⚠️ CRITICAL: CVE-2026-33728 in DataDog dd-trace-java (0.40.0 - <1.60.3) allows unauth RCE via unsafe deserialization if JMX/RMI port is exposed on JDK ≤16. Upgrade to 1.60.3+ & restrict access! https://radar.offseq.com/threat/cve-2026-33728-cwe-502-deserialization-of-untruste-d41c376a #OffSeq #Java #Infosec #CVE202633728

⚠️ CRITICAL: CVE-2026-33728 in DataDog dd-trace-java (0.40.0 - <1.60.3) allows unauth RCE via unsafe deserialization if JMX/RMI port is exposed on JDK ≤16. Upgrade to 1.60.3+ & restrict access! https://radar.offseq.com/threat/cve-2026-33728-cwe-502-deserialization-of-untruste-d41c376a #OffSeq #Java #Infosec #CVE202633728

🚨 CRITICAL: CVE-2026-33701 affects opentelemetry-java-instrumentation <2.26.1. Unauthenticated RCE possible on Java ≤16 via unsafe RMI deserialization. Upgrade to 2.26.1+ or disable RMI now! Details: https://radar.offseq.com/threat/cve-2026-33701-cwe-502-deserialization-of-untruste-08578920 #OffSeq #Java #RCE #Vuln

🚨 CRITICAL: CVE-2026-33701 affects opentelemetry-java-instrumentation <2.26.1. Unauthenticated RCE possible on Java ≤16 via unsafe RMI deserialization. Upgrade to 2.26.1+ or disable RMI now! Details: https://radar.offseq.com/threat/cve-2026-33701-cwe-502-deserialization-of-untruste-08578920 #OffSeq #Java #RCE #Vuln

🟠 CVE-2026-34352 - High (8.5)

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34352 - High (8.5)

In TigerVNC before 1.16.2, Image.cxx in x0vncserver allows other users to observe or manipulate the screen contents, or cause an application crash, because of incorrect permissions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4903 - High (8.8)

A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. This manipulation of the argument PPPOEPassword causes stack-based buffer ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4903/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4903 - High (8.8)

A flaw has been found in Tenda AC5 15.03.06.47. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. This manipulation of the argument PPPOEPassword causes stack-based buffer ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4903/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4902 - High (8.8)

A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addressNat of the component POST Request Handler. The manipulation of the argument page results in stack-based buffer overflow. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4902/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4902 - High (8.8)

A vulnerability was detected in Tenda AC5 15.03.06.47. This affects the function fromAddressNat of the file /goform/addressNat of the component POST Request Handler. The manipulation of the argument page results in stack-based buffer overflow. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4902/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-12805 - High (8.1)

A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12805/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-12805 - High (8.1)

A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other namespaces via direct network requests, because no NetworkPolicy restricts access to the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12805/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28377 - High (7.5)

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.

Thanks to william_goodfellow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28377/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28377 - High (7.5)

A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.

Thanks to william_goodfellow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28377/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-33945 (CRITICAL, CVSS 10): lxc incus <6.23.0 is vulnerable to path traversal, enabling attackers to write as root & escalate privileges. Upgrade to 6.23.0+ ASAP, restrict config access! https://radar.offseq.com/threat/cve-2026-33945-cwe-22-improper-limitation-of-a-pat-4b327a65 #OffSeq #CVE202633945 #ContainerSecurity

🚨 CVE-2026-33945 (CRITICAL, CVSS 10): lxc incus <6.23.0 is vulnerable to path traversal, enabling attackers to write as root & escalate privileges. Upgrade to 6.23.0+ ASAP, restrict config access! https://radar.offseq.com/threat/cve-2026-33945-cwe-22-improper-limitation-of-a-pat-4b327a65 #OffSeq #CVE202633945 #ContainerSecurity

🟠 CVE-2026-1961 - High (8)

A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource provid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1961 - High (8)

A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource provid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3650 - High (7.5)

A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-standard VR types in file meta information. The vulnerability leads to vast memory allocations and resource depletion, triggeri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3650 - High (7.5)

A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-standard VR types in file meta information. The vulnerability leads to vast memory allocations and resource depletion, triggeri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-3650 in Grassroots DICOM (GDCM):

• Memory leak via malformed DICOM parsing
• CVSS 7.5 → DoS risk
• No patch, no maintainer response
• Impacts healthcare imaging pipelines
Mitigate via isolation + strict input controls.

