🟠 CVE-2026-3400 - High (8.8)

A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goform/TextEditingConversion. The manipulation of the argument wpapsk_crypto2_4g results in stack-based buffer o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3400/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ CVE-2026-3400 (HIGH, CVSS 8.7): Stack-based buffer overflow in Tenda AC15 routers (≤v15.13.07.13) allows unauthenticated remote code execution. PoC code is public. Restrict access & monitor for patches! https://radar.offseq.com/threat/cve-2026-3400-stack-based-buffer-overflow-in-tenda-c665b93a #OffSeq #Infosec #CVE #Vulnerability

🟠 CVE-2026-3400 - High (8.8)

A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goform/TextEditingConversion. The manipulation of the argument wpapsk_crypto2_4g results in stack-based buffer o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3400/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ CVE-2026-3400 (HIGH, CVSS 8.7): Stack-based buffer overflow in Tenda AC15 routers (≤v15.13.07.13) allows unauthenticated remote code execution. PoC code is public. Restrict access & monitor for patches! https://radar.offseq.com/threat/cve-2026-3400-stack-based-buffer-overflow-in-tenda-c665b93a #OffSeq #Infosec #CVE #Vulnerability

🚨 HIGH severity: CVE-2026-3399 impacts Tenda F453 (v1.0.0.3) via buffer overflow in httpd's fromGstDhcpSetSer. Remotely exploitable, public exploit available. Patch or mitigate now to prevent device takeover! https://radar.offseq.com/threat/cve-2026-3399-buffer-overflow-in-tenda-f453-2372f90c #OffSeq #Vuln #Infosec #Router

🟠 CVE-2026-3399 - High (8.8)

A vulnerability was identified in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer of the component httpd. The manipulation of the argument dips leads to buffer overflow. The at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 HIGH severity: CVE-2026-3399 impacts Tenda F453 (v1.0.0.3) via buffer overflow in httpd's fromGstDhcpSetSer. Remotely exploitable, public exploit available. Patch or mitigate now to prevent device takeover! https://radar.offseq.com/threat/cve-2026-3399-buffer-overflow-in-tenda-f453-2372f90c #OffSeq #Vuln #Infosec #Router

🟠 CVE-2026-3399 - High (8.8)

A vulnerability was identified in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer of the component httpd. The manipulation of the argument dips leads to buffer overflow. The at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 HIGH severity: Tenda F453 v1.0.0.3 vulnerable to remote buffer overflow (CVE-2026-3398) via /goform/AdvSetWan. Exploit public, RCE possible with no auth. Disable remote admin & monitor for exploits. Patch ASAP. https://radar.offseq.com/threat/cve-2026-3398-buffer-overflow-in-tenda-f453-735bc013 #OffSeq #Vuln #RouterSec

🟠 CVE-2026-3398 - High (8.8)

A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromAdvSetWan of the file /goform/AdvSetWan of the component httpd. Executing a manipulation of the argument wanmode/PPPOEPassword can lead to buffer overflow. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 HIGH severity: Tenda F453 v1.0.0.3 vulnerable to remote buffer overflow (CVE-2026-3398) via /goform/AdvSetWan. Exploit public, RCE possible with no auth. Disable remote admin & monitor for exploits. Patch ASAP. https://radar.offseq.com/threat/cve-2026-3398-buffer-overflow-in-tenda-f453-735bc013 #OffSeq #Vuln #RouterSec

🟠 CVE-2026-3398 - High (8.8)

A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromAdvSetWan of the file /goform/AdvSetWan of the component httpd. Executing a manipulation of the argument wanmode/PPPOEPassword can lead to buffer overflow. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-3380: HIGH-severity buffer overflow in Tenda F453 (v1.0.0.3). Remotely exploitable, no auth needed — PoC public. Isolate devices, restrict WAN, monitor for /goform/L7Im traffic. Patch pending. https://radar.offseq.com/threat/cve-2026-3380-buffer-overflow-in-tenda-f453-54481f34 #OffSeq #Vulnerability #Tenda #InfoSec

🟠 CVE-2026-3380 - High (8.8)

A vulnerability was found in Tenda F453 1.0.0.3. This issue affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page results in buffer overflow. The attack may be launched remotely. The exploit has been made...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3380/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-3380: HIGH-severity buffer overflow in Tenda F453 (v1.0.0.3). Remotely exploitable, no auth needed — PoC public. Isolate devices, restrict WAN, monitor for /goform/L7Im traffic. Patch pending. https://radar.offseq.com/threat/cve-2026-3380-buffer-overflow-in-tenda-f453-54481f34 #OffSeq #Vulnerability #Tenda #InfoSec

