🟠 CVE-2026-7160 - High (8.8)

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed fro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7160 - High (8.8)

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed fro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7155 - Critical (9.8)

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass leads to os c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7155 - Critical (9.8)

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass leads to os c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7154 - Critical (9.8)

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument tty_server can lead to os...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7154/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7154 - Critical (9.8)

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument tty_server can lead to os...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7154/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7151 - High (8.8)

A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipulation of the argument destNet causes stack-based buffer overflow. It is possible to initiate the attack re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7151 - High (8.8)

A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipulation of the argument destNet causes stack-based buffer overflow. It is possible to initiate the attack re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7153 - Critical (9.8)

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sys_in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7153/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7153 - Critical (9.8)

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sys_in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7153/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7152 - Critical (9.8)

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7152 - Critical (9.8)

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6741 - High (8.8)

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the con...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6741/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6741 - High (8.8)

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the con...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6741/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30350 - High (7.5)

An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30350/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30350 - High (7.5)

An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30350/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) is vulnerable to OS command injection (CVE-2026-7156, CVSS 9.3). Exploit is public — remote attackers can fully compromise devices. Disable remote mgmt & restrict access now. https://radar.offseq.com/threat/cve-2026-7156-os-command-injection-in-totolink-a80-8abcd97a #OffSeq #CVE20267156 #IoTSecurity

🔴 CVE-2026-7156 - Critical (9.8)

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7156/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) is vulnerable to OS command injection (CVE-2026-7156, CVSS 9.3). Exploit is public — remote attackers can fully compromise devices. Disable remote mgmt & restrict access now. https://radar.offseq.com/threat/cve-2026-7156-os-command-injection-in-totolink-a80-8abcd97a #OffSeq #CVE20267156 #IoTSecurity

🔴 CVE-2026-7156 - Critical (9.8)

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7156/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42039 - High (7.5)

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a Range...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42039 - High (7.5)

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a Range...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30351 - High (7.5)

A path traversal vulnerability in the UI/static component of leonvanzyl autocoder commit 79d02a allows attackers to read arbitrary files via sending crafted URL path containing traversal sequences.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30351/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30351 - High (7.5)

A path traversal vulnerability in the UI/static component of leonvanzyl autocoder commit 79d02a allows attackers to read arbitrary files via sending crafted URL path containing traversal sequences.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30351/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41419 - High (7.6)

4ga Boards is a boards system for realtime project management. Prior to 3.3.5, a path traversal vulnerability allows an authenticated user with board import privileges to make the server ingest arbitrary host files as board attachments during BOAR...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41419/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40858 - High (8.8)

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinis...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-40858 in Apache Camel's camel-infinispan lets attackers with cache write access trigger arbitrary code execution. Patch to 4.20.0/4.14.7/4.18.2 ASAP! More info: https://radar.offseq.com/threat/cve-2026-40858-cwe-502-deserialization-of-untruste-52424157 #OffSeq #ApacheCamel #Infosec #CVE2026_40858

🟠 CVE-2026-40858 - High (8.8)

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinis...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-40858 in Apache Camel's camel-infinispan lets attackers with cache write access trigger arbitrary code execution. Patch to 4.20.0/4.14.7/4.18.2 ASAP! More info: https://radar.offseq.com/threat/cve-2026-40858-cwe-502-deserialization-of-untruste-52424157 #OffSeq #ApacheCamel #Infosec #CVE2026_40858

🟠 CVE-2026-5940 - High (7.8)

Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5940 - High (7.8)

Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program crashes.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

If you're using plug_cowboy, update to the newly-released v2.8.1 to patch a denial-of-service vulnerability related to atom exhaustion.

https://cna.erlef.org/cves/CVE-2026-32688.html

#ElixirLang

🔴 CVE-2026-41409 - Critical (9.8)

The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41409/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41409 - Critical (9.8)

The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read might already have been exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41409/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 New security advisory:

CVE-2026-6785 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-6785-firefox-memory-corruption-can-run-code

#CVE #ZeroDay #ThreatIntel

🟠 CVE-2026-6785 - High (8.1)

Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: Tenda F456 (v1.0.0.5) buffer overflow in httpd's fromPPTPUserSetting (CVE-2026-7080) enables remote code execution or DoS. No patch yet — restrict device exposure & monitor for updates. Details: https://radar.offseq.com/threat/cve-2026-7080-buffer-overflow-in-tenda-f456-6bb8799d #OffSeq #infosec #CVE20267080

⚠️ HIGH severity: Tenda F456 (v1.0.0.5) buffer overflow in httpd's fromPPTPUserSetting (CVE-2026-7080) enables remote code execution or DoS. No patch yet — restrict device exposure & monitor for updates. Details: https://radar.offseq.com/threat/cve-2026-7080-buffer-overflow-in-tenda-f456-6bb8799d #OffSeq #infosec #CVE20267080

🟠 CVE-2026-7080 - High (8.8)

A security vulnerability has been detected in Tenda F456 1.0.0.5. This impacts the function fromPPTPUserSetting of the file /goform/PPTPUserSetting of the component httpd. Such manipulation of the argument delno leads to buffer overflow. The attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7097 - High (8.8)

A weakness has been identified in Tenda F456 1.0.0.5. This issue affects the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter of the component httpd. This manipulation of the argument page causes buffer overflow. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7097/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7097 - High (8.8)

A weakness has been identified in Tenda F456 1.0.0.5. This issue affects the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter of the component httpd. This manipulation of the argument page causes buffer overflow. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7097/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7096 - High (8.8)

A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. The manipulation of the argument fmgpon_loid results in os command injection. It is possi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7096/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7096 - High (8.8)

A security flaw has been discovered in Tenda HG3 2.0 300003070. This vulnerability affects the function formgponConf of the file /boaform/admin/formgponConf. The manipulation of the argument fmgpon_loid results in os command injection. It is possi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7096/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: CVE-2026-3868 affects Moxa EDR-8010 v1.0 routers. Remote attackers can trigger a DoS via HTTPS mgmt interface buffer overflow. No patch yet — restrict access & monitor for outages. https://radar.offseq.com/threat/cve-2026-3868-cwe-130-improper-handling-of-length--680be2d5 #OffSeq #Moxa #Infosec #ICS

⚠️ HIGH severity: CVE-2026-3868 affects Moxa EDR-8010 v1.0 routers. Remote attackers can trigger a DoS via HTTPS mgmt interface buffer overflow. No patch yet — restrict access & monitor for outages. https://radar.offseq.com/threat/cve-2026-3868-cwe-130-improper-handling-of-length--680be2d5 #OffSeq #Moxa #Infosec #ICS

🟠 CVE-2026-7056 - High (8.8)

A vulnerability was detected in Tenda F456 1.0.0.5. Impacted is the function fromSafeUrlFilter of the file /goform/SafeUrlFilter of the component httpd. The manipulation of the argument page results in buffer overflow. The attack may be performed ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7057 - High (8.8)

A flaw has been found in Tenda F456 1.0.0.5. The affected element is an unknown function of the file /goform/setcfm of the component httpd. This manipulation of the argument funcname/funcpara1 causes buffer overflow. It is possible to initiate the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7057/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7035 - High (8.8)

A vulnerability was determined in Tenda FH1202 1.2.0.14. This affects the function fromWrlclientSet of the file /goform/WrlclientSet of the component httpd. Executing a manipulation of the argument Go can lead to stack-based buffer overflow. The a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7035/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7029 - High (8.8)

A weakness has been identified in Tenda F456 1.0.0.5. The impacted element is the function fromaddressNat of the file /goform/addressNat. Executing a manipulation of the argument menufacturer/Go can lead to buffer overflow. The attack may be perfo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7029/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

MEDIUM severity alert: CVE-2026-7026 in D-Link DGS-3420 v1.50.018 allows remote XSS via System Info Settings Page. Exploit is public. Assess your devices and monitor for abuse. https://radar.offseq.com/threat/cve-2026-7026-cross-site-scripting-in-d-link-dgs-3-10e9ee49 #OffSeq #DLink #Vuln #XSS

⚠️ HIGH severity: Tenda HG10 (HG7_HG9_HG10re_300001138_en_xpon) buffer overflow via Boa Service (formRoute). Remote RCE/DoS risk. Exploit public, patch pending. Restrict access & monitor Tenda updates. CVE-2026-6988 https://radar.offseq.com/threat/cve-2026-6988-buffer-overflow-in-tenda-hg10-324a24f1 #OffSeq #IoT #Vuln

🟠 CVE-2026-6988 - High (8.8)

A flaw has been found in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon. This issue affects the function formRoute of the file /boaform/formRouting of the component Boa Service. This manipulation of the argument nextHop causes buffer overflow. It is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-41328: CRITICAL DQL injection in dgraph-io Dgraph (<25.3.3) allows unauthenticated full DB read! Exploit via crafted POSTs to port 8080. Patch to 25.3.3+ or enable ACL to mitigate. Details: https://radar.offseq.com/threat/cve-2026-41328-cwe-943-improper-neutralization-of--c8d19cb1 #OffSeq #CVE202641328 #GraphQL #infosec

🔴 CVE-2026-41328 - Critical (9.1)

Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, a vulnerability has been found in Dgraph that gives an unauthenticated attacker full read access to every piece of data in the database. This affects Dgraph's default configur...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41328/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-41248 affects clerk astro, nextjs, nuxt — lets attackers bypass middleware in affected JS libs. Update to fixed versions ASAP to prevent unauthorized access. Patches available now. https://radar.offseq.com/threat/cve-2026-41248-cwe-436-interpretation-conflict-in--1e1431c1 #OffSeq #Vulnerability #ClerkJS

🔴 CVE-2026-41248 - Critical (9.1)

Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middleware gating and reach down...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41248/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42171 - High (7.8)

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the referenc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42171/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41478 - Critical (9.9)

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcorn’s mobile-sync routes allows any authenticated low-privilege user with read access to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41478/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41477 - High (7.8)

Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and exposes an IPC named pipe with WorldAccessOption enabled. The daemon processes privileged commands without authentication, allowi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41477/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22337 - Critical (9.8)

Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22337/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22337 - Critical (9.8)

Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22337/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42379 - High (7.7)

Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue affects Templately: from n/a through 3.6.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42379/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42379 - High (7.7)

Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue affects Templately: from n/a through 3.6.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42379/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7122 - Critical (9.8)

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7122/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7122 - Critical (9.8)

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7122/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7136 - Critical (9.8)

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wanIdx can lead to os ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7136/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7136 - Critical (9.8)

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wanIdx can lead to os ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7136/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31673 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

af_unix: read UNIX_DIAG_VFS data under unix_state_lock

Exact UNIX diag lookups hold a reference to the socket, but not to
u->path. Meanwhile, unix_release_sock() clears u->path ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31673 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

af_unix: read UNIX_DIAG_VFS data under unix_state_lock

Exact UNIX diag lookups hold a reference to the socket, but not to
u->path. Meanwhile, unix_release_sock() clears u->path ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31682 - Critical (9.1)

In the Linux kernel, the following vulnerability has been resolved:

bridge: br_nd_send: linearize skb before parsing ND options

br_nd_send() parses neighbour discovery options from ns->opt[] and
assumes that these options are in the linear part ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31682/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31682 - Critical (9.1)

In the Linux kernel, the following vulnerability has been resolved:

bridge: br_nd_send: linearize skb before parsing ND options

br_nd_send() parses neighbour discovery options from ns->opt[] and
assumes that these options are in the linear part ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31682/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31680 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: flowlabel: defer exclusive option free until RCU teardown

`ip6fl_seq_show()` walks the global flowlabel hash under the seq-file
RCU read-side lock and prints `fl->opt...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31680 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: flowlabel: defer exclusive option free until RCU teardown

`ip6fl_seq_show()` walks the global flowlabel hash under the seq-file
RCU read-side lock and prints `fl->opt...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31678 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: defer tunnel netdev_put to RCU release

ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already
detached the device. Dropping the netdev reference in des...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31678/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31678 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: defer tunnel netdev_put to RCU release

ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already
detached the device. Dropping the netdev reference in des...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31678/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31676 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: only handle RESPONSE during service challenge

Only process RESPONSE packets while the service connection is still in
RXRPC_CONN_SERVICE_CHALLENGING. Check that state unde...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31676/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31676 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: only handle RESPONSE during service challenge

Only process RESPONSE packets while the service connection is still in
RXRPC_CONN_SERVICE_CHALLENGING. Check that state unde...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31676/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31675 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_netem: fix out-of-bounds access in packet corruption

In netem_enqueue(), the packet corruption logic uses
get_random_u32_below(skb_headlen(skb)) to select an inde...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31675/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31675 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_netem: fix out-of-bounds access in packet corruption

In netem_enqueue(), the packet corruption logic uses
get_random_u32_below(skb_headlen(skb)) to select an inde...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31675/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31685 - Critical (9.4)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_eui64: reject invalid MAC header for all packets

`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address
and compares it with the low 64 bits of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31685/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31685 - Critical (9.4)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ip6t_eui64: reject invalid MAC header for all packets

`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address
and compares it with the low 64 bits of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31685/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31683 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: avoid OGM aggregation when skb tailroom is insufficient

When OGM aggregation state is toggled at runtime, an existing forwarded
packet may have been allocated with o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31683/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31683 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: avoid OGM aggregation when skb tailroom is insufficient

When OGM aggregation state is toggled at runtime, an existing forwarded
packet may have been allocated with o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31683/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-38934 - High (8.8)

Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-38934/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-38934 - High (8.8)

Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-38934/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-38934 - High (8.8)

Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-38934/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-38934 - High (8.8)

Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5. and before allows a remote attacker to escalate privileges and obtain sensitive information via the public/settings_process.php

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-38934/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7140 - Critical (9.8)

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument HTTP leads to os command injection. The at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7140/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7140 - Critical (9.8)

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument HTTP leads to os command injection. The at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7140/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7140 - Critical (9.8)

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument HTTP leads to os command injection. The at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7140/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7140 - Critical (9.8)

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument HTTP leads to os command injection. The at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7140/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7139 - Critical (9.8)

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mode causes os command injection. The a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7139/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7139 - Critical (9.8)

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mode causes os command injection. The a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7139/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41463 - High (8.8)

ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory by craftin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41463/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41463 - High (8.8)

ProjeQtor versions 7.0 through 12.4.3 contain a ZipSlip path traversal vulnerability in the plugin upload functionality that allows authenticated attackers with upload permissions to write files outside the intended extraction directory by craftin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41463/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7138 - Critical (9.8)

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument tz results in os command inject...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7138/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7138 - Critical (9.8)

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setNtpCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument tz results in os command inject...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7138/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7137 - Critical (9.8)

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument sambaEnabled leads to os co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7137/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7137 - Critical (9.8)

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument sambaEnabled leads to os co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7137/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69689 - High (8.8)

The Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog. The dialog processes user-supplied paths with elevated permissions, which can be exploited by a local attacker to perform actions with ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69689/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69689 - High (8.8)

The Fan Control application V251 contains an improper privilege handling vulnerability in its Open File Dialog. The dialog processes user-supplied paths with elevated permissions, which can be exploited by a local attacker to perform actions with ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69689/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30352 - Critical (9.8)

A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30352 - Critical (9.8)

A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41462 - Critical (9.8)

ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inje...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41462/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41462 - Critical (9.8)

ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inje...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41462/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33454 - Critical (9.4)

The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33454/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33454 - Critical (9.4)

The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33454/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40022 - High (8.2)

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the B...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40022/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40022 - High (8.2)

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the B...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40022/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41635 - Critical (9.8)

Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.

The fix che...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41635/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41635 - Critical (9.8)

Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed.

The fix che...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41635/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40860 - Critical (9.8)

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40860/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40860 - Critical (9.8)

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40860/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40453 - Critical (9.9)

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was no...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40453 - Critical (9.9)

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was no...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40048 - High (7.8)

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.secu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40048/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40048 - High (7.8)

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.secu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40048/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41066 - High (7.5)

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_ent...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41066/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Apple Notfall-Update gegen Datenschutz-Loch

Apple hat gerade iOS/iPadOS 26.4.2 und iOS/iPadOS 18.7.8 veröffentlicht. Der einzige Zweck dieser Updates außer der Reihe besteht darin, die Sicherheitslücke CVE-2026-28950 zu schließen. Apple verschweigt (hier und hier), dass das FBI diese Lücke bereits ausgenutzt hat, um Informationen aus dem iPhone eines Verdächtigen auszulesen, die eigentlich geschützt sein sollten. Das geht so:

https://www.pc-fluesterer.info/wordpress/2026/04/27/apple-notfall-update-gegen-datenschutz-loch/

#Allgemein #Empfehlung #Hintergrund #Mobilfunk #Warnung #0day #apple #chat #datenschutz #ios #messenger #privacy #privatsphäre #sicherheit #spionage #UnplugApple #UnplugTrump #wissen

🟠 CVE-2026-40897 - High (8.8)

Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40897/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-04-20 - 2026-04-27)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1459

Severity:
- Critical: 124
- High: 358
- Medium: 586
- Low: 70
- None: 321

Status:
- : 40
- Analyzed: 313
- Awaiting Analysis: 570
- Deferred: 238
- Modified: 9
- Received: 124
- Rejected: 23
- Undergoing Analysis: 142

Top CNAs:
- GitHub, Inc.: 326
- kernel.org: 257
- VulnCheck: 119
- VulDB: 114
- Oracle: 102
- MITRE: 69
- Wordfence: 67
- Canonical Ltd.: 46
- Mozilla Corporation: 42
- N/A: 40

Top Affected Products:
- UNKNOWN: 1040
- Openclaw: 42
- Mozilla Firefox: 39
- Mozilla Thunderbird: 38
- Oracle Mysql Server: 25
- Wwbn Avideo: 18
- Flowiseai Flowise: 18
- Uutils Coreutils: 14
- Silextechnology Sd-330ac Firmware: 11
- Gitlab: 11

Top EPSS Score:
- CVE-2026-5965 - 6.34 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5965)
- CVE-2026-41179 - 5.98 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41179)
- CVE-2026-40887 - 4.56 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-40887)
- CVE-2026-38834 - 3.22 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-38834)
- CVE-2026-41176 - 2.79 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41176)
- CVE-2026-21571 - 1.10 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21571)
- CVE-2026-6799 - 1.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6799)
- CVE-2026-24467 - 0.76 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24467)
- CVE-2026-41472 - 0.67 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41472)
- CVE-2019-25714 - 0.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2019-25714)

🟠 CVE-2026-41433 - High (8.4)

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary ho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41433/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41428 - Critical (9.1)

Budibase is an open-source low-code platform. Prior to 3.35.4, the authenticated middleware uses unanchored regular expressions to match public (no-auth) endpoint patterns against ctx.request.url. Since ctx.request.url in Koa includes the query st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33453 - Critical (10)

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component.

Apache Camel's camel-coap component is vulnerable to Camel message header injection, leading to remote code executi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33453 - Critical (10)

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component.

Apache Camel's camel-coap component is vulnerable to Camel message header injection, leading to remote code executi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7124 - Critical (9.8)

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument addrPrefix...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7124 - Critical (9.8)

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument addrPrefix...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7123 - Critical (9.8)

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument setIptvCfg results in os command inject...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7123 - Critical (9.8)

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument setIptvCfg results in os command inject...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7125 - Critical (9.8)

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge leads to os command...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7125/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7125 - Critical (9.8)

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge leads to os command...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7125/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40473 - High (8.8)

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or U...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40473/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40473 - High (8.8)

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or U...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40473/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40473 - High (8.8)

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or U...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40473/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40473 - High (8.8)

The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. When a Camel route uses camel-mina as a TCP or U...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40473/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41208 - High (8.8)

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @paperclipai/server prior to 2026.416.0 contain a privilege escalation vulnerability that allows an attacker with an Agent API key to e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Ericsson CodeChecker (≤6.27.3) is vulnerable to CRITICAL auth bypass (CVE-2026-25660). Attackers can assign permissions via crafted URLs. Restrict access & monitor for changes. Patch not yet available. https://radar.offseq.com/threat/cve-2026-25660-cwe-290-authentication-bypass-by-sp-881e021f #OffSeq #vulnerability #CodeChecker #infosec

🟠 CVE-2026-5943 - High (7.8)

Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not properly maintained, leading to a crash when access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5943/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5943 - High (7.8)

Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered document modifications, object reference validity was not properly maintained, leading to a crash when access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5943/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7121 - Critical (9.8)

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument wizard causes os command injection. It is possib...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7121/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7121 - Critical (9.8)

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument wizard causes os command injection. It is possib...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7121/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7119 - High (8.8)

A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argument countrystr results in os command injection. The attack may be performed from remote. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7119 - High (8.8)

A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulation of the argument countrystr results in os command injection. The attack may be performed from remote. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5941 - High (7.8)

Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during internal data structure construction.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5941 - High (7.8)

Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leading to invalid memory writes and program crashes during internal data structure construction.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22336 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affects Directorist Booking: from n/a before 3.0.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22336/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22336 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affects Directorist Booking: from n/a before 3.0.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22336/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7101 - High (8.8)

A vulnerability has been found in Tenda F456 1.0.0.5. This affects the function fromWrlclientSet of the file /goform/WrlclientSet of the component httpd. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7101 - High (8.8)

A vulnerability has been found in Tenda F456 1.0.0.5. This affects the function fromWrlclientSet of the file /goform/WrlclientSet of the component httpd. The manipulation leads to buffer overflow. Remote exploitation of the attack is possible. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7100 - High (8.8)

A flaw has been found in Tenda F456 1.0.0.5. The impacted element is the function fromNatlimitof of the file /goform/Natlimit of the component httpd. Executing a manipulation can lead to buffer overflow. The attack may be launched remotely. The ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7100 - High (8.8)

A flaw has been found in Tenda F456 1.0.0.5. The impacted element is the function fromNatlimitof of the file /goform/Natlimit of the component httpd. Executing a manipulation can lead to buffer overflow. The attack may be launched remotely. The ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7099 - High (8.8)

A vulnerability was detected in Tenda F456 1.0.0.5. The affected element is the function formQuickIndex of the file /goform/QuickIndex of the component httpd. Performing a manipulation of the argument mit_linktype results in buffer overflow. The a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7099/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7099 - High (8.8)

A vulnerability was detected in Tenda F456 1.0.0.5. The affected element is the function formQuickIndex of the file /goform/QuickIndex of the component httpd. Performing a manipulation of the argument mit_linktype results in buffer overflow. The a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7099/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7098 - High (8.8)

A security vulnerability has been detected in Tenda F456 1.0.0.5. Impacted is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. Such manipulation of the argument page leads to buffer overflow. The attack ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7098/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7098 - High (8.8)

A security vulnerability has been detected in Tenda F456 1.0.0.5. Impacted is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. Such manipulation of the argument page leads to buffer overflow. The attack ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7098/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ CVE-2026-7081: HIGH-severity buffer overflow in Tenda F456 v1.0.0.5 (fromGstDhcpSetSer, httpd). Remote exploit possible, no patch yet. Limit remote access & watch for Tenda updates. Details: https://radar.offseq.com/threat/cve-2026-7081-buffer-overflow-in-tenda-f456-d90f75b6 #OffSeq #Vulnerability #Infosec #IoT

🛡️ CVE-2026-7081: HIGH-severity buffer overflow in Tenda F456 v1.0.0.5 (fromGstDhcpSetSer, httpd). Remote exploit possible, no patch yet. Limit remote access & watch for Tenda updates. Details: https://radar.offseq.com/threat/cve-2026-7081-buffer-overflow-in-tenda-f456-d90f75b6 #OffSeq #Vulnerability #Infosec #IoT

🟠 CVE-2026-7081 - High (8.8)

A vulnerability was detected in Tenda F456 1.0.0.5. Affected is the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer of the component httpd. Performing a manipulation of the argument dips results in buffer overflow. Remote exploitation...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7081/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-7082: HIGH severity buffer overflow in Tenda F456 v1.0.0.5 (formWrlExtraSet in httpd). Attack is remote and exploit is public. Audit exposure & restrict remote mgmt ASAP. https://radar.offseq.com/threat/cve-2026-7082-buffer-overflow-in-tenda-f456-cc536e34 #OffSeq #Vulnerability #Tenda #CVE20267082

🟠 CVE-2026-7082 - High (8.8)

A flaw has been found in Tenda F456 1.0.0.5. Affected by this vulnerability is the function formWrlExtraSet of the file /goform/WrlExtraSet of the component httpd. Executing a manipulation of the argument Go can lead to buffer overflow. The attack...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7082/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7079 - High (8.8)

A weakness has been identified in Tenda F456 1.0.0.5. This affects the function fromAdvSetWan of the file /goform/AdvSetWan of the component httpd. This manipulation of the argument wanmode causes buffer overflow. The attack may be initiated remot...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7079/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7078 - High (8.8)

A security flaw has been discovered in Tenda F456 1.0.0.5. The impacted element is the function fromSetIpBind of the file /goform/SetIpBind of the component httpd. The manipulation of the argument page results in buffer overflow. The attack can be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7078/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7106 - High (8.8)

The Highland Software Custom Role Manager plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 1.0.0. This is due to insufficient authorization checks in the hscrm_save_user_roles() function, which is hooked t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7069 - High (8)

A security flaw has been discovered in D-Link DIR-825 up to 3.00b32. This impacts the function AddPortMapping of the file upnpsoap.c of the component miniupnpd. Performing a manipulation of the argument NewPortMappingDescription results in buffer ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7069/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7068 - High (8.8)

A vulnerability was identified in D-Link DIR-825 3.00b32. This affects the function NMBD_process of the file sserver.c of the component nmbd. Such manipulation leads to buffer overflow. The attack can only be initiated within the local network. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7068/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7055 - High (8.8)

A security vulnerability has been detected in Tenda F456 1.0.0.5. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component httpd. The manipulation of the argument menufacturer/Go leads to buffer overflow. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7055/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7054 - High (8.8)

A weakness has been identified in Tenda F456 1.0.0.5. This vulnerability affects the function fromPptpUserAdd of the file /goform/PPTPDClient of the component httpd. Executing a manipulation of the argument opttype/usernamewith can lead to buffer ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7054/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7053 - High (8.8)

A security flaw has been discovered in Tenda F456 1.0.0.5. This affects the function frmL7ProtForm of the file /goform/L7Prot of the component httpd. Performing a manipulation of the argument page results in buffer overflow. Remote exploitation of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7053/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: OS command injection in JPCERT/CC LogonTracer before v2.0.0 (CVE-2026-33277). Logged-in users can run arbitrary OS commands. Restrict access & monitor logs until patch available. https://radar.offseq.com/threat/cve-2026-33277-improper-neutralization-of-special--31d12542 #OffSeq #Vuln #LogonTracer #Infosec

🟠 CVE-2026-33277 - High (8.8)

An OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrary OS command may be executed by a logged-in user.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨CRITICAL: CVE-2026-42363 in GeoVision GV-IP Device Utility 9.0.5 exposes admin creds via UDP broadcast with weak encryption. Attackers on LAN can take full control. Limit access, avoid untrusted networks, and watch for patches. https://radar.offseq.com/threat/cve-2026-42363-cwe-656-reliance-on-security-throug-65391bf4 #OffSeq #infosec #IoTSecurity

🔴 CVE-2026-42363 - Critical (9.3)

An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42363/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ New security advisory:

CVE-2026-6786 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-6786-firefox-memory-corruption-could-run-code

#Cybersecurity #PatchNow #InfoSecCommunity

🟠 CVE-2026-6786 - High (8.1)

Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7039 - High (7.8)

A security vulnerability has been detected in tufantunc ssh-mcp up to 1.5.0. The affected element is the function shell.write of the file src/index.ts. Such manipulation of the argument Description leads to command injection. The attack must be ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-7037: Totolink A8000RU (7.1cu.643_b20200521) — CRITICAL OS command injection flaw. Remote, unauthenticated exploit enables full device compromise. Restrict access & monitor systems. No patch yet. https://radar.offseq.com/threat/cve-2026-7037-os-command-injection-in-totolink-a80-052cff94 #OffSeq #CVE #infosec #IoT

🔴 CVE-2026-7037 - Critical (9.8)

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument pptpPassThru results in os c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7037/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7034 - High (8.8)

A vulnerability was found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function WrlExtraSet of the file /goform/WrlExtraSet of the component httpd. Performing a manipulation of the argument Go results in stack-based buffer overflow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7034/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7033 - High (8.8)

A vulnerability has been found in Tenda F456 1.0.0.5. Affected by this vulnerability is the function fromSafeClientFilter of the file /goform/SafeClientFilter. Such manipulation of the argument menufacturer/Go leads to buffer overflow. The attack ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7033/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7032 - High (8.8)

A flaw has been found in Tenda F456 1.0.0.5. Affected is the function SafeEmailFilter of the file /goform/SafeEmailFilter. This manipulation of the argument page causes buffer overflow. The attack can be initiated remotely. The exploit has been pu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7032/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 CVE-2026-7031: HIGH-severity buffer overflow in Tenda F456 (v1.0.0.5). Remote, no user interaction needed. Exploit public, no patch yet. Limit device exposure & monitor for updates. More: https://radar.offseq.com/threat/cve-2026-7031-buffer-overflow-in-tenda-f456-f28ef6c0 #OffSeq #Vulnerability #IoTSecurity #NetSec

🟠 CVE-2026-7031 - High (8.8)

A vulnerability was detected in Tenda F456 1.0.0.5. This impacts the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page results in buffer overflow. It is possible to launch the attack remotely. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7031/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7030 - High (8.8)

A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page leads to buffer overflow. It is possible to initiate the attack remo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7030/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

MEDIUM severity: CVE-2026-7028 impacts CodeAstro Online Job Portal 1.0. SQL injection possible via /admin/jobs-admins/delete-jobs.php (ID param). Exploit is public — monitor for attacks and restrict access! https://radar.offseq.com/threat/cve-2026-7028-sql-injection-in-codeastro-online-jo-7d79de51 #OffSeq #SQLi #Vulnerability #InfoSec

🛑 HIGH severity: Buffer overflow in Tenda F456 (v1.0.0.5) via /goform/P2pListFilter ('menufacturer/Go'). Public exploit available, no patch. Limit exposure & monitor systems. CVE-2026-7019. https://radar.offseq.com/threat/cve-2026-7019-buffer-overflow-in-tenda-f456-8fc2e156 #OffSeq #Tenda #Vuln #BufferOverflow

🟠 CVE-2026-7019 - High (8.8)

A vulnerability was identified in Tenda F456 1.0.0.5. The impacted element is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument menufacturer/Go leads to buffer overflow. The attack is possible to be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7019/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-42255 (HIGH): Technitium DNS Server <15.0 is vulnerable to DNS amplification via cyclic delegation (CWE-684). No patch yet — monitor DNS traffic & apply filtering. https://radar.offseq.com/threat/cve-2026-42255-cwe-684-incorrect-provision-of-spec-30347b11 #OffSeq #DNS #Infosec #Vuln

⚠️ CVE-2026-7015: MEDIUM XSS in MaxSite CMS (109.0 – 109.3) via Guestbook Plugin. Exploit public — remote attackers can target f_text/f_slug/f_limit/f_email. Patch in 109.4 (8a3946bd...). Upgrade now. Details: https://radar.offseq.com/threat/cve-2026-7015-cross-site-scripting-in-maxsite-cms-49304643 #OffSeq #XSS #MaxSiteCMS #Vuln

🚨 HIGH severity (CVSS 8.6) OS command injection in Linksys MR9600 (2.0.6.206937) — CVE-2026-6992. Remote attackers can gain control via the 'pin' argument. Exploit is public, no fix yet. Restrict remote access & monitor closely. https://radar.offseq.com/threat/cve-2026-6992-os-command-injection-in-linksys-mr96-18ae6106 #OffSeq #Vulnerability #Linksys