent Warning on SharePoint Server Exploitation

CISA warns of active exploitation of three SharePoint Server vulnerabilities (CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164) used by threat actors to deploy malware and steal IIS machine keys. The agency also reports two additional critical flaws (CVE-2026-55040 and CVE-2026-58644) that pose a high risk for remote code execution and authentication bypass.

**If you run on-premise SharePoint Server (2016, 2019, or Subscription Edition), apply the latest Microsoft security updates immediately. Three of these flaws are being actively exploited to deploy ransomware. Then check your servers for signs of breach before rotating your IIS machine keys, and block direct internet access to SharePoint (especially the Central Administration interface) by placing it behind a reverse proxy.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-issues-urgent-warning-on-sharepoint-server-exploitation-o-9-u-8-x/gD2P6Ple2L

Windows AppResolver LPE: From AppContainer to SYSTEM. PoC linked to CVE-2026-50454 https://davidcarliez.github.io/blog/windows-appresolver-lpe-to-system/

‼️ CVE-2026-58635: Windows Narrator Braille Local Privilege Escalation

PoC: https://github.com/DavidCarliez/CVE-2026-58635-PoC

Age of Empires II : une faille permettait de prendre le contrôle d’un PC via une partie multijoueur https://www.it-connect.fr/age-of-empires-ii-faille-rce-cve-2026-50663/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft

Microsoft fixed an Age of Empires RCE from yesterday’s Patch Tuesday (CVE-2026-50663). Here is an example of how it was done.

Credit: https://x.com/rdjgr/status/2077331427549421918

I was scanning through the @sans_isc #PatchTuesday post (https://isc.sans.edu/diary/33154?n with another record breaking number of fixes!) and had to double take when I saw "Age of Empires II" ... I was playing that 25 years ago.

Here's the CVE:
https://nvd.nist.gov/vuln/detail/CVE-2026-50663

#Microsoft #AgeOfEmpiresII

Rockwell Automation vulnerability CVE-2026-10577 (CVSS 10) exposes an unauthenticated debug port in 1715 Redundant I/O modules. Update to firmware 3.011.

#RockwellAutomation #ICS #OTSecurity #CVE #CyberSecurity

https://securityonline.info/rockwell-1715-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

Citrix patched CVE-2026-53565, a Citrix Secure Access vulnerability letting local users gain SYSTEM, plus the CVE-2026-53566 out-of-bounds read bug.

#Citrix #CVE202653565 #PrivilegeEscalation #Vulnerability #Windows

https://securityonline.info/citrix-secure-access-cve-2026-53565/?utm_source=mastodon&utm_medium=jetpack_social