🟠 CVE-2026-3380 - High (8.8)

A vulnerability was found in Tenda F453 1.0.0.3. This issue affects the function frmL7ImForm of the file /goform/L7Im. The manipulation of the argument page results in buffer overflow. The attack may be launched remotely. The exploit has been made...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3380/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ New security advisory:

CVE-2026-3379 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://yazoul.net/advisory/cve/cve-2026-3379

#Cybersecurity #ZeroDay #ThreatIntel

🟠 CVE-2026-3379 - High (8.8)

A vulnerability has been found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page leads to buffer overflow. The attack may be initiated remotely. The ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3379/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 HIGH severity: Tenda F453 v1.0.0.3 has a buffer overflow (CVE-2026-3379) in /goform/SetIpBind. Remotely exploitable with no auth. Restrict access, monitor for exploit attempts, and patch ASAP. https://radar.offseq.com/threat/cve-2026-3379-buffer-overflow-in-tenda-f453-63a79945 #OffSeq #Cybersecurity #Vulnerability #CVE20263379

🟠 CVE-2026-3379 - High (8.8)

A vulnerability has been found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page leads to buffer overflow. The attack may be initiated remotely. The ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3379/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 HIGH severity: Tenda F453 v1.0.0.3 has a buffer overflow (CVE-2026-3379) in /goform/SetIpBind. Remotely exploitable with no auth. Restrict access, monitor for exploit attempts, and patch ASAP. https://radar.offseq.com/threat/cve-2026-3379-buffer-overflow-in-tenda-f453-63a79945 #OffSeq #Cybersecurity #Vulnerability #CVE20263379

🔥 CVE-2026-3378 (HIGH, CVSS 8.7): Buffer overflow in Tenda F453 (FW 1.0.0.3) lets remote attackers execute code or cause DoS — no authentication needed. PoC exploit published. Patch or restrict access now! https://radar.offseq.com/threat/cve-2026-3378-buffer-overflow-in-tenda-f453-0b5023a3 #OffSeq #Vulnerability #Tenda #RouterSecurity

🟠 CVE-2026-3378 - High (8.8)

A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromqossetting of the file /goform/qossetting. Executing a manipulation of the argument qos can lead to buffer overflow. The attack can be launched remotely. The exploit has be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 CVE-2026-3378 (HIGH, CVSS 8.7): Buffer overflow in Tenda F453 (FW 1.0.0.3) lets remote attackers execute code or cause DoS — no authentication needed. PoC exploit published. Patch or restrict access now! https://radar.offseq.com/threat/cve-2026-3378-buffer-overflow-in-tenda-f453-0b5023a3 #OffSeq #Vulnerability #Tenda #RouterSecurity

🟠 CVE-2026-3378 - High (8.8)

A flaw has been found in Tenda F453 1.0.0.3. This affects the function fromqossetting of the file /goform/qossetting. Executing a manipulation of the argument qos can lead to buffer overflow. The attack can be launched remotely. The exploit has be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28414 - High (7.5)

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28414/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28414 - High (7.5)

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28414/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26862 - High (8.3)

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26862/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26862 - High (8.3)

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26862/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ HIGH severity: CVE-2026-28562 in wpForo Forum 2.4.14 (WordPress) — unauthenticated SQL injection via wpfob, enabling blind credential extraction. Apply WAF rules & monitor logs until a fix is released. https://radar.offseq.com/threat/cve-2026-28562-improper-neutralization-of-special--22c35314 #OffSeq #WordPress #SQLInjection #Infosec

🟠 CVE-2026-28562 - High (8.2)

wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ HIGH severity: CVE-2026-28562 in wpForo Forum 2.4.14 (WordPress) — unauthenticated SQL injection via wpfob, enabling blind credential extraction. Apply WAF rules & monitor logs until a fix is released. https://radar.offseq.com/threat/cve-2026-28562-improper-neutralization-of-special--22c35314 #OffSeq #WordPress #SQLInjection #Infosec

🟠 CVE-2026-28562 - High (8.2)

wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE WHEN payl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 CVE-2026-3376: HIGH severity buffer overflow in Tenda F453 v1.0.0.3 (/goform/SafeMacFilter). Public exploit enables remote code execution — no auth needed. Isolate devices & restrict access until patched. https://radar.offseq.com/threat/cve-2026-3376-buffer-overflow-in-tenda-f453-d5150655 #OffSeq #RouterVuln #InfoSec

🟠 CVE-2026-3376 - High (8.8)

A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromSafeMacFilter of the file /goform/SafeMacFilter. Such manipulation of the argument page leads to buffer overflow. It is possible t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3376/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 CVE-2026-3376: HIGH severity buffer overflow in Tenda F453 v1.0.0.3 (/goform/SafeMacFilter). Public exploit enables remote code execution — no auth needed. Isolate devices & restrict access until patched. https://radar.offseq.com/threat/cve-2026-3376-buffer-overflow-in-tenda-f453-d5150655 #OffSeq #RouterVuln #InfoSec

🟠 CVE-2026-3376 - High (8.8)

A security vulnerability has been detected in Tenda F453 1.0.0.3. Affected by this vulnerability is the function fromSafeMacFilter of the file /goform/SafeMacFilter. Such manipulation of the argument page leads to buffer overflow. It is possible t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3376/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ New security advisory:

CVE-2026-3377 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://yazoul.net/advisory/cve/cve-2026-3377

#Cybersecurity #SecurityPatching #HackerNews

⚠️ CVE-2026-3377 (HIGH): Buffer overflow in Tenda F453 v1.0.0.3 via /goform/SafeUrlFilter. Public exploit available, no patch yet. Restrict device access & monitor traffic. Details: https://radar.offseq.com/threat/cve-2026-3377-buffer-overflow-in-tenda-f453-c140c206 #OffSeq #Vulnerability #Tenda #Infosec

🟠 CVE-2026-3377 - High (8.8)

A vulnerability was detected in Tenda F453 1.0.0.3. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Performing a manipulation of the argument page results in buffer overflow. The attack can be initiated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3377/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-3377 (HIGH): Buffer overflow in Tenda F453 v1.0.0.3 via /goform/SafeUrlFilter. Public exploit available, no patch yet. Restrict device access & monitor traffic. Details: https://radar.offseq.com/threat/cve-2026-3377-buffer-overflow-in-tenda-f453-c140c206 #OffSeq #Vulnerability #Tenda #Infosec

🟠 CVE-2026-3377 - High (8.8)

A vulnerability was detected in Tenda F453 1.0.0.3. Affected by this issue is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Performing a manipulation of the argument page results in buffer overflow. The attack can be initiated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3377/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL vuln in Microchip TimePictra (11.0 – 11.3 SP2): CVE-2026-2844 lets remote, unauthenticated attackers manipulate configs. No patch yet — restrict access & monitor logs! https://radar.offseq.com/threat/cve-2026-2844-cwe-306-missing-authentication-for-c-aa868998 #OffSeq #TimePictra #Vulnerability #OTSecurity

⚠️ CRITICAL vuln in Microchip TimePictra (11.0 – 11.3 SP2): CVE-2026-2844 lets remote, unauthenticated attackers manipulate configs. No patch yet — restrict access & monitor logs! https://radar.offseq.com/threat/cve-2026-2844-cwe-306-missing-authentication-for-c-aa868998 #OffSeq #TimePictra #Vulnerability #OTSecurity

🚨 CVE-2026-3010: CRITICAL XSS in Microchip TimePictra v11.0 – 11.3 SP2. Remote, unauthenticated attackers can inject scripts via web UI. Restrict access, enable WAF, monitor logs. Patch awaited. Full info: https://radar.offseq.com/threat/cve-2026-3010-cwe-79-improper-neutralization-of-in-f593f595 #OffSeq #XSS #ICS #Vuln

🚨 CVE-2026-3010: CRITICAL XSS in Microchip TimePictra v11.0 – 11.3 SP2. Remote, unauthenticated attackers can inject scripts via web UI. Restrict access, enable WAF, monitor logs. Patch awaited. Full info: https://radar.offseq.com/threat/cve-2026-3010-cwe-79-improper-neutralization-of-in-f593f595 #OffSeq #XSS #ICS #Vuln

⚠️ New security advisory:

CVE-2025-13673 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://yazoul.net/advisory/cve/cve-2025-13673

#Cybersecurity #ZeroDay #ThreatIntel

🟠 CVE-2025-13673 - High (7.5)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13673 - High (7.5)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2471 - High (7.5)

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the `BaseModel` class constructor c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2471 - High (7.5)

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the `BaseModel` class constructor c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2788 - Critical (9.8)

Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2788/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0980 - High (8.3)

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious usern...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0980 - High (8.3)

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious usern...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3037 - High (8)

An OS command injection vulnerability exists in XWEB Pro version 1.12.1
and prior, enabling an authenticated attacker to achieve remote code
execution on the system by modifying malicious input injected into the
MBird SMS service URL and/or cod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3037/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27630 - High (7.5)

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27630/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27630 - High (7.5)

TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. Versions prior to version 2.02 are vulnerable to a Denial of Service (DoS) attack known as Slowloris. The server spawns a new OS thread for every incoming connection without enforc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27630/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28426 - High (8.7)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious Jav...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28426 - High (8.7)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious Jav...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28425 - High (8)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28425/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28425 - High (8)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28425/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20902 - High (8)

An OS command injection

vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into the map filename field during the map
upl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20902/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21718 - Critical (10)

An authentication bypass vulnerability exists in Copeland XWEB Pro
version 1.12.1 and prior, enabling any attackers to bypass the
authentication requirement and achieve pre-authenticated code execution
on the system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-21718: CRITICAL auth bypass in Copeland XWEB 300D PRO (≤1.12.1). Remote code exec possible — no user interaction. No patch yet. Segment & monitor ICS networks! https://radar.offseq.com/threat/cve-2026-21718-cwe-327-in-copeland-copeland-xweb-3-124474ba #OffSeq #ICS #Vulnerability #Cybersecurity

🟠 CVE-2026-23702 - High (8)

An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
sending malicious input injected into the server username field of the
impo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23702/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24452 - High (8)

An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
supplying a crafted template file to the devices route.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24452/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25037 - High (8)

An OS command injection

vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
configuring a maliciously crafted LCD state which is later processed
durin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25037/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25105 - High (8)

An OS command injection

vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into parameters of the Modbus command tool in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25196 - High (8)

An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into the Wi-Fi SSID and/or password fields
can le...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25196/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27836 - High (7.5)

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27836 - High (7.5)

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28416 - High (8.2)

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a mal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28416/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28416 - High (8.2)

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a mal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28416/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28406 - High (8.2)

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28406/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28406 - High (8.2)

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28406/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28400 - High (7.5)

Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST `/engines/_configure` endpoint that accepts arbitrary runtime flags without authentication. These flags are pass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28400/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28400 - High (7.5)

Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST `/engines/_configure` endpoint that accepts arbitrary runtime flags without authentication. These flags are pass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28400/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27939 - High (8.8)

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27939 - High (8.8)

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-40932 - High (8.2)

Apache::SessionX versions through 2.01 for Perl create insecure session id.

Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand() ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40932/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-40932 - High (8.2)

Apache::SessionX versions through 2.01 for Perl create insecure session id.

Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand() ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40932/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2597 - High (7.5)

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes().

The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2597/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2597 - High (7.5)

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes().

The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2597/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69437 - High (8.7)

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69437/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69437 - High (8.7)

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69437/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27755 in SODOLA SL902-SWTGW124AS (≤200.1.20) lets attackers forge MD5-based session IDs, bypassing auth remotely. No patch yet — segment, restrict, monitor! https://radar.offseq.com/threat/cve-2026-27755-cwe-330-use-of-insufficiently-rando-27c7bdab #OffSeq #CVE202627755 #IoTSecurity #Infosec

🔴 CVE-2026-27755 - Critical (9.8)

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess val...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27755 in SODOLA SL902-SWTGW124AS (≤200.1.20) lets attackers forge MD5-based session IDs, bypassing auth remotely. No patch yet — segment, restrict, monitor! https://radar.offseq.com/threat/cve-2026-27755-cwe-330-use-of-insufficiently-rando-27c7bdab #OffSeq #CVE202627755 #IoTSecurity #Infosec

🔴 CVE-2026-27755 - Critical (9.8)

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess val...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27510 - Critical (9.6)

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27510 - Critical (9.6)

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510) https://boschko.ca/unitree-go2-rce/

🟠 CVE-2026-27509 - High (8)

Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, una...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27509 - High (8)

Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, una...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510) https://boschko.ca/unitree-go2-rce/

🔴 CVE-2026-22207 - Critical (9.8)

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22207 - Critical (9.8)

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22206 - High (8.8)

SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw comb...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22206 - High (8.8)

SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw comb...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22205 - High (7.5)

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22205/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22205 - High (7.5)

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22205/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-28268 - Critical (9.8)

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL vuln in go-vikunja vikunja (<2.1.0): Password reset tokens never expire due to logic flaw, enabling persistent account takeover. Patch to v2.1.0+ now! CVE-2026-28268 https://radar.offseq.com/threat/cve-2026-28268-cwe-459-incomplete-cleanup-in-go-vi-0517b158 #OffSeq #Vuln #Security #FOSS

🔴 CVE-2026-28268 - Critical (9.8)

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL vuln in go-vikunja vikunja (<2.1.0): Password reset tokens never expire due to logic flaw, enabling persistent account takeover. Patch to v2.1.0+ now! CVE-2026-28268 https://radar.offseq.com/threat/cve-2026-28268-cwe-459-incomplete-cleanup-in-go-vi-0517b158 #OffSeq #Vuln #Security #FOSS

🟠 CVE-2026-27141 - High (7.5)

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27141 - High (7.5)

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26861 - High (8.3)

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26861 - High (8.3)

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-02-23 - 2026-03-02)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 974

Severity:
- Critical: 145
- High: 315
- Medium: 431
- Low: 49
- None: 34

Status:
- : 10
- Analyzed: 435
- Awaiting Analysis: 257
- Modified: 60
- Received: 119
- Rejected: 17
- Undergoing Analysis: 76

Top CNAs:
- GitHub, Inc.: 354
- VulDB: 131
- VulnCheck: 70
- Mozilla Corporation: 52
- ICS-CERT: 51
- MITRE: 34
- Wordfence: 34
- Red Hat, Inc.: 15
- Cisco Systems, Inc.: 15
- GitLab Inc.: 13

Top Affected Products:
- UNKNOWN: 459
- Mozilla Firefox: 52
- Mozilla Thunderbird: 50
- Imagemagick: 34
- Open-emr Openemr: 25
- Copeland Xweb 300d Pro Firmware: 15
- Freerdp: 15
- Copeland Xweb 500b Pro Firmware: 15
- Copeland Xweb 500d Pro Firmware: 15
- Tenda F453 Firmware: 10

Top EPSS Score:
- CVE-2026-3301 - 2.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3301)
- CVE-2025-70328 - 2.51 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70328)
- CVE-2026-20127 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20127)
- CVE-2025-70327 - 1.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70327)
- CVE-2026-24663 - 1.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24663)
- CVE-2026-22553 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22553)
- CVE-2026-26222 - 0.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26222)
- CVE-2026-26331 - 0.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26331)
- CVE-2026-27498 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27498)
- CVE-2026-21658 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21658)

📈 CVE Published in last 7 days (2026-02-23 - 2026-03-02)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 974

Severity:
- Critical: 145
- High: 315
- Medium: 431
- Low: 49
- None: 34

Status:
- : 10
- Analyzed: 435
- Awaiting Analysis: 257
- Modified: 60
- Received: 119
- Rejected: 17
- Undergoing Analysis: 76

Top CNAs:
- GitHub, Inc.: 354
- VulDB: 131
- VulnCheck: 70
- Mozilla Corporation: 52
- ICS-CERT: 51
- MITRE: 34
- Wordfence: 34
- Red Hat, Inc.: 15
- Cisco Systems, Inc.: 15
- GitLab Inc.: 13

Top Affected Products:
- UNKNOWN: 459
- Mozilla Firefox: 52
- Mozilla Thunderbird: 50
- Imagemagick: 34
- Open-emr Openemr: 25
- Copeland Xweb 300d Pro Firmware: 15
- Freerdp: 15
- Copeland Xweb 500b Pro Firmware: 15
- Copeland Xweb 500d Pro Firmware: 15
- Tenda F453 Firmware: 10

Top EPSS Score:
- CVE-2026-3301 - 2.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3301)
- CVE-2025-70328 - 2.51 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70328)
- CVE-2026-20127 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20127)
- CVE-2025-70327 - 1.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70327)
- CVE-2026-24663 - 1.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24663)
- CVE-2026-22553 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22553)
- CVE-2026-26222 - 0.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26222)
- CVE-2026-26331 - 0.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26331)
- CVE-2026-27498 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27498)
- CVE-2026-21658 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21658)

another day another critical vulnerability in openclaw 🥲🤡

"In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval."

🔐 CVE-2026-28363

📊 CVSS: 9.9 · Critical
📅 02/27/2026, 04:16 AM
🛡️ CWE: CWE-184
📦 Affected: OpenClaw OpenClaw (< 2026.2.23)

🔗 https://hecate.pw/vulnerability/CVE-2026-28363

#cve #vulnerability #hecate

🔴 CVE-2026-28363 - Critical (9.9)

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28363/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28274 - High (8.7)

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28276 - High (7.5)

Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28276/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27635 - High (7.5)

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.0, when model render generation is enabled, a logged-in user can achieve RCE by uploading a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27635/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24352 - Critical (9.8)

PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID
for a victim and later hijack the authenticated...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24352 - Critical (9.8)

PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID
for a victim and later hijack the authenticated...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-2749 hits Centreon Open Tickets (Linux Central Server). All before v25.10.3/24.10.8/24.04.7 at risk — remote exploit, full compromise possible. Restrict access & monitor systems! https://radar.offseq.com/threat/cve-2026-2749-e23f9297 #OffSeq #Centreon #Vuln

🔴 CVE-2026-2749 - Critical (9.9)

Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10.3, 24.10.8, 24.04.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2749/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-2749 hits Centreon Open Tickets (Linux Central Server). All before v25.10.3/24.10.8/24.04.7 at risk — remote exploit, full compromise possible. Restrict access & monitor systems! https://radar.offseq.com/threat/cve-2026-2749-e23f9297 #OffSeq #Centreon #Vuln

🔴 CVE-2026-2749 - Critical (9.9)

Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10.3, 24.10.8, 24.04.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2749/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3271 - High (8.8)

A vulnerability was found in Tenda F453 1.0.0.3. This impacts the function fromP2pListFilter of the file /goform/P2pListFilterof of the component httpd. The manipulation of the argument page results in buffer overflow. The attack may be launched r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3271/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔐 CVE-2026-27751 (CRITICAL): SODOLA SL902-SWTGW124AS gateways (≤200.1.20) use default creds, enabling remote admin takeover. Change all passwords or restrict access ASAP! No patch yet. https://radar.offseq.com/threat/cve-2026-27751-cwe-1392-use-of-default-credentials-706a3fb0 #OffSeq #Vuln #IoTSecurity #NetworkSecurity

🔴 CVE-2026-27751 - Critical (9.8)

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management interface. Attackers can authenticate using the hardcoded default...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔐 CVE-2026-27751 (CRITICAL): SODOLA SL902-SWTGW124AS gateways (≤200.1.20) use default creds, enabling remote admin takeover. Change all passwords or restrict access ASAP! No patch yet. https://radar.offseq.com/threat/cve-2026-27751-cwe-1392-use-of-default-credentials-706a3fb0 #OffSeq #Vuln #IoTSecurity #NetworkSecurity

🔴 CVE-2026-27751 - Critical (9.8)

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management interface. Attackers can authenticate using the hardcoded default...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-11251 - Critical (9.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows SQL Injection.This issue affects E-Commerce Platform: through 27022026.

NOTE...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11251/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-11251 - Critical (9.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows SQL Injection.This issue affects E-Commerce Platform: through 27022026.

NOTE...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11251/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27942 - High (7.5)

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27942 - High (7.5)

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-28370 in OpenStack Vitrage (CVSS 9.1) enables authenticated RCE via eval injection in query parser. Upgrade to fixed versions, restrict API access, and monitor logs. Affects 0, 13.0.0, 14.0.0, 15.0.0. Details: https://radar.offseq.com/threat/cve-2026-28370-cwe-95-improper-neutralization-of-d-e403f347 #OffSeq #OpenStack #Vuln

🔴 CVE-2026-28370 - Critical (9.1)

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unau...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28370/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2750 - Critical (9.1)

Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2750 - Critical (9.1)

Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27969 - High (8.8)

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27969 - High (8.8)

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-28215 - Critical (9.1)

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28215/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-28215 - Critical (9.1)

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructure configuration of a self-hosted Hoppscotch instance including OAuth provider credentials and SMTP...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28215/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25136 - High (8.1)

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25136/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-02-23 - 2026-03-02)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 974

Severity:
- Critical: 145
- High: 315
- Medium: 431
- Low: 49
- None: 34

Status:
- : 10
- Analyzed: 435
- Awaiting Analysis: 257
- Modified: 60
- Received: 119
- Rejected: 17
- Undergoing Analysis: 76

Top CNAs:
- GitHub, Inc.: 354
- VulDB: 131
- VulnCheck: 70
- Mozilla Corporation: 52
- ICS-CERT: 51
- MITRE: 34
- Wordfence: 34
- Red Hat, Inc.: 15
- Cisco Systems, Inc.: 15
- GitLab Inc.: 13

Top Affected Products:
- UNKNOWN: 459
- Mozilla Firefox: 52
- Mozilla Thunderbird: 50
- Imagemagick: 34
- Open-emr Openemr: 25
- Copeland Xweb 300d Pro Firmware: 15
- Freerdp: 15
- Copeland Xweb 500b Pro Firmware: 15
- Copeland Xweb 500d Pro Firmware: 15
- Tenda F453 Firmware: 10

Top EPSS Score:
- CVE-2026-3301 - 2.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3301)
- CVE-2025-70328 - 2.51 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70328)
- CVE-2026-20127 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20127)
- CVE-2025-70327 - 1.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70327)
- CVE-2026-24663 - 1.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24663)
- CVE-2026-22553 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22553)
- CVE-2026-26222 - 0.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26222)
- CVE-2026-26331 - 0.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26331)
- CVE-2026-27498 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27498)
- CVE-2026-21658 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21658)

📈 CVE Published in last 7 days (2026-02-23 - 2026-03-02)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 974

Severity:
- Critical: 145
- High: 315
- Medium: 431
- Low: 49
- None: 34

Status:
- : 10
- Analyzed: 435
- Awaiting Analysis: 257
- Modified: 60
- Received: 119
- Rejected: 17
- Undergoing Analysis: 76

Top CNAs:
- GitHub, Inc.: 354
- VulDB: 131
- VulnCheck: 70
- Mozilla Corporation: 52
- ICS-CERT: 51
- MITRE: 34
- Wordfence: 34
- Red Hat, Inc.: 15
- Cisco Systems, Inc.: 15
- GitLab Inc.: 13

Top Affected Products:
- UNKNOWN: 459
- Mozilla Firefox: 52
- Mozilla Thunderbird: 50
- Imagemagick: 34
- Open-emr Openemr: 25
- Copeland Xweb 300d Pro Firmware: 15
- Freerdp: 15
- Copeland Xweb 500b Pro Firmware: 15
- Copeland Xweb 500d Pro Firmware: 15
- Tenda F453 Firmware: 10

Top EPSS Score:
- CVE-2026-3301 - 2.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3301)
- CVE-2025-70328 - 2.51 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70328)
- CVE-2026-20127 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20127)
- CVE-2025-70327 - 1.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-70327)
- CVE-2026-24663 - 1.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24663)
- CVE-2026-22553 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22553)
- CVE-2026-26222 - 0.85 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26222)
- CVE-2026-26331 - 0.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26331)
- CVE-2026-27498 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27498)
- CVE-2026-21658 - 0.59 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21658)

🔴 CVE-2026-3301 - Critical (9.8)

A security flaw has been discovered in Totolink N300RH 6.1c.1353_B20190305. Affected by this vulnerability is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3301/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL OS command injection in Totolink N300RH (v6.1c.1353_B20190305) — CVE-2026-3301. Unauthenticated remote exploit possible, with public exploit code out. Restrict access & monitor until patch released. https://radar.offseq.com/threat/cve-2026-3301-os-command-injection-in-totolink-n30-8ab5e0b9 #OffSeq #CVE20263301 #IoTSecurity

🟠 CVE-2026-2751 - High (8.3)

Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2751 - High (8.3)

Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-11252 - Critical (9.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm allows SQL Injection.This issue affects windesk.Fm: through 27022026.

NOTE: The vendor ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11252/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-11252 - Critical (9.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm allows SQL Injection.This issue affects windesk.Fm: through 27022026.

NOTE: The vendor ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11252/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23750 - High (8.1)

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23750 - High (8.1)

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25997 - Critical (9.8)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reco...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25997/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25997 - Critical (9.8)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_clipboard_format_equal` reads freed `lastSentFormats` memory because `xf_clipboard_formats_free` (called from the cliprdr channel thread during auto-reco...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25997/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25955 - Critical (9.8)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_AppUpdateWindowFromSurface` reuses a cached `XImage` whose `data` pointer references a freed RDPGFX surface buffer, because `gdi_DeleteSurface` frees `su...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25955/