Source: https://www.hipaajournal.com/grassroots-dicom-vulnerability-march-2026/

Follow @technadu for more.

#InfoSec #HealthcareSecurity #Vulnerability

🔴 CVE-2026-33669 - Critical (9.8)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33669/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33669 - Critical (9.8)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, document IDs were retrieved via the /api/file/readDir interface, and then the /api/block/getChildBlocks interface was used to view the content of all documents. Version 3.6....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33669/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-55262 - High (8.3)

HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-55262/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-55262 - High (8.3)

HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-55262/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

I updated the “Device Name” section of my “How to Fingerprint iOS Users” article to note that iOS 26.4 fixes CVE-2026-28877, which leaked the device name without needing a proper entitlement.

https://paradisefacade.com/blog/2026/3/9/how-to-fingerprint-users

🟠 CVE-2025-41368 - High (8.1)

Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permissions outsid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41368/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-41368 - High (8.1)

Problem in the Small HTTP Server v3.06.36 service. An authenticated path traversal vulnerability in '/' allows remote users to bypass the intended restrictions of SecurityManager and display any file if they have the appropriate permissions outsid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41368/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-41359 - High (7.8)

Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a maliciou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-41359 - High (7.8)

Vulnerability related to an unquoted service path in Small HTTP Server 3.06.36, specifically affecting the executable located at 'C:\Program Files (x86)\shttps_mg\http.exe service'. This misconfiguration allows a local attacker to place a maliciou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33509 - High (7.5)

pyLoad is a free and open-source download manager written in Python. From version 0.4.0 to before version 0.5.0b3.dev97, the set_config_value() API endpoint allows users with the non-admin SETTINGS permission to modify any configuration option wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32748 - High (7.5)

Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remot...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32748 - High (7.5)

Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remot...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33942 - Critical (9.8)

Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33942 - Critical (9.8)

Saloon is a PHP library that gives users tools to build API integrations and SDKs. Versions prior to 4.0.0 used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33413 - High (8.8)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, unauthorized users may bypass authentication or authorization checks and call certain etcd functions in clusters that expose t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33413/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33413 - High (8.8)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, unauthorized users may bypass authentication or authorization checks and call certain etcd functions in clusters that expose t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33413/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33631 - High (8.7)

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy exclusively by intercepting...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33631/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33631 - High (8.7)

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy exclusively by intercepting...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33631/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33491 - High (7.8)

Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.4, a stack-based buffer overflow vulnerability in the Zen C compiler allows attackers to cause a compiler crash or potentially execute arbitrar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33491/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33491 - High (7.8)

Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.4, a stack-based buffer overflow vulnerability in the Zen C compiler allows attackers to cause a compiler crash or potentially execute arbitrar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33491/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32522 - High (8.6)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-ticket-system allows Path Traversal.This issue affects WooCommerce Support Ticket System...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32522/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32522 - High (8.6)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-ticket-system allows Path Traversal.This issue affects WooCommerce Support Ticket System...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32522/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

We're released Netty 4.2.11 and 4.1.132. These contain many bug fixes, and fixes for two CVEs both rated *high*:

- CVE-2026-33871: HTTP/2 CONTINUATION frame flood Denial of Service.
- CVE-2026-33870: HTTP/1.1 Request Smuggling vulnerability in chunked encoding parsing.

Release notes for 4.2.11: https://netty.io/news/2026/03/24/4-2-11-Final.html
Release notes for 4.1.132: https://netty.io/news/2026/03/24/4-1-132-Final.html

Also of note: We had 17 people contribute to Netty 4.2.11, of which 5 are new first time contributors 😲

#netty #java

We're released Netty 4.2.11 and 4.1.132. These contain many bug fixes, and fixes for two CVEs both rated *high*:

- CVE-2026-33871: HTTP/2 CONTINUATION frame flood Denial of Service.
- CVE-2026-33870: HTTP/1.1 Request Smuggling vulnerability in chunked encoding parsing.

Release notes for 4.2.11: https://netty.io/news/2026/03/24/4-2-11-Final.html
Release notes for 4.1.132: https://netty.io/news/2026/03/24/4-1-132-Final.html

Also of note: We had 17 people contribute to Netty 4.2.11, of which 5 are new first time contributors 😲

#netty #java

🟠 CVE-2026-2995 - High (7.7)

GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2995/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2995 - High (7.7)

GitLab has remediated an issue in GitLab EE affecting all versions from 15.4 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to add email addresses to targeted user accounts due to improper...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2995/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33487 - High (7.5)

goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in `validate.go` goes through the references in the `SignedInfo` block to find one that matches the signed element's ID. In Go ver...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33487/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33487 - High (7.5)

goxmlsig provides XML Digital Signatures implemented in Go. Prior to version 1.6.0, the `validateSignature` function in `validate.go` goes through the references in the `SignedInfo` block to find one that matches the signed element's ID. In Go ver...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33487/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4867 - High (7.5)

Impact:

A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4867/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4867 - High (7.5)

Impact:

A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4867/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3108 - High (8)

Mattermost versions 11.2.x &lt;= 11.2.2, 10.11.x &lt;= 10.11.10, 11.4.x &lt;= 11.4.0, 11.3.x &lt;= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator termin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3108/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3108 - High (8)

Mattermost versions 11.2.x &lt;= 11.2.2, 10.11.x &lt;= 10.11.10, 11.4.x &lt;= 11.4.0, 11.3.x &lt;= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator termin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3108/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29785 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29785 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.14 and 2.12.5, if the nats-server has the "leafnode" configuration enabled (not default), then anyone who can connect can crash ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-15101 - High (8.8)

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Web management interface of certain ASUS router models. This vulnerability potentially allows actions to be performed with the existing privileges of an authenticated use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-15101 - High (8.8)

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Web management interface of certain ASUS router models. This vulnerability potentially allows actions to be performed with the existing privileges of an authenticated use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚩 CRITICAL: CVE-2026-33696 in n8n-io n8n (CVSS 9.4) - Prototype pollution enables remote code execution via XML/GSuiteAdmin nodes. Patch to 2.14.1, 2.13.3, or 1.123.27+. Restrict permissions & disable XML node as temp fix. https://radar.offseq.com/threat/cve-2026-33696-cwe-1321-improperly-controlled-modi-9ddf2aba #OffSeq #n8n #CVE2026_33696

🟠 CVE-2026-33932 - High (7.6)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a stored cross-site scripting vulnerability in the CCDA document preview allows an attacker who can upload or send a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33932/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29187 - High (8.1)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php)...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29187/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29187 - High (8.1)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php)...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29187/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34055 - High (8.1)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the legacy patient notes functions in `library/pnotes.inc.php` perform updates and deletes using `WHERE id = ?` with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34055/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22790 - High (8.8)

EVerest is an EV charging software stack. Prior to version 2026.02.0, `HomeplugMessage::setup_payload` trusts `len` after an `assert`; in release builds the check is removed, so oversized SLAC payloads are `memcpy`'d into a ~1497-byte stack buffer...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22790/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22790 - High (8.8)

EVerest is an EV charging software stack. Prior to version 2026.02.0, `HomeplugMessage::setup_payload` trusts `len` after an `assert`; in release builds the check is removed, so oversized SLAC payloads are `memcpy`'d into a ~1497-byte stack buffer...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22790/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24068 - High (8.8)

The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24068/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24068 - High (8.8)

The VSL privileged helper does utilize NSXPC for IPC. The implementation of the "shouldAcceptNewConnection" function, which is used by the NSXPC framework to validate if a client should be allowed to connect to the XPC listener, does not validate ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24068/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4247 - High (7.5)

When a challenge ACK is to be sent tcp_respond() constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge ACK should be sent the function returns and leaks the mbuf.

If an attacker is either on path with ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4247/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4247 - High (7.5)

When a challenge ACK is to be sent tcp_respond() constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge ACK should be sent the function returns and leaks the mbuf.

If an attacker is either on path with ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4247/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4652 - High (7.5)

On a system exposing an NVMe/TCP target, a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue with a bogus or stale CNTLID.

An attacker with network access to the NVMe/TCP target can trigger an unauthenticated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4652/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4652 - High (7.5)

On a system exposing an NVMe/TCP target, a remote client can trigger a kernel panic by sending a CONNECT command for an I/O queue with a bogus or stale CNTLID.

An attacker with network access to the NVMe/TCP target can trigger an unauthenticated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4652/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-55261 - High (8.1)

HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the application and may steal and manipulate the data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-55261/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-55261 - High (8.1)

HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the application and may steal and manipulate the data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-55261/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27664 - High (7.5)

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions &lt; V26.10), SICORE Base system (All versions &lt; V26.10.0). The affected application contains an out-of-bounds write vulnerability while parsing specia...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27664/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27664 - High (7.5)

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions &lt; V26.10), SICORE Base system (All versions &lt; V26.10.0). The affected application contains an out-of-bounds write vulnerability while parsing specia...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27664/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26008 - High (7.5)

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have an out-of-bounds access (std::vector) that leads to possible remote crash/memory corruption. This is because the CSMS sends UpdateAllowedEnergyTransferModes over the networ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26008/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26008 - High (7.5)

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have an out-of-bounds access (std::vector) that leads to possible remote crash/memory corruption. This is because the CSMS sends UpdateAllowedEnergyTransferModes over the networ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26008/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4747 - High (8.8)

Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4747/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4747 - High (8.8)

Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet. This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4747/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

HIGH severity alert: RATOC RAID Monitoring Manager for Windows (<2.00.009.260220) can leave custom install folders with insecure ACLs, letting non-admins run code as SYSTEM. Check permissions & update! CVE-2026-32680 https://radar.offseq.com/threat/cve-2026-32680-incorrect-default-permissions-in-ra-38982bf7 #OffSeq #Vuln #Windows #SysAdmin

🟠 CVE-2026-32680 - High (7.8)

The installer of RATOC RAID Monitoring Manager for Windows allows to customize the installation folder. If the installation folder is customized to some non-default one, the folder may be left with un-secure ACLs and non-administrative users can a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL RCE in n8n (CVE-2026-33660): Auth'd users can exploit Merge node SQL to read files & execute code on n8n host. Patch to 2.14.1/2.13.3/1.123.26 ASAP. Limit permissions if you can't patch yet. https://radar.offseq.com/threat/cve-2026-33660-cwe-94-improper-control-of-generati-e1c73d20 #OffSeq #n8n #infosec #CVE202633660

🚨 CVE-2026-33526: Critical Use-After-Free in Squid (<7.5) allows remote attackers to crash Squid via ICP traffic. icp_access rules are ineffective. Upgrade to 7.5+ or disable ICP (icp_port=0) ASAP! https://radar.offseq.com/threat/cve-2026-33526-cwe-416-use-after-free-in-squid-cac-5f2ea159 #OffSeq #Squid #Vuln #DoS

🟠 CVE-2026-20125 - High (7.7)

A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) conditio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20125/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3857 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3857 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3857 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to execute arbitrary GraphQL mutations on behalf of authen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32530 - High (8.8)

Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through &lt;= 1.1.18.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32530/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32530 - High (8.8)

Incorrect Privilege Assignment vulnerability in WPFunnels Creator LMS creatorlms allows Privilege Escalation.This issue affects Creator LMS: from n/a through &lt;= 1.1.18.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32530/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32523 - Critical (9.9)

Unrestricted Upload of File with Dangerous Type vulnerability in denishua WPJAM Basic wpjam-basic allows Using Malicious Files.This issue affects WPJAM Basic: from n/a through &lt;= 6.9.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32523/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32523 - Critical (9.9)

Unrestricted Upload of File with Dangerous Type vulnerability in denishua WPJAM Basic wpjam-basic allows Using Malicious Files.This issue affects WPJAM Basic: from n/a through &lt;= 6.9.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32523/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2511 - High (7.5)

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameter in the `storeTickets()` function in all versions up to, and including, 3.0.4. This is due to the user-su...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2511/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2511 - High (7.5)

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameter in the `storeTickets()` function in all versions up to, and including, 3.0.4. This is due to the user-su...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2511/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:0325] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0325)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-33017 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-33017)
- Name: Langflow Code Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx ; https://nvd.nist.gov/vuln/detail/CVE-2026-33017

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260325 #cisa20260325 #cve_2026_33017 #cve202633017

"CISA: New Langflow flaw actively exploited to hijack AI workflows"

"[...] The Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are actively exploiting a critical vulnerability identified as CVE-2026-33017, which affects the Langflow framework for building AI agents."

https://www.bleepingcomputer.com/news/security/cisa-new-langflow-flaw-actively-exploited-to-hijack-ai-workflows/

#Cybersecurity

Critical Langflow Vulnerability Exploited by Hackers, CISA Warns

A newly discovered flaw in the popular AI workflow tool Langflow is causing alarm in cybersecurity circles. The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority warning about CVE-2026-33017, a critical vulnerability that allows hackers to execute arbitrary code remotely. With Langflow widely used by AI developers worldwide, the flaw represents a serious threat to…

https://undercodenews.com/critical-langflow-vulnerability-exploited-by-hackers-cisa-warns/

CVE-2026-33017: Unauthenticated RCE in Langflow’s Public Flow Endpoint Explained…
#technology #thegeektribune
https://hackernoon.com/cve-2026-33017-unauthenticated-rce-in-langflows-public-flow-endpoint-explained?source=rss

🚨 [CISA-2026:0325] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0325)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-33017 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-33017)
- Name: Langflow Code Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx ; https://nvd.nist.gov/vuln/detail/CVE-2026-33017

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260325 #cisa20260325 #cve_2026_33017 #cve202633017

"CISA: New Langflow flaw actively exploited to hijack AI workflows"

"[...] The Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are actively exploiting a critical vulnerability identified as CVE-2026-33017, which affects the Langflow framework for building AI agents."

https://www.bleepingcomputer.com/news/security/cisa-new-langflow-flaw-actively-exploited-to-hijack-ai-workflows/

#Cybersecurity

CVE ID: CVE-2026-33017
Vendor: Langflow
Product: Langflow
Date Added: 2026-03-25
Notes: https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx ; https://nvd.nist.gov/vuln/detail/CVE-2026-33017
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33017

CISA has updated the KEV catalogue.

- CVE-2026-33017: Langflow Code Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-33017 #CISA #infosec #vulnerability

🔴 CVE-2026-4700 - Critical (9.8)

Mitigation bypass in the Networking: HTTP component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4700/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33344 - High (8.1)

Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33344/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4862 - High (8.8)

A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file /goform/formConfigDnsFilterGlobal of the component Parameter Handler. Such manipulation of the argument Gr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4862/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4862 - High (8.8)

A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file /goform/formConfigDnsFilterGlobal of the component Parameter Handler. Such manipulation of the argument Gr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4862/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4809 - Critical (9.8)

plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4809/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL vuln in plank/laravel-mediable <=6.4.0 (CVE-2026-4809): attackers can upload malicious PHP files by spoofing MIME types. No patch yet. Disable client MIME trust & enforce server-side checks! Details: https://radar.offseq.com/threat/cve-2026-4809-cwe-434-unrestricted-upload-of-file--9d4d9e8e #OffSeq #CVE20264809 #Laravel #RCE

🔴 CVE-2026-4809 - Critical (9.8)

plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4809/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL vuln in plank/laravel-mediable <=6.4.0 (CVE-2026-4809): attackers can upload malicious PHP files by spoofing MIME types. No patch yet. Disable client MIME trust & enforce server-side checks! Details: https://radar.offseq.com/threat/cve-2026-4809-cwe-434-unrestricted-upload-of-file--9d4d9e8e #OffSeq #CVE20264809 #Laravel #RCE

🟠 CVE-2026-4861 - High (8.8)

A weakness has been identified in Wavlink WL-NU516U1 260227. This vulnerability affects the function ftext of the file /cgi-bin/nas.cgi. This manipulation of the argument Content-Length causes stack-based buffer overflow. The attack can be initiat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4861 - High (8.8)

A weakness has been identified in Wavlink WL-NU516U1 260227. This vulnerability affects the function ftext of the file /cgi-bin/nas.cgi. This manipulation of the argument Content-Length causes stack-based buffer overflow. The attack can be initiat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ HIGH-severity: CVE-2026-28760 in RATOC RAID Monitoring Manager for Windows (<2.00.009.260220) allows DLL hijacking — local attackers may run code as admin. Patch ASAP, restrict installer access, and audit installs. https://radar.offseq.com/threat/cve-2026-28760-uncontrolled-search-path-element-in-f4dfdefd #OffSeq #infosec #vuln #windows

🟠 CVE-2026-28760 - High (7.8)

The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs. If a user is directed to place a crafted DLL with the installer, an arbitrary code may be executed with the administrator privilege.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28760/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 CVE-2026-4840: HIGH-severity OS command injection in Netcore Power 15AX (≤3.0.0.6938). No patch, public exploit out. Remote code execution possible — immediate mitigation needed! Full compromise risk. Details: https://radar.offseq.com/threat/cve-2026-4840-os-command-injection-in-netcore-powe-abf3a5bc #OffSeq #Netcore #Security #CVE20264840

🟠 CVE-2026-4840 - High (8.8)

A security flaw has been discovered in Netcore Power 15AX up to 3.0.0.6938. Affected by this issue is the function setTools of the file /bin/netis.cgi of the component Diagnostic Tool Interface. Performing a manipulation of the argument IpAddr res...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4840/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2931 - High (8.8)

The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and acce...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4484 - Critical (9.8)

The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_data...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4758 - High (8.8)

The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'WPJOBPORTALcustomfields::removeFileCustom' function in all versions up to, and including, 2.4.9. This makes it possibl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4758/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-33248 - High (7.8)

NVIDIA Megatron-LM contains a vulnerability in the hybrid conversion script where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A successful exploit of this vulnerability may lead to code execution, escalati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33248/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24151 - High (7.8)

NVIDIA Megatron-LM contains a vulnerability in inferencing where an Attacker may cause an RCE by convincing a user to load a maliciously crafted input. A successful exploit of this vulnerability may lead to code execution, escalation of privileges...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 New security advisory:

CVE-2026-33286 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-33286-graphiti-arbitrary-method-execution

#Cybersecurity #ZeroDay #ThreatIntel

🔴 CVE-2026-32536 - Critical (9.9)

Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows Using Malicious Files.This issue affects Green Downloads: from n/a through &lt;= 2.08.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32536/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32538 - High (7.5)

Insertion of Sensitive Information Into Sent Data vulnerability in Noor Alam SMTP Mailer smtp-mailer allows Retrieve Embedded Sensitive Data.This issue affects SMTP Mailer: from n/a through &lt;= 1.1.24.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32537 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nK Visual Portfolio, Photo Gallery & Post Grid visual-portfolio allows PHP Local File Inclusion.This issue affects Visual Port...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32537/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32546 - High (7.5)

Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Content: from n/a through &lt;= 3.2.22.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32546/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32546 - High (7.5)

Missing Authorization vulnerability in StellarWP Restrict Content restrict-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict Content: from n/a through &lt;= 3.2.22.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32546/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-20687 (CRITICAL): Use-after-free in Apple iOS/iPadOS/macOS/tvOS/watchOS lets malicious apps crash devices or write kernel memory. Patch to iOS/iPadOS 18.7.7/26.4, macOS Sequoia 15.7.5, Tahoe 26.4+ ASAP. https://radar.offseq.com/threat/cve-2026-20687-an-app-may-be-able-to-cause-unexpec-a39ac789 #OffSeq #AppleSecurity #InfoSec

🚨 CRITICAL: CVE-2026-32573 in Nelio AB Testing plugin (≤8.2.7) enables code injection on WordPress sites. No active exploits, but risk of remote code execution. Monitor for patches & harden configs. https://radar.offseq.com/threat/cve-2026-32573-improper-control-of-generation-of-c-2c0edccd #OffSeq #WordPress #Vuln

🔴 CVE-2026-32573 - Critical (9.1)

Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through &lt;= 8.2.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32539 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Blind SQL Injection.This issue affects PublishPress Revisions: from n/a through &lt;= 3.7.23.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32513 - High (8.8)

Deserialization of Untrusted Data vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows Object Injection.This issue affects JS Archive List: from n/a through &lt;= 6.1.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32513/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25366 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through &lt;= 2.7.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32525 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through &lt;= 3.5.6.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32525/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4719 - High (7.5)

Incorrect boundary conditions in the Graphics: Text component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4719/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4705 - Critical (9.8)

Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4705/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32534 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through &lt;= 3.0.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32531 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kunco kunco allows PHP Local File Inclusion.This issue affects Kunco: from n/a through &lt; 1.4.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32531/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33671 - High (7.5)

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33671/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33671 - High (7.5)

Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33671/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33497 - High (7.5)

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33497/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33484 - High (7.5)

Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33418 - High (7.5)

DiceBear is an avatar library for designers and developers. Prior to version 9.4.2, the `ensureSize()` function in `@dicebear/converter` used a regex-based approach to rewrite SVG `width`/`height` attributes, capping them at 2048px to prevent deni...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33316 - High (8.1)

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled users to regain access to their accounts. The `ResetPassword()` function sets the user’s status to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33316/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33310 - High (8.8)

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33310/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4723 - Critical (9.8)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox &lt; 149.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4723/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4716 - Critical (9.1)

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4716/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27044 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through &lt;= 4.12.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27044 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through &lt;= 4.12.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25447 - Critical (9.1)

Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through &lt;= 2.3.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25447 - Critical (9.1)

Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through &lt;= 2.3.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25001 - High (8.5)

Improper Control of Generation of Code ('Code Injection') vulnerability in Saad Iqbal Post Snippets post-snippets allows Remote Code Inclusion.This issue affects Post Snippets: from n/a through &lt;= 4.0.12.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33686 - High (8.8)

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33686 - High (8.8)

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the FileUtil class. The application fails to sanitize file extensions properly, allowing path separators to be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33687 - High (8.8)

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33687/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33687 - High (8.8)

Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 contain a vulnerability in the file upload endpoint that allows authenticated users to bypass all file type restrictions. The upload endpoint within t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33687/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33673 - High (7.6)

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33673 - High (7.6)

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33673 - High (7.6)

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33673 - High (7.6)

PrestaShop is an open source e-commerce web application. Versions prior to 8.2.5 and 9.1.0 are vulnerable to stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO. An attacker who can inject data into the database, via limited back-of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-33670 in SiYuan (<3.6.2) lets remote attackers exploit /api/file/readDir for path traversal, exposing sensitive files. Patch to 3.6.2+ ASAP! Details: https://radar.offseq.com/threat/cve-2026-33670-cwe-22-improper-limitation-of-a-pat-0880f67a #OffSeq #vuln #infosec #SiYuan

🔴 CVE-2026-33670 - Critical (9.8)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook. Version 3.6.2 patches the issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33670/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-33670 in SiYuan (<3.6.2) lets remote attackers exploit /api/file/readDir for path traversal, exposing sensitive files. Patch to 3.6.2+ ASAP! Details: https://radar.offseq.com/threat/cve-2026-33670-cwe-22-improper-limitation-of-a-pat-0880f67a #OffSeq #vuln #infosec #SiYuan

🔴 CVE-2026-33670 - Critical (9.8)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the /api/file/readDir interface was used to traverse and retrieve the file names of all documents under a notebook. Version 3.6.2 patches the issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33670/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33661 - High (8.6)

Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33661/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33661 - High (8.6)

Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33661/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4712 - High (7.5)

Information disclosure in the Widget: Cocoa component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4704 - High (7.5)

Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox &lt; 149, Firefox ESR &lt; 140.9, Thunderbird &lt; 149, and Thunderbird &lt; 140.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3988 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3988 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3988 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20012 - High (8.6)

A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20012/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20084 - High (8.6)

A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded between VLANs, resulting in a denial of service (DoS) condition.

This vulnerability is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26832 - Critical (9.8)

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20086 - High (8.6)

A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20086/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-32991 - Critical (9)

In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-32991/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-3608: HIGH-severity vuln in ISC Kea DHCP (2.6.0 – 2.6.4, 3.0.0 – 3.0.2). Remote attackers can crash daemons, causing DoS. Restrict API/HA access, monitor traffic, and prep failover. Details: https://radar.offseq.com/threat/cve-2026-3608-cwe-617-reachable-assertion-in-isc-k-fed4f439 #OffSeq #CVE #DHCP #Infosec

🟠 CVE-2026-33287 - High (7.5)

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript's `String.prototype.replace()` which interprets `$&` as a back reference to the ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33285 - High (7.5)

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's `memoryLimit` security mechanism can be completely bypassed by using reverse range expressions (e.g., `(100000000..1)`), allow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27889 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the na...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27889/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Pharos Controls Patches Critical Root Access Flaw in Mosaic Show Controllers

Pharos Controls patched a critical vulnerability (CVE-2026-2417) in its Mosaic Show Controller that allows unauthenticated attackers to execute arbitrary commands with root privileges.

**Make sure all Pharos Mosaic Show Controllers are isolated from the internet and accessible from trusted networks only. Check your version, if you are running 2.15.3, you are at risk. Plan an update the firmware to version 2.16 or later.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/pharos-controls-patches-critical-root-access-flaw-in-mosaic-show-controllers-1-6-s-3-0/gD2P6Ple2L

🟠 CVE-2026-24158 - High (7.5)

NVIDIA Triton Inference Server contains a vulnerability in the HTTP endpoint where an attacker may cause a denial of service by providing a large compressed payload. A successful exploit of this vulnerability may lead to denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24158/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ #Cybersecurity news & tips across the #fediverse

“🟠 CVE-2026-33678 - High (8.1) Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id = ?`), ignoring the task ID fro...”

https://mastodon.social/@thehackerwire/116285975900964242

🤖 via RSS feed. Not an endorsement.

🟠 CVE-2026-3104 - High (7.5)

A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain.
This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1.
BIND 9 versions 9...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3104/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26830 - Critical (9.8)

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shel...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26830/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH-severity XSS (CVE-2026-2072, CVSS 8.2) in Hitachi Infrastructure Analytics Advisor & Ops Center Analyzer <11.0.5-00. Exploitable by low-privilege users. Patch when available, restrict access, enable WAF. https://radar.offseq.com/threat/cve-2026-2072-cwe-79-improper-neutralization-of-in-c6f3add7 #OffSeq #XSS #Vuln #Hitachi

🔒 CVE-2026-28864 (HIGH): Local attackers can access Apple Keychain items on iOS, iPadOS, macOS, visionOS, watchOS. Patch to latest OS releases now to protect credentials. No known exploits yet. https://radar.offseq.com/threat/cve-2026-28864-a-local-attacker-may-gain-access-to-881070fb #OffSeq #Apple #Security #Keychain

🟠 CVE-2026-1519 - High (7.5)

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1519/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH: CVE-2026-2343 in PeproDev Ultimate Invoice ≤2.2.5 exposes PII via predictable ZIP archive names in bulk downloads. No auth needed — risk of mass data leaks! Disable feature, restrict access, monitor logs. https://radar.offseq.com/threat/cve-2026-2343-cwe-200-information-exposure-in-pepr-b24bfe87 #OffSeq #WordPress #Vuln

⚠️ CVE-2026-26306 (HIGH): OM Workspace (Windows ≤2.4) vulnerable to DLL hijacking. Local attackers can execute code via unsafe installer DLL loading. Patch urgently or restrict installs & use Safe DLL Search Mode. https://radar.offseq.com/threat/cve-2026-26306-uncontrolled-search-path-element-in-ee774158 #OffSeq #Vulnerability #Windows

🟠 CVE-2026-33218 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33218 - High (7.5)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, a client which can connect to the leafnode port can crash the nats-server with a certain malformed message pre-au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33216 - High (8.6)

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33216/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack