🚨 CRITICAL: SenseLive X3050 v1.523 is vulnerable to authentication bypass (CVE-2026-40630) via alternate paths. No fix yet — restrict device network access and monitor closely. https://radar.offseq.com/threat/cve-2026-40630-cwe-288-authentication-bypass-using-b2eedf7d #OffSeq #CVE202640630 #IoTSecurity #VulnAlert

🚨 CRITICAL: SenseLive X3050 v1.523 is vulnerable to authentication bypass (CVE-2026-40630) via alternate paths. No fix yet — restrict device network access and monitor closely. https://radar.offseq.com/threat/cve-2026-40630-cwe-288-authentication-bypass-using-b2eedf7d #OffSeq #CVE202640630 #IoTSecurity #VulnAlert

SenseLive X3050 V1.523 is at CRITICAL risk (CVE-2026-40620, CVSS 9.3): missing auth lets remote attackers gain admin access. No patch yet — restrict management access, monitor logs, and follow vendor updates. https://radar.offseq.com/threat/cve-2026-40620-cwe-306-missing-authentication-for--0af2786c #OffSeq #CVE202640620 #IoTSecurity

SenseLive X3050 V1.523 is at CRITICAL risk (CVE-2026-40620, CVSS 9.3): missing auth lets remote attackers gain admin access. No patch yet — restrict management access, monitor logs, and follow vendor updates. https://radar.offseq.com/threat/cve-2026-40620-cwe-306-missing-authentication-for--0af2786c #OffSeq #CVE202640620 #IoTSecurity

🔍 CVE-2026-25775: SenseLive X3050 (V1.523) critical vuln — remote firmware updates possible without auth! Patch unavailable. Restrict access & monitor for unauthorized firmware actions. https://radar.offseq.com/threat/cve-2026-25775-cwe-306-missing-authentication-for--773ccfcd #OffSeq #IoTSecurity #CVE202625775

🔍 CVE-2026-25775: SenseLive X3050 (V1.523) critical vuln — remote firmware updates possible without auth! Patch unavailable. Restrict access & monitor for unauthorized firmware actions. https://radar.offseq.com/threat/cve-2026-25775-cwe-306-missing-authentication-for--773ccfcd #OffSeq #IoTSecurity #CVE202625775

🟠 CVE-2026-41353 - High (8.1)

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41353/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41353 - High (8.1)

OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions through persistent profile mutation and runtime profile selection. Remote attackers can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41353/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41352 - High (8.8)

OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41352 - High (8.8)

OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. Attackers with device pairing credentials can execute arbitrary node commands on the host ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41349 - High (8.8)

OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter. Remote attackers can exploit this to bypass security controls and execute unauthorize...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41349/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41349 - High (8.8)

OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch parameter. Remote attackers can exploit this to bypass security controls and execute unauthorize...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41349/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41336 - High (7.8)

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, enabling loading of attacker-controlled hook code. Attackers can replace trusted default-on bundled hooks from untrusted workspa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41336/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41336 - High (7.8)

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_HOOKS_DIR environment variable, enabling loading of attacker-controlled hook code. Attackers can replace trusted default-on bundled hooks from untrusted workspa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41336/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33819 - Critical (10)

Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33819/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33819 - Critical (10)

Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33819/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33102 - Critical (9.3)

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33102/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33102 - Critical (9.3)

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33102/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32210 - Critical (9.3)

Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32210/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32210 - Critical (9.3)

Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32210/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32172 - High (8)

Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32172/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32172 - High (8)

Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32172/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26210 - Critical (9.8)

KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages usi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26210/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26210 - Critical (9.8)

KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve backend mode where the scheduler RPC server binds a ZMQ ROUTER socket to all interfaces with no authentication and deserializes incoming messages usi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26210/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31178 - Critical (9.8)

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to /cgi-bin/cstecgi.cgi.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31178/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31178 - Critical (9.8)

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to /cgi-bin/cstecgi.cgi.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31178/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6920 - High (7.5)

Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6920/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6920 - High (7.5)

Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6920/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-39087 - Critical (9.8)

An issue in Ntfy ntfy.sh before v.2.21 allows a remote attacker to execute arbitrary code via the parseActions function

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39087/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-39087 - Critical (9.8)

An issue in Ntfy ntfy.sh before v.2.21 allows a remote attacker to execute arbitrary code via the parseActions function

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39087/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31177 - Critical (9.8)

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31177/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31177 - Critical (9.8)

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31177/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6942 - Critical (9.8)

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6942 - Critical (9.8)

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41268 - High (7.7)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41268 - High (7.7)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, Flowise is vulnerable to a critical unauthenticated remote command execution (RCE) vulnerability. It can be exploited via a parameter override...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Apple issues iOS/iPadOS 26.4.2 to fix a Notification Services bug (CVE-2026-28950) that could retain deleted-app notification previews — Signal says preserved fragments will be removed after users update. Install now: https://cyberinsider.com/apple-fixes-ios-privacy-flaw-that-allowed-signal-message-retrieval/ 🔒📱 #iOS #Privacy #Security

Apple fixes iOS flaw exposing deleted messages via notification logs (CVE-2026-28950).

Even encrypted apps were impacted.
Patch now.

https://www.technadu.com/apple-patches-bug-exposing-deleted-chat-messages-via-logged-notifications/626706/

#Infosec #iOS #Privacy

Apple issues iOS/iPadOS 26.4.2 to fix a Notification Services bug (CVE-2026-28950) that could retain deleted-app notification previews — Signal says preserved fragments will be removed after users update. Install now: https://cyberinsider.com/apple-fixes-ios-privacy-flaw-that-allowed-signal-message-retrieval/ 🔒📱 #iOS #Privacy #Security

Apple fixes iOS flaw exposing deleted messages via notification logs (CVE-2026-28950).

Even encrypted apps were impacted.
Patch now.

https://www.technadu.com/apple-patches-bug-exposing-deleted-chat-messages-via-logged-notifications/626706/

#Infosec #iOS #Privacy

https://support.apple.com/en-us/127002
Impact: Notifications marked for deletion could be unexpectedly retained on the device

Description: A logging issue was addressed with improved data redaction.

CVE-2026-28950

<3

🟠 CVE-2026-5816 - High (8)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.4 and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper pa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5816/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41138 - High (8.3)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, there is a remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas. The user’s input ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41138/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41138 - High (8.3)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, there is a remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas. The user’s input ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41138/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41246 - High (8.1)

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPP...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41246/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41246 - High (8.1)

Contour is a Kubernetes ingress controller using Envoy proxy. From v1.19.0 to before v1.33.4, v1.32.5, and v1.31.6, Contour's Cookie Rewriting feature is vulnerable to Lua code injection. An attacker with RBAC permissions to create or modify HTTPP...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41246/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40886 - High (7.7)

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a work...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40886 - High (7.7)

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 3.6.5 to 4.0.4, an unchecked array index in the pod informer's podGCFromPod() function causes a controller-wide panic when a work...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31181 - Critical (9.8)

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31181/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31181 - Critical (9.8)

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31181/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-62373 - Critical (9.8)

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in `LivekitFrameSerializer` – an optional, non-default, undocumented frame serializ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-62373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-62373 - Critical (9.8)

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in `LivekitFrameSerializer` – an optional, non-default, undocumented frame serializ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-62373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34291 - High (8.7)

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network ac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34291/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33999 - High (7.8)

A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33999 - High (7.8)

A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40471 - Critical (9.6)

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative acti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40471 - Critical (9.6)

hackage-server lacked Cross-Site Request Forgery (CSRF) protection across its endpoints. Scripts on foreign sites could trigger requests to hackage server, possibly abusing latent credentials to upload packages or perform other administrative acti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40472 - Critical (9.9)

In hackage-server, user-controlled metadata from .cabal files are rendered into HTML
href attributes without proper sanitization, enabling stored
Cross-Site Scripting (XSS) attacks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40472/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40472 - Critical (9.9)

In hackage-server, user-controlled metadata from .cabal files are rendered into HTML
href attributes without proper sanitization, enabling stored
Cross-Site Scripting (XSS) attacks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40472/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2026-040
CODESYS EtherNetIP - Improper timeout handling

CODESYS EtherNet/IP is an add‑on for the CODESYS Development System that provides a fully integrated EtherNet/IP protocol stack along with diagnostic capabilities. A flaw in the EtherNet/IP adapter protocol stack library results in a vulnerability within the generated application code. When an EtherNet/IP adapter is configured, this vulnerable protocol stack is downloaded to and executed by CODESYS Control runtime systems.
#CVE CVE-2026-35225

https://certvde.com/en/advisories/vde-2026-040/
#oCSAF
#CSAF https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-04_vde-2026-040.json

#OT #Advisory VDE-2026-040
CODESYS EtherNetIP - Improper timeout handling

CODESYS EtherNet/IP is an add‑on for the CODESYS Development System that provides a fully integrated EtherNet/IP protocol stack along with diagnostic capabilities. A flaw in the EtherNet/IP adapter protocol stack library results in a vulnerability within the generated application code. When an EtherNet/IP adapter is configured, this vulnerable protocol stack is downloaded to and executed by CODESYS Control runtime systems.
#CVE CVE-2026-35225

https://certvde.com/en/advisories/vde-2026-040/
#oCSAF
#CSAF https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-04_vde-2026-040.json

🟠 CVE-2026-34001 - High (7.8)

A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34001 - High (7.8)

A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41460 - Critical (9.8)

SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoint where user-supplied input passed via the text parameter is not sanitized before being incorporated into a SQL query. An unaut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41460/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41460 - Critical (9.8)

SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoint where user-supplied input passed via the text parameter is not sanitized before being incorporated into a SQL query. An unaut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41460/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41679 - Critical (10)

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance runnin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41679/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 New security advisory:

CVE-2026-41679 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-41679-paperclip-unauthenticated-remote-code-execution

#InfoSec #ZeroDay #ThreatIntel

🔴 CVE-2026-41679 - Critical (10)

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance runnin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41679/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-41679 in Paperclip (<2026.416.0) enables unauthenticated remote code execution via API chain — no user creds needed. Upgrade to 2026.416.0+ ASAP! Full details: https://radar.offseq.com/threat/cve-2026-41679-cwe-287-improper-authentication-in--09e9d7e4 #OffSeq #CVE202641679 #infosec #rce

🟠 CVE-2026-41461 - High (8.5)

SocialEngine versions 7.8.0 and prior contain a blind server-side request forgery vulnerability in the /core/link/preview endpoint where user-supplied input passed via the uri request parameter is not sanitized before being used to construct outbo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41461/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41461 - High (8.5)

SocialEngine versions 7.8.0 and prior contain a blind server-side request forgery vulnerability in the /core/link/preview endpoint where user-supplied input passed via the uri request parameter is not sanitized before being used to construct outbo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41461/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34297 - High (7.5)

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34297/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34297 - High (7.5)

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34297/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ Microsoft Defender Elevation of Privilege Vulnerability
Description

🛡️ Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

https://www.cve.org/CVERecord?id=CVE-2026-33825

#Cybersecurity #CISA #Security #Microsoft

Just in: CVE-2026-33825 "BlueHammer" just hit the CISA KEV. Meanwhile, I'm not near my Windows PC, so I'm not sure if the Red Sun still prevails.

🛡️ Microsoft Defender Elevation of Privilege Vulnerability
Description

🛡️ Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

https://www.cve.org/CVERecord?id=CVE-2026-33825

#Cybersecurity #CISA #Security #Microsoft

Just in: CVE-2026-33825 "BlueHammer" just hit the CISA KEV. Meanwhile, I'm not near my Windows PC, so I'm not sure if the Red Sun still prevails.

🚨 [CISA-2026:0422] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0422)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-33825 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-33825)
- Name: Microsoft Defender Insufficient Granularity of Access Control Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Defender
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33825

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260422 #cisa20260422 #cve_2026_33825 #cve202633825

CVE ID: CVE-2026-33825
Vendor: Microsoft
Product: Defender
Date Added: 2026-04-22
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33825

🔴 CVE-2026-40470 - Critical (9.9)

A critical XSS vulnerability affected hackage-server and
hackage.haskell.org. HTML and JavaScript files provided in source
packages or via the documentation upload facility were served
as-is on the main hackage.haskell.org domain. As a consequen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40470/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40470 - Critical (9.9)

A critical XSS vulnerability affected hackage-server and
hackage.haskell.org. HTML and JavaScript files provided in source
packages or via the documentation upload facility were served
as-is on the main hackage.haskell.org domain. As a consequen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40470/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34003 - High (7.8)

A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34003/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34003 - High (7.8)

A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34003/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-23751 - Critical (9.8)

Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-23751 - Critical (9.8)

Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecated .NET Remoting HTTP channel on port 2424 via the Ascent Capture Service that is accessible without authentication and uses a d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31018 - High (8.8)

In Dolibarr ERP & CRM &lt;= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31018/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40869 - High (7.5)

Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who hav...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40869/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40931 - High (8.4)

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Broadcom has three critical listings today: https://support.broadcom.com/web/ecx/security-advisory

- Datacom Health Check Analyzer 1.1 Vulnerability
- IDMS Server: OpenSSL Vulnerability CVE-2026-28386
- MICS REST API SERVER - 14.5 Vulnerability in Spring Security

Also:

Cisco has a critical advisory:

- CVE-2026-20122; CVE-2026-20126 and CVE-2026-20128: Cisco Catalyst SD-WAN Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v

Cisco has also tagged 7Zip and Adobe for zero-day reports https://talosintelligence.com/vulnerability_info @TalosSecurity #infoec #Broadcom #vulnerability #zeroday #Adobe

🔴 CVE-2026-39440 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC FunnelFormsPro allows Remote Code Inclusion.This issue affects FunnelFormsPro: from n/a through 3.8.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39440/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-39440 - Critical (9.9)

Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC FunnelFormsPro allows Remote Code Inclusion.This issue affects FunnelFormsPro: from n/a through 3.8.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39440/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Five critical self-hosted flaws landed April 20-22. Marimo pre-auth remote takeover (CVE-2026-39987, CVSS 9.3), exploited in 10 hours. Apache Airflow XCom. Spinnaker Echo. Jellystat SQL injection to takeover (CVE-2026-41167, 9.1). OpenVPN 2.7.2 fixed two. Three trace to injection. Across 14 compliant platforms I have architected, the audit finding is patch cadence, not availability. A 10-hour window makes quarterly cadence a breach timeline.

#CyberSecurity #SelfHosted #OpenSource #InfoSec

🚨 CRITICAL: CyferShepard Jellystat <1.1.10 vulnerable to SQL injection (CVE-2026-41167). Auth’d users can read any DB table & execute commands on the PostgreSQL host. Upgrade to 1.1.10 ASAP! https://radar.offseq.com/threat/cve-2026-41167-cwe-89-improper-neutralization-of-s-51b08aed #OffSeq #Jellystat #SQLi #Infosec

🔴 CVE-2026-41167 - Critical (9.1)

Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40882 - High (7.6)

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Microsoft a publié un patch pour une faille critique dans ASP.NET : CVE-2026-40372 https://www.it-connect.fr/microsoft-a-publie-un-patch-pour-une-faille-critique-dans-asp-net-cve-2026-40372/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft

#Microsoft corrige de urgencia un fallo crítico en ASP.NET Core Data Protection (CVE-2026-40372)

https://unaaldia.hispasec.com/2026/04/microsoft-corrige-de-urgencia-un-fallo-critico-en-asp-net-core-data-protection-cve-2026-40372-2.html?utm_source=rss&amp

Microsoft a publié un patch pour une faille critique dans ASP.NET : CVE-2026-40372 https://www.it-connect.fr/microsoft-a-publie-un-patch-pour-une-faille-critique-dans-asp-net-cve-2026-40372/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft

Microsoft Issues Emergency Patches for Critical ASP.NET Core Cryptographic Flaw

Microsoft released emergency patches for a critical ASP.NET Core vulnerability (CVE-2026-40372) that allows unauthenticated attackers to forge authentication cookies and gain SYSTEM privileges. The flaw primarily affects applications on Linux and macOS using specific versions of the Data Protection NuGet package.

**If you're running ASP.NET Core apps using the Microsoft.AspNetCore.DataProtection NuGet package (versions 10.0.0 through 10.0.6), especially on Linux or macOS, upgrade immediately to version 10.0.7 and redeploy your applications. After updating, rotate the DataProtection key ring to invalidate any forged tokens or sessions that may have been issued during the vulnerable window.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/microsoft-issues-emergency-patches-for-critical-asp-net-core-cryptographic-flaw-0-1-8-4-c/gD2P6Ple2L

If you missed this. Microsoft posted this patch yesterday:

ASP.NET Core Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40372

More:

The Hacker News: Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug https://thehackernews.com/2026/04/microsoft-patches-critical-aspnet-core.html @thehackernews #Microsoft #infosec #vulnerability

CVE-2026-40372 in ASP.NET Core enables privilege escalation via cryptographic validation flaws.
Patch released - but token persistence risk remains without key rotation.

Source: https://thehackernews.com/2026/04/microsoft-patches-critical-aspnet-core.html

Follow TechNadu. Insights? 👇

#Infosec #Microsoft #Vulnerability

🔴 CVE-2026-40372 - Critical (9.1)

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35251 - High (7.5)

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure wh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35251/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35230 - High (7.5)

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure wh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35230/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6887 - Critical (9.8)

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6887/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6887 - Critical (9.8)

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6887/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL SQL Injection (CVE-2026-6887) in BorG SPM 2007: unauthenticated remote attackers can manipulate databases. No patch, product EOL. Isolate or discontinue use ASAP. Details: https://radar.offseq.com/threat/cve-2026-6887-cwe-89-improper-neutralization-of-sp-f0a62364 #OffSeq #SQLInjection #Vuln #InfoSec

🔴 CVE-2026-6887 - Critical (9.8)

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6887/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6887 - Critical (9.8)

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6887/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL SQL Injection (CVE-2026-6887) in BorG SPM 2007: unauthenticated remote attackers can manipulate databases. No patch, product EOL. Isolate or discontinue use ASAP. Details: https://radar.offseq.com/threat/cve-2026-6887-cwe-89-improper-neutralization-of-sp-f0a62364 #OffSeq #SQLInjection #Vuln #InfoSec

🟠 CVE-2026-6903 - High (7.5)

The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthenticated attacker could exploit this vulnerability to read arbitrary files on the host system that are acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6903/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6903 - High (7.5)

The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access functionality. An unauthenticated attacker could exploit this vulnerability to read arbitrary files on the host system that are acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6903/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6886 - Critical (9.8)

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attackers to log into the system as any user.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6886 - Critical (9.8)

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attackers to log into the system as any user.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6885 - Critical (9.8)

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6885/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6885 - Critical (9.8)

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6885/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34285 - Critical (9.1)

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34287 - Critical (9.1)

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41040 - High (7.5)

GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41040/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41040 - High (7.5)

GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41040/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41040 - High (7.5)

GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41040/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41040 - High (7.5)

GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41040/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3844 - Critical (9.8)

The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3844/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3844 - Critical (9.8)

The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3844/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚩 CVE-2026-3844 (CRITICAL): Breeze Cache ≤2.4.4 lets unauthenticated attackers upload arbitrary files via 'fetch_gravatar_from_remote' if "Host Files Locally - Gravatars" is enabled. RCE possible. Check settings & update! https://radar.offseq.com/threat/cve-2026-3844-cwe-434-unrestricted-upload-of-file--8e6074b3 #OffSeq #WordPress #infosec

🔴 CVE-2026-41196: luanti 5.0.0 – 5.15.1 has a CRITICAL code injection vuln (CVSS 9.0). Malicious mods can break Lua sandbox with LuaJIT, gaining full filesystem access. Patch: upgrade to 5.15.2 or mitigate via getfenv = nil. https://radar.offseq.com/threat/cve-2026-41196-cwe-94-improper-control-of-generati-70ec6155 #OffSeq #CVE202641196 #vuln

🟠 CVE-2026-41455 - High (8.5)

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the url schema field accepts any string without protocol restriction or destination validation. Attackers who can create or modify in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41455/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41454 - High (8.3)

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification. Attackers can enumerate integr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41454/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41175 - High (8.1)

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and REST API endpoints, or arguments in GraphQL queries, could result in the loss of conten...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41175/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40517 - High (7.8)

radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with newline characters in symbol names. Attackers ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40517/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛑 CVE-2026-41468: Beghelli SicuroWeb (Sicuro24) uses unmaintained AngularJS 1.5.2, allowing network-adjacent attackers to hijack sessions via MITM and template injection. Enforce HTTPS, monitor activity. No patch yet. More: https://radar.offseq.com/threat/cve-2026-41468-cwe-1104-use-of-unmaintained-third--1563ff90 #OffSeq #CVE202641468 #infosec

🛑 CVE-2026-41468: Beghelli SicuroWeb (Sicuro24) uses unmaintained AngularJS 1.5.2, allowing network-adjacent attackers to hijack sessions via MITM and template injection. Enforce HTTPS, monitor activity. No patch yet. More: https://radar.offseq.com/threat/cve-2026-41468-cwe-1104-use-of-unmaintained-third--1563ff90 #OffSeq #CVE202641468 #infosec

🟠 CVE-2026-41468 - High (8.7)

Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing known sandbox escape primitives. When combined with template injection present in the same application, these primitives allow attackers to escape the AngularJ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41468/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: xerteonlinetoolkits ≤3.15 has incomplete input validation in elFinder — .php4 files can be uploaded & executed, enabling unauth RCE. Restrict endpoint, monitor uploads, apply custom filters. Patch status unknown. CVE-2026-34415 https://radar.offseq.com/threat/cve-2026-34415-cwe-184-incomplete-list-of-disallow-f774ae94 #OffSeq #Vuln #RCE

⚠️ CRITICAL: xerteonlinetoolkits ≤3.15 has incomplete input validation in elFinder — .php4 files can be uploaded & executed, enabling unauth RCE. Restrict endpoint, monitor uploads, apply custom filters. Patch status unknown. CVE-2026-34415 https://radar.offseq.com/threat/cve-2026-34415-cwe-184-incomplete-list-of-disallow-f774ae94 #OffSeq #Vuln #RCE

🔴 CVE-2026-34415 - Critical (9.8)

Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attacker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34415/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26354 - High (8.1)

Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.60, contain a stack-based Buffer...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26354/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 New security advisory:

CVE-2026-34275 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-34275-oracle-e-biz-unauth-takeover

#InfoSec #ZeroDay #ThreatIntel

🚨 CVE-2026-40911: WWBN AVideo <=29.0 CRITICAL code injection via YPTSocket plugin. Unauthenticated attacker can execute JS on all connected clients, risking account takeover. Patch with commit c08694bf ASAP. https://radar.offseq.com/threat/cve-2026-40911-cwe-94-improper-control-of-generati-3a34b5ff #OffSeq #CVE202640911 #infosec #security

🔴 CVE-2026-40911 - Critical (10)

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields. On the clie...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40911/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: ElectricSQL (v1.1.12 - <1.5.0) has a CVE-2026-40906 SQL injection in /v1/shape API. Authenticated users can fully compromise PostgreSQL DB. Upgrade to 1.5.0+ now! https://radar.offseq.com/threat/cve-2026-40906-cwe-89-improper-neutralization-of-s-06dc3129 #OffSeq #SQLInjection #ElectricSQL #InfoSec

🔴 CVE-2026-40906 - Critical (9.9)

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40906/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40906 - Critical (9.9)

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40906/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35229 - High (7.5)

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.30 and 21.3-21.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35229/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40884 - Critical (9.8)

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accept...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40884/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24189 - High (8.2)

NVIDIA CUDA-Q contains a vulnerability in an endpoint, where an unauthenticated attacker could cause an out-of-bounds read by sending a maliciously crafted request. A successful exploit of this vulnerability might lead to denial of service and inf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24189/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24177 - High (7.7)

NVIDIA KAI Scheduler contains a vulnerability where an attacker could access API endpoints without authorization. A successful exploit of this vulnerability might lead to information disclosure.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24177/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40868 - High (8.1)

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40868/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Here's a harmless little #PoC for the #PackageKit LPE vulnerability (CVE-2026-41651), by @brezel@infosec.exchange and myself: https://codeberg.org/hillu/cve-2026-41651-poc
It was a lot of fun to piece together.

📢 CVE-2026-41651 : Élévation de privilèges locale cross-distro via PackageKit (Pack2TheRoot)
📝 ## 🔍 Contexte

Publié le 22 avril 2026 par l'équipe Red Team de Deutsche Telekom sur leur blog séc...
📖 cyberveille : https://cyberveille.ch/posts/2026-04-23-cve-2026-41651-elevation-de-privileges-locale-cross-distro-via-packagekit-pack2theroot/
🌐 source : https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html
#CVE_2026_41651 #IOC #Cyberveille

Here's a harmless little #PoC for the #PackageKit LPE vulnerability (CVE-2026-41651), by @brezel@infosec.exchange and myself: https://codeberg.org/hillu/cve-2026-41651-poc
It was a lot of fun to piece together.

📢 CVE-2026-41651 : Élévation de privilèges locale cross-distro via PackageKit (Pack2TheRoot)
📝 ## 🔍 Contexte

Publié le 22 avril 2026 par l'équipe Red Team de Deutsche Telekom sur leur blog séc...
📖 cyberveille : https://cyberveille.ch/posts/2026-04-23-cve-2026-41651-elevation-de-privileges-locale-cross-distro-via-packagekit-pack2theroot/
🌐 source : https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html
#CVE_2026_41651 #IOC #Cyberveille

Pack2TheRoot (CVE-2026-41651): Cross-Distro Local Privilege Escalation Vulnerability https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html

🟠 CVE-2026-41651 - High (8.8)

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41651/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Forgot your root password? No problem! With #PackageKit <= 1.3.4 you can do all the fun root action on any Linux system you have local access to, no privileges required!

Don't like that? Then PLEASE UPDATE your system ASAP to PackageKit >= 1.3.5 or any fixed distro package. Fixes for this vulnerability should already be available everywhere since today.

You can read more about CVE-2026-41651 on the security researcher's blog:
https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html

#pack2theroot #osssecurity

There is a great report out there by @dtcert

Telekom Red Team (great work guys) found a high severity LPE vulnerability in PackageKit daemon. In the report the distros of Ubuntu, Debian and Fedora and some more are mentioned as affected. Some left traces to hunt for the exploitation comes with the report, which is helpful.

edit: now known as CVE-2026-41651

https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html

Pack2TheRoot: Cross-Distro LPE in PackageKit

CVE: CVE-2026-41651
CVSS3: 8.8

https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html

#privescalation #CVE_2026_41651 #vulnerability

🔥 CRITICAL vuln in nimiq-block (<1.3.0): Flawed input validation in SkipBlockProof::verify lets attackers bypass PoS quorum using crafted indices. Patch in v1.3.0 — upgrade ASAP! CVE-2026-33471 https://radar.offseq.com/threat/cve-2026-33471-cwe-20-improper-input-validation-in-2bd8708b #OffSeq #Rust #Security #Blockchain

🔴 CVE-2026-33471 - Critical (9.6)

nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::verify` computes its quorum check using `BitSet.len()`, then iterates `BitSet` indices and casts each `usize` index to `u16` (`slot as u16`) for slot...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41059 - High (8.2)

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 have a configuration-dependent authentication bypass. Deployments are affected when all of the following are true: Use of `skip_auth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40575 - Critical (9.1)

OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions 7.5.0 through 7.15.1 may trust a client-supplied `X-Forwarded-Uri` header when `--reverse-proxy` is enabled and `--skip-auth-regex` or `--skip-auth-route...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41133 - High (8.8)

pyLoad is a free and open-source download manager written in Python. Versions up to and including 0.5.0b3.dev97 cache `role` and `permission` in the session at login and continues to authorize requests using these cached values, even after an admi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41133/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22754 - High (7.5)

Vulnerability in Spring Spring Security. If an application uses  to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorizat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22754/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22753 - High (7.5)

Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a PathPatternRequestMatcher.Builder bean to prepend a servlet path, matching requests to that filter chain may fail and its related security compo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22753/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6023 - High (8.1)

In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization when restoring filter state if the state is exposed to the client. If an attacker tampers with this state,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6023/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34065 - High (7.5)

nimiq-primitives contains primitives (e.g., block, account, transaction) to be used in Nimiq's Rust implementation. Prior to version 1.3.0, an untrusted p2p peer can cause a node to panic by announcing an election macro block whose `validators` se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34065/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6846 - High (7.8)

A flaw was found in binutils. A heap-buffer-overflow vulnerability exists when processing a specially crafted XCOFF (Extended Common Object File Format) object file during linking. A local attacker could trick a user into processing this malicious...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6846/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6859 - High (8.8)

A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from HuggingFace. This allows a remote attacker to achieve arbitrary Python code execution by convincing a user to run `ilab train/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6859/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35548 - High (8.5)

An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored database credentials to be reused after modification of the target Host, IP address, or P...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35548/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41060 - High (7.7)

WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41060/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6832 - High (8.1)

Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authenticated attackers to delete files outside the session directory by supplying an absolute path or path traversal payload in the ses...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40925 - High (8.3)

WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists dozens of global site settings from `$_POST` but protects the endpoint only with `User::isA...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6823 - High (8.2)

HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permitting arbitrary remote senders to pass admission checks. Attackers who can reach the conf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6823/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34413 - High (8.6)

Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die()...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34413/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40568 - High (8.5)

FreeScout is a free self-hosted help desk and shared mailbox. Versions prior to 1.8.213 have a stored cross-site scripting (XSS) vulnerability in the mailbox signature feature. The sanitization function `Helper::stripDangerousTags()` (`app/Misc/He...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40568/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40870 - High (7.5)

Decidim is a participatory democracy framework. Starting in version 0.0.1 and prior to versions 0.30.5 and 0.31.1, the root level `commentable` field in the API allows access to all commentable resources within the platform, without any permission...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40870/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40887 - Critical (9.1)

Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40887/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 CVE-2026-40946 (CRITICAL, CVSS 9.2): oxia-db oxia < 0.16.2 improperly authenticates OIDC tokens, accepting tokens from other services. Upgrade to 0.16.2+ ASAP. No exploits seen. https://radar.offseq.com/threat/cve-2026-40946-cwe-287-improper-authentication-in--d724c488 #OffSeq #oxia #infosec #OIDC

🟠 CVE-2026-41135 - High (7.5)

free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. A memory leak vulnerability in versions prior to 1.4.3 allows any unauthenticated attacker with network access to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41135/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40937 - High (8.3)

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions` helper that validates authentication only (acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40937/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5262 - High (8)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.1.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an unauthenticated user to access tokens in the Storyb...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5262/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4922 - High (8.1)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an unauthenticated user to execute GraphQL mutations on behalf of authenticated u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

https://www.cve.org/CVERecord?id=CVE-2026-35344

https://www.cve.org/CVERecord?id=CVE-2026-35344

⛔ New security advisory:

CVE-2018-25270 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2018-25270-thinkphp-5-0-23-unauthenticated-remote-code-execution

#Cybersecurity #VulnerabilityManagement #CyberSec

🟠 CVE-2026-35368 - High (7.8)

A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35368/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35246 - High (7.5)

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure wh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35246/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35245 - High (7.5)

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via RDP to compro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35245/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35242 - High (7.5)

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure wh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35242/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35242 - High (7.5)

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure wh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35242/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35243 - High (7.8)

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35243/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34309 - High (8.1)

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61-8.62. Easily exploitable vulnerability allows low privileged attacker with network access via...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34309/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35231 - High (7.5)

Vulnerability in the Oracle Financial Services Transaction Filtering product of Oracle Financial Services Applications (component: User Interface). The supported version that is affected is 8.1.2.8.0. Easily exploitable vulnerability allows unau...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35231/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34310 - High (7.5)

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploita...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34310/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34320 - High (7.5)

Vulnerability in the Oracle Financial Services Customer Screening product of Oracle Financial Services Applications (component: User Interface). The supported version that is affected is 8.1.2.8.0. Easily exploitable vulnerability allows unauthe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34320/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5398 - High (8.4)

The implementation of TIOCNOTTY failed to clear a back-pointer from the structure representing the controlling terminal to the calling process' session. If the invoking process then exits, the terminal structure may end up containing a pointer to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34290 - High (7.5)

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6356 - Critical (9.6)

A vulnerability in the web application allows standard users to escalate their privileges to those of a super administrator through parameter manipulation, enabling them to access and modify sensitive information.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6356/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33593 - High (7.5)

A client can trigger a divide by zero error leading to crash by sending a crafted DNSCrypt query.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33593/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6857 - High (7.5)

A flaw was found in camel-infinispan. This vulnerability involves unsafe deserialization in the ProtoStream remote aggregation repository. A remote attacker with low privileges could exploit this by sending specially crafted data, leading to arbit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34305 - High (7.5)

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34305/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34305 - High (7.5)

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34305/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34279 - Critical (9.1)

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34286 - Critical (9.1)

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34286 - Critical (9.1)

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack