🟠 CVE-2026-25131 - High (8.8)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in the OpenEMR order types management system, allowing low-privilege user...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25131/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25131 - High (8.8)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in the OpenEMR order types management system, allowing low-privilege user...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25131/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24849 - Critical (9.9)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method in `EtherFaxActions.php` allows authenticated users to read arbitrary files from th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24849/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24849 - Critical (9.9)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, the `disposeDocument()` method in `EtherFaxActions.php` allows authenticated users to read arbitrary files from th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24849/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69231 - High (8.7)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a stored cross-site scripting vulnerability in the GAD-7 anxiety assessment form allows authenticated users with clini...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69231/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69231 - High (8.7)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a stored cross-site scripting vulnerability in the GAD-7 anxiety assessment form allows authenticated users with clini...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69231/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67752 - High (8.1)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper (`oeHttp`/`oeHttpRequest`) disables SSL/TLS certificate verification by default (`verify...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67752/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67752 - High (8.1)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper (`oeHttp`/`oeHttpRequest`) disables SSL/TLS certificate verification by default (`verify...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67752/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0797 - High (7.8)

GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerabilit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0797/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0797 - High (7.8)

GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerabilit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0797/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

PSA for Statamic folks - update your sites ASAP! ⚠️

A CRITICAL vuln was discovered that allows full account takeover via password resets! 😱

All the details: https://cvereports.com/reports/CVE-2026-27593 #Laravel

🚨 Statamic CMS CRITICAL vuln (CVE-2026-27593): Weak password reset lets attackers hijack accounts if users click a malicious link. Patch to 6.3.3/5.73.10+, educate users, enable MFA. Details: https://radar.offseq.com/threat/cve-2026-27593-cwe-640-weak-password-recovery-mech-d0c0ac0e #OffSeq #Statamic #CVE202627593 #infosec

🔴 CVE-2026-27593 - Critical (9.3)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27593/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

PSA for Statamic folks - update your sites ASAP! ⚠️

A CRITICAL vuln was discovered that allows full account takeover via password resets! 😱

All the details: https://cvereports.com/reports/CVE-2026-27593 #Laravel

🚨 Statamic CMS CRITICAL vuln (CVE-2026-27593): Weak password reset lets attackers hijack accounts if users click a malicious link. Patch to 6.3.3/5.73.10+, educate users, enable MFA. Details: https://radar.offseq.com/threat/cve-2026-27593-cwe-640-weak-password-recovery-mech-d0c0ac0e #OffSeq #Statamic #CVE202627593 #infosec

🔴 CVE-2026-27593 - Critical (9.3)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 6.3.3 and 5.73.10, an attacker may leverage a vulnerability in the password reset feature to capture a user's token and reset the password on their behalf. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27593/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25899 - High (7.5)

Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25899/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25899 - High (7.5)

Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25899/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚩 CRITICAL: CVE-2026-26222 in Altec DocLink 4.0.336.0 enables unauthenticated remote code execution & file access via unsafe .NET deserialization. No patch yet — immediately restrict/segment endpoints & monitor. Details: https://radar.offseq.com/threat/cve-2026-26222-cwe-502-deserialization-of-untruste-e414adc9
#OffSeq #CVE202626222 #Vuln #RCE

🚩 CRITICAL: CVE-2026-26222 in Altec DocLink 4.0.336.0 enables unauthenticated remote code execution & file access via unsafe .NET deserialization. No patch yet — immediately restrict/segment endpoints & monitor. Details: https://radar.offseq.com/threat/cve-2026-26222-cwe-502-deserialization-of-untruste-e414adc9
#OffSeq #CVE202626222 #Vuln #RCE

⚠️ CRITICAL: CVE-2026-26341 in Tattile Smart+, Vega & Basic (fw ≤1.181.5) — default creds allow admin access if device is reachable. Change passwords, restrict interface access ASAP. Details: https://radar.offseq.com/threat/cve-2026-26341-cwe-1392-use-of-default-credentials-b1797eea #OffSeq #IoTSecurity #DefaultCreds #Vuln

⚠️ CRITICAL: CVE-2026-26341 in Tattile Smart+, Vega & Basic (fw ≤1.181.5) — default creds allow admin access if device is reachable. Change passwords, restrict interface access ASAP. Details: https://radar.offseq.com/threat/cve-2026-26341-cwe-1392-use-of-default-credentials-b1797eea #OffSeq #IoTSecurity #DefaultCreds #Vuln

🚨 CRITICAL SQL Injection (CVE-2026-21410) affects all InSAT MasterSCADA BUK-TS versions. Unauthenticated RCE possible — industrial ops at risk. Restrict access & monitor until patched. Details: https://radar.offseq.com/threat/cve-2026-21410-cwe-89-in-insat-masterscada-buk-ts-10cd43d6 #OffSeq #ICS #SCADA #Vulnerability

🔴 CVE-2026-21410 - Critical (9.8)

InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21410/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL SQL Injection (CVE-2026-21410) affects all InSAT MasterSCADA BUK-TS versions. Unauthenticated RCE possible — industrial ops at risk. Restrict access & monitor until patched. Details: https://radar.offseq.com/threat/cve-2026-21410-cwe-89-in-insat-masterscada-buk-ts-10cd43d6 #OffSeq #ICS #SCADA #Vulnerability

🔴 CVE-2026-21410 - Critical (9.8)

InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21410/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-22553: CRITICAL OS command injection in InSAT MasterSCADA BUK-TS (all versions) via MMadmServ web interface. Unauthenticated RCE risk — no patch yet. Isolate, monitor, and apply WAF mitigations. https://radar.offseq.com/threat/cve-2026-22553-cwe-78-in-insat-masterscada-buk-ts-da2080e7 #OffSeq #ICS #SCADA #Infosec

🔴 CVE-2026-22553 - Critical (9.8)

All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22553/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-22553: CRITICAL OS command injection in InSAT MasterSCADA BUK-TS (all versions) via MMadmServ web interface. Unauthenticated RCE risk — no patch yet. Isolate, monitor, and apply WAF mitigations. https://radar.offseq.com/threat/cve-2026-22553-cwe-78-in-insat-masterscada-buk-ts-da2080e7 #OffSeq #ICS #SCADA #Infosec

🔴 CVE-2026-22553 - Critical (9.8)

All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22553/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-33180 - High (8)

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-33180 - High (8)

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Two advisories from AMD, one new, one updated:

-  CVE-2025-0037: Versal Adaptive SoC –Overwriting Protected Memory Regions through PLM Firmware https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8010.html

- CVE-2023-31364: Guest Initiated Machine Check Errors https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7059.html

Two new ones from NVIDIA:

- CVE-2025-33179, CVE-2025-33180, and CVE-2025-33181: NVIDIA Cumulus Linux and NVOS - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5722

- CVE-2026-24241: NVIDIA License System - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5789 #Nvidia #infosec #AMD #vulnerability #Linux

🟠 CVE-2025-33180 - High (8)

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-33180 - High (8)

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could inject a command. A successful exploit of this vulnerability might lead to escalation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Two advisories from AMD, one new, one updated:

-  CVE-2025-0037: Versal Adaptive SoC –Overwriting Protected Memory Regions through PLM Firmware https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8010.html

- CVE-2023-31364: Guest Initiated Machine Check Errors https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7059.html

Two new ones from NVIDIA:

- CVE-2025-33179, CVE-2025-33180, and CVE-2025-33181: NVIDIA Cumulus Linux and NVOS - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5722

- CVE-2026-24241: NVIDIA License System - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5789 #Nvidia #infosec #AMD #vulnerability #Linux

🟠 CVE-2026-3105 - High (7.6)

SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3105 - High (7.6)

SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-33179 - High (8)

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command. A successful exploit of this vulnerability might lead to escalation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Two advisories from AMD, one new, one updated:

-  CVE-2025-0037: Versal Adaptive SoC –Overwriting Protected Memory Regions through PLM Firmware https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8010.html

- CVE-2023-31364: Guest Initiated Machine Check Errors https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7059.html

Two new ones from NVIDIA:

- CVE-2025-33179, CVE-2025-33180, and CVE-2025-33181: NVIDIA Cumulus Linux and NVOS - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5722

- CVE-2026-24241: NVIDIA License System - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5789 #Nvidia #infosec #AMD #vulnerability #Linux

🟠 CVE-2025-33179 - High (8)

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command. A successful exploit of this vulnerability might lead to escalation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-33179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Two advisories from AMD, one new, one updated:

-  CVE-2025-0037: Versal Adaptive SoC –Overwriting Protected Memory Regions through PLM Firmware https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8010.html

- CVE-2023-31364: Guest Initiated Machine Check Errors https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7059.html

Two new ones from NVIDIA:

- CVE-2025-33179, CVE-2025-33180, and CVE-2025-33181: NVIDIA Cumulus Linux and NVOS - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5722

- CVE-2026-24241: NVIDIA License System - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5789 #Nvidia #infosec #AMD #vulnerability #Linux

Two advisories from AMD, one new, one updated:

-  CVE-2025-0037: Versal Adaptive SoC –Overwriting Protected Memory Regions through PLM Firmware https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8010.html

- CVE-2023-31364: Guest Initiated Machine Check Errors https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7059.html

Two new ones from NVIDIA:

- CVE-2025-33179, CVE-2025-33180, and CVE-2025-33181: NVIDIA Cumulus Linux and NVOS - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5722

- CVE-2026-24241: NVIDIA License System - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5789 #Nvidia #infosec #AMD #vulnerability #Linux

Two advisories from AMD, one new, one updated:

-  CVE-2025-0037: Versal Adaptive SoC –Overwriting Protected Memory Regions through PLM Firmware https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8010.html

- CVE-2023-31364: Guest Initiated Machine Check Errors https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7059.html

Two new ones from NVIDIA:

- CVE-2025-33179, CVE-2025-33180, and CVE-2025-33181: NVIDIA Cumulus Linux and NVOS - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5722

- CVE-2026-24241: NVIDIA License System - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5789 #Nvidia #infosec #AMD #vulnerability #Linux

🟠 CVE-2026-27519 - High (7.5)

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript. Because the key is static and exposed, an attacker can decrypt protected values and defeat confident...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27519/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27519 - High (7.5)

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded in client-side JavaScript. Because the key is static and exposed, an attacker can decrypt protected values and defeat confident...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27519/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2769 - High (8.8)

Use-after-free in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2769 - High (8.8)

Use-after-free in the Storage: IndexedDB component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27208 - Critical (9.2)

bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege Escalation. This allows an attacker to execute arbitrary commands with root privileges wi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27208 - Critical (9.2)

bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege Escalation. This allows an attacker to execute arbitrary commands with root privileges wi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2038 - Critical (9.8)

GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2038/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2038 - Critical (9.8)

GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2038/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2039 - Critical (9.8)

GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulner...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2039 - Critical (9.8)

GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulner...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2037 - High (8.8)

GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Although authentication is required to ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2037/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2045 - High (7.8)

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2045/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-3044: HIGH severity stack buffer overflow in Tenda AC8 (16.03.34.06) — remote exploit published! Restrict /cgi-bin/UploadCfg, monitor traffic, and disable remote mgmt. Await patches or consider device replacement. https://radar.offseq.com/threat/cve-2026-3044-stack-based-buffer-overflow-in-tenda-c3428cc0 #OffSeq #Vuln #Tenda

🚨 CVE-2026-3044: HIGH severity stack buffer overflow in Tenda AC8 (16.03.34.06) — remote exploit published! Restrict /cgi-bin/UploadCfg, monitor traffic, and disable remote mgmt. Await patches or consider device replacement. https://radar.offseq.com/threat/cve-2026-3044-stack-based-buffer-overflow-in-tenda-c3428cc0 #OffSeq #Vuln #Tenda

🟠 CVE-2026-3044 - High (8.8)

A vulnerability has been found in Tenda AC8 16.03.34.06. This affects the function webCgiGetUploadFile of the file /cgi-bin/UploadCfg of the component Httpd Service. The manipulation of the argument boundary leads to stack-based buffer overflow. I...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:0224] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0224)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-25108 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-25108)
- Name: Soliton Systems K.K FileZen OS Command Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Soliton Systems K.K
- Product: FileZen
- Notes: https://jvn.jp/en/jp/JVN84622767/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-25108

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260224 #cisa20260224 #cve_2026_25108 #cve202625108

CVE ID: CVE-2026-25108
Vendor: Soliton Systems K.K
Product: FileZen
Date Added: 2026-02-24
Notes: https://jvn.jp/en/jp/JVN84622767/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-25108
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25108

CISA has updated the KEV catalogue.

- CVE-2026-25108: Soliton Systems K.K FileZen OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-25108

- Three industrial advisories: https://www.cisa.gov/ #CISA #infosec #vulnerability

🚨 [CISA-2026:0224] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0224)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-25108 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-25108)
- Name: Soliton Systems K.K FileZen OS Command Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Soliton Systems K.K
- Product: FileZen
- Notes: https://jvn.jp/en/jp/JVN84622767/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-25108

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260224 #cisa20260224 #cve_2026_25108 #cve202625108

CVE ID: CVE-2026-25108
Vendor: Soliton Systems K.K
Product: FileZen
Date Added: 2026-02-24
Notes: https://jvn.jp/en/jp/JVN84622767/ ; https://nvd.nist.gov/vuln/detail/CVE-2026-25108
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-25108

CISA has updated the KEV catalogue.

- CVE-2026-25108: Soliton Systems K.K FileZen OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-25108

- Three industrial advisories: https://www.cisa.gov/ #CISA #infosec #vulnerability

🟠 CVE-2026-22765 - High (8.8)

Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of Privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22765 - High (8.8)

Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of Privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Two advisories from AMD, one new, one updated:

-  CVE-2025-0037: Versal Adaptive SoC –Overwriting Protected Memory Regions through PLM Firmware https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8010.html

- CVE-2023-31364: Guest Initiated Machine Check Errors https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7059.html

Two new ones from NVIDIA:

- CVE-2025-33179, CVE-2025-33180, and CVE-2025-33181: NVIDIA Cumulus Linux and NVOS - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5722

- CVE-2026-24241: NVIDIA License System - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5789 #Nvidia #infosec #AMD #vulnerability #Linux

Two advisories from AMD, one new, one updated:

-  CVE-2025-0037: Versal Adaptive SoC –Overwriting Protected Memory Regions through PLM Firmware https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8010.html

- CVE-2023-31364: Guest Initiated Machine Check Errors https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7059.html

Two new ones from NVIDIA:

- CVE-2025-33179, CVE-2025-33180, and CVE-2025-33181: NVIDIA Cumulus Linux and NVOS - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5722

- CVE-2026-24241: NVIDIA License System - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5789 #Nvidia #infosec #AMD #vulnerability #Linux

🟠 CVE-2026-2798 - High (8.8)

Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2798/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2798 - High (8.8)

Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2798/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26746 - High (8.8)

OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function. An attacker can read arbitrary files on the web server by manipulating the Invoice Type configuration. This issue can be chained with ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26746/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70329 - High (8)

TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlanVidLan1 (and other vlanVidLanX) parameters are retrieved via Uci_Get_Str and passed to t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70329/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27483 - High (8.8)

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27483/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27483 - High (8.8)

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a path traversal vulnerability in Mindsdb's /api/files interface, which an authenticated attacker can exploit to achieve remote co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27483/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity buffer overflow in UTT HiPER 810G (≤1.7.7-1711) — remote exploitation possible via passwd1 in /goform/setSysAdm. Exploit is public. Monitor devices & restrict access until patch available. CVE-2026-2980 https://radar.offseq.com/threat/cve-2026-2980-buffer-overflow-in-utt-hiper-810g-30621ae4 #OffSeq #Vuln #Infosec

🔴 New security advisory:

CVE-2026-23693 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://yazoul.net/advisory/cve/cve-2026-23693

#Cybersecurity #VulnerabilityManagement #CyberSec

⚠️ CVE-2026-23693 (CRITICAL, CVSS 9.3) in ElementsKit Lite <3.7.9 exposes a Mailchimp REST endpoint to unauth’d abuse — risking API quota exhaustion & data manipulation. Patch ASAP & block /wp-json/elementskit/v1/widget/mailchimp/subscribe. https://radar.offseq.com/threat/cve-2026-23693-cwe-306-missing-authentication-for--873ad830 #OffSeq #WordPress #Vuln

🔴 CVE-2026-23693 - Critical (10)

ElementsKit Lite (elementskit-lite) WordPress plugin versions prior to 3.7.9 expose the REST endpoint /wp-json/elementskit/v1/widget/mailchimp/subscribe without authentication. The endpoint accepts client-supplied Mailchimp API credentials and ins...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23693/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25989 - High (7.5)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can cause a denial of service. An off-by-one boundary check (`>` instead of `>=`) that allo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-15386 - High (8.8)

The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments ar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15386/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-15386 - High (8.8)

The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments ar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15386/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27515 - Critical (9.1)

Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session identifiers in the web management interface. An attacker can guess valid session IDs and hijack authenticated sessions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27515/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27515 - Critical (9.1)

Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session identifiers in the web management interface. An attacker can guess valid session IDs and hijack authenticated sessions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27515/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23678 - High (8.8)

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function of the affected device web management interface. By injecting the character into the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23678/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23678 - High (8.8)

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerability in the traceroute diagnostic function of the affected device web management interface. By injecting the character into the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23678/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27520 - High (7.5)

Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side cookie as a Base64-encoded value accessible via the web interface. Because Base64 is reversible and provides no confidentialit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27520/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27520 - High (7.5)

Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side cookie as a Base64-encoded value accessible via the web interface. Because Base64 is reversible and provides no confidentialit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27520/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27507 - Critical (9.8)

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain hard-coded administrative credentials that cannot be changed by users. Knowledge of these credentials allows full administrative access to the device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27507/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27507 - Critical (9.8)

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain hard-coded administrative credentials that cannot be changed by users. Knowledge of these credentials allows full administrative access to the device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27507/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27516 - High (8.1)

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext within the administrative interface and HTTP responses, allowing recovery of valid credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27516/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27516 - High (8.1)

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext within the administrative interface and HTTP responses, allowing recovery of valid credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27516/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-2904 (HIGH): Buffer overflow in UTT HiPER 810G v1.7.7-171114 via /goform/ConfigExceptAli. Remote, unauthenticated RCE/DoS risk. Public exploit code available — restrict access & monitor. https://radar.offseq.com/threat/cve-2026-2904-buffer-overflow-in-utt-hiper-810g-b0bb6f4a #OffSeq #Vulnerability #NetworkSecurity

🟠 CVE-2026-2904 - High (8.8)

A vulnerability was determined in UTT HiPER 810G 1.7.7-171114. This affects the function strcpy of the file /goform/ConfigExceptAli. Executing a manipulation can lead to buffer overflow. The attack can be launched remotely. The exploit has been pu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2904/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-40541 - Critical (9.1)

An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account.

This issue requires administrative privileges to abuse. On Window...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40541/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25794 - High (8.2)

ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25794/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27211 - Critical (10)

Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration (constrained by process privileges) when using virtio-block devices backed by raw images. A malicious g...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27211 - Critical (10)

Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file exfiltration (constrained by process privileges) when using virtio-block devices backed by raw images. A malicious g...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ HIGH-severity XSS (CVE-2026-25802) in QuantumNous new-api (<0.10.8-alpha.9): Unsafe MarkdownRenderer.jsx allows script injection with user interaction. Upgrade ASAP & implement CSP! https://radar.offseq.com/threat/cve-2026-25802-cwe-79-improper-neutralization-of-i-48d25c61 #OffSeq #XSS #InfoSec #AIsecurity

🟠 CVE-2026-25802 - High (7.6)

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.10.8-alpha.9, a potential unsafe operation occurs in component `MarkdownRenderer.jsx`, allowing for Cross-Site Scripting(XS...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25802/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-25591 (HIGH): QuantumNous new-api <0.10.8-alpha.10 vulnerable to SQL LIKE wildcard injection in /api/token/search. Auth users can cause DoS via crafted search patterns. Patch ASAP! https://radar.offseq.com/threat/cve-2026-25591-cwe-943-improper-neutralization-of--2ce4358a #OffSeq #Infosec #SQLInjection #Vulnerability

🚨 CVE-2026-25591 (HIGH): QuantumNous new-api <0.10.8-alpha.10 vulnerable to SQL LIKE wildcard injection in /api/token/search. Auth users can cause DoS via crafted search patterns. Patch ASAP! https://radar.offseq.com/threat/cve-2026-25591-cwe-943-improper-neutralization-of--2ce4358a #OffSeq #Infosec #SQLInjection #Vulnerability

🔴 CVE-2026-27574 - Critical (9.9)

OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module (explicitly documented as not a security mechanism) to execute user-supplied code, a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27574/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25985 - High (7.5)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file containing an malicious element causes ImageMagick to attempt to allocate ~674 GB of memory...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25985/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24481 - High (7.5)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap information disclosure vulnerability exists in ImageMagick's PSD (Adobe Photoshop) format handler. When...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24481/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27212 - High (7.8)

Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27212 - High (7.8)

Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27212 in nolimits4web swiper (6.5.1 – 12.1.1) enables prototype pollution, risking auth bypass, DoS, & RCE. Affects Node & Bun, Windows & Linux. Upgrade to 12.1.2 now! https://radar.offseq.com/threat/cve-2026-27212-cwe-1321-improperly-controlled-modi-35374c82 #OffSeq #CVE202627212 #AppSec #JavaScript

🔴 CVE-2026-27471 - Critical (9.1)

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27471 - Critical (9.1)

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27471 in ERPNext (≤15.98.0, 16.0.0-rc.1 – 16.6.0) lets unauth attackers access sensitive docs via missing API auth. Upgrade to 15.98.1/16.6.1+ & restrict access now. https://radar.offseq.com/threat/cve-2026-27471-cwe-862-missing-authorization-in-fr-0d95cb60 #OffSeq #ERPNext #CVE202627471 #Infosec

🟠 CVE-2026-27479 - High (7.7)

Wallos is an open-source, self-hostable personal subscription tracker. Versions 4.6.0 and below contain a Server-Side Request Forgery (SSRF) vulnerability in the subscription and payment logo/icon upload functionality. The application validates th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27479/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔍 HIGH severity: CVE-2026-27127 in Craft CMS (4.5.0-RC1 – 4.16.18, 5.0.0-RC1 – 5.8.22) enables DNS rebinding via TOCTOU in GraphQL Asset mutation. Patch to 4.16.19/5.8.23+ & review GraphQL permissions. https://radar.offseq.com/threat/cve-2026-27127-cwe-367-time-of-check-time-of-use-t-5842a733 #OffSeq #CraftCMS #SSRF #Vuln

🛡️ CVE-2026-26198: CRITICAL SQLi in Ormar Python ORM (0.9.9 – 0.22.0). min() & max() allow injection — no auth needed! Patch with v0.23.0+. Audit & monitor now. Details: https://radar.offseq.com/threat/cve-2026-26198-cwe-89-improper-neutralization-of-s-7460e41f #OffSeq #SQLInjection #Python

🔴 CVE-2026-26198 - Critical (9.8)

Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into `sqlalchemy.text()` without any validation or sanit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26198/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13943 - High (8.8)

A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13943/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13943 - High (8.8)

A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could allow an authenticated attacker to execute operating system (OS) commands on an affected...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13943/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26331 - High (8.8)

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary com...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26331/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25965 - High (8.6)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25965/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24485 - High (7.5)

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24485/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25648 - High (8.7)

Versions of the Traccar open-source GPS tracking system starting with 6.11.1 contain an issue in which authenticated users can execute arbitrary JavaScript in the context of other users' browsers by uploading malicious SVG files as device images. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21863 - High (7.5)

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the syste...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21863/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21863 - High (7.5)

Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious actor with access to the Valkey clusterbus port can send an invalid packet that may cause an out bound read, which might result in the syste...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21863/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2041 - High (8.8)

Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2041/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2041 - High (8.8)

Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2041/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-02-16 - 2026-02-23)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1338

Severity:
- Critical: 74
- High: 301
- Medium: 602
- Low: 33
- None: 328

Status:
- : 9
- Analyzed: 277
- Awaiting Analysis: 747
- Modified: 3
- Received: 170
- Rejected: 40
- Undergoing Analysis: 92

Top CNAs:
- Patchstack: 334
- GitHub, Inc.: 170
- VulDB: 164
- Wordfence: 148
- VulnCheck: 145
- MITRE: 53
- kernel.org: 33
- IBM Corporation: 33
- Fortinet, Inc.: 25
- Zero Day Initiative: 20

Top Affected Products:
- UNKNOWN: 1037
- Comodo Dome Firewall: 29
- Gfi Mailessentials: 18
- Smoothwall Express: 17
- Openclaw: 16
- Invoiceplane: 11
- Spip: 10
- Nvidia Nemo: 10
- Mjdm Majordomo: 8
- Ibm Concert: 7

Top EPSS Score:
- CVE-2026-22769 - 28.78 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22769)
- CVE-2026-2033 - 10.53 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2033)
- CVE-2019-25441 - 2.65 % (https://secdb.nttzen.cloud/cve/detail/CVE-2019-25441)
- CVE-2026-2426 - 1.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2426)
- CVE-2026-2533 - 1.28 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2533)
- CVE-2026-2544 - 1.28 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2544)
- CVE-2026-2041 - 1.25 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2041)
- CVE-2026-2042 - 1.25 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2042)
- CVE-2026-2635 - 1.17 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2635)
- CVE-2026-2548 - 1.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2548)

🟠 CVE-2026-27161 - High (7.5)

GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27161/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27161 - High (7.5)

GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27161/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The most severe of the four security flaws patched by SolarWinds today in Serv-U 15.5.4 is tracked as CVE-2025-40538, and it allows attackers with high privileges to gain root or admin permissions on vulnerable servers. https://www.bleepingcomputer.com/news/security/critical-solarwinds-serv-u-flaws-offer-root-access-to-servers/

🔴 CVE-2025-40538 - Critical (9.1)

A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges.

This iss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The most severe of the four security flaws patched by SolarWinds today in Serv-U 15.5.4 is tracked as CVE-2025-40538, and it allows attackers with high privileges to gain root or admin permissions on vulnerable servers. https://www.bleepingcomputer.com/news/security/critical-solarwinds-serv-u-flaws-offer-root-access-to-servers/

🔴 CVE-2025-40538 - Critical (9.1)

A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges.

This iss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-40539 - Critical (9.1)

A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account.

This issue requires administrative privileges to abuse. On Windows deployments, the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-40539 - Critical (9.1)

A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account.

This issue requires administrative privileges to abuse. On Windows deployments, the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-40540 - Critical (9.1)

A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account.

This issue requires administrative privileges to abuse. On Windows deployments, the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40540/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-1459: HIGH-severity OS command injection in Zyxel VMG3625-T50B firmware ≤5.50(ABPM.9.7)C0. Authenticated admin can run arbitrary commands. Restrict admin access & monitor. Patch ASAP when released! https://radar.offseq.com/threat/cve-2026-1459-cwe-78-improper-neutralization-of-sp-f412c512 #OffSeq #Zyxel #CVE20261459 #InfoSec

🔴 CVE-2025-13942 - Critical (9.8)

A command injection vulnerability in the UPnP function of the Zyxel EX3510-B0 firmware versions through 5.17(ABUP.15.1)C0 could allow a remote attacker to execute operating system (OS) commands on an affected device by sending specially crafted UP...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27487 - High (7.6)

OpenClaw is a personal AI assistant. In versions 2026.2.13 and below, when using macOS, the Claude CLI keychain credential refresh path constructed a shell command to write the updated JSON blob into Keychain via security add-generic-password -w ....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27487/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27198 - High (8.8)

Formwork is a flat file-based Content Management System (CMS). In versions 2.0.0 through 2.3.3, the application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exist...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27198/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27196 - High (8.1)

Statmatic is a Laravel and Git powered content management system (CMS). Versions 5.73.8 and below in addition to 6.0.0-alpha.1 through 6.3.1 have a Stored XSS vulnerability in html fieldtypes which allows authenticated users with field management ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27196/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27203 - High (8.3)

eBay API MCP Server is an open source local MCP server providing AI assistants with comprehensive access to eBay's Sell APIs. All versions are vulnerable to Environment Variable Injection through the updateEnvFile function. The ebay_set_user_token...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27203/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69700 - High (7.5)

Tenda FH1203 V2.0.1.6 contains a stack-based buffer overflow vulnerability in the modify_add_client_prio function, which is reachable via the formSetClientPrio CGI handler.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69700/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69380 - High (7.5)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vanquish Upload Files Anywhere wp-upload-files-anywhere allows Path Traversal.This issue affects Upload Files Anywhere: from n/a through &lt;= 2.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69380/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26722 - Critical (9.4)

An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login functionality.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26722/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26723 - High (8.2)

Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the function parameter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26723/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70833 - Critical (9.4)

An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26747 - Critical (9.1)

A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where the "app.force_url" is not set and default is "...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26747/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26725 - Critical (9.8)

An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 allows a remote attacker to escalate privileges via the AccessID parameter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26725/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26724 - High (7.6)

Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the selectgroup and gn parameters on the /?Function=Groups endpoint.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26724/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70831 - Critical (9.8)

A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properly sanitize user-supplied input in the mediaId parameter before using it in a system shell command. This al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70831/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69393 - High (7.5)

Missing Authorization vulnerability in Jthemes Exzo exzo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exzo: from n/a through &lt;= 1.2.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69393/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2886 - High (8.8)

A weakness has been identified in Tenda A21 1.0.0.0. This affects the function set_device_name of the file /goform/SetOnlineDevName. This manipulation of the argument devName causes stack-based buffer overflow. It is possible to initiate the attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2886 - High (8.8)

A weakness has been identified in Tenda A21 1.0.0.0. This affects the function set_device_name of the file /goform/SetOnlineDevName. This manipulation of the argument devName causes stack-based buffer overflow. It is possible to initiate the attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2871 - High (8.8)

A weakness has been identified in Tenda A21 1.0.0.0. This affects the function fromSetIpMacBind of the file /goform/SetIpMacBind. This manipulation of the argument list causes stack-based buffer overflow. The attack is possible to be carried out r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2871/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27169 - High (8.9)

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Versions 1.1.2-alpha and below render untrusted user/model content in chat tool UI surfaces using unsafe HTML interpolation patterns, leading t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27169/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27194 - Critical (9.8)

D-Tale is a visualizer for pandas data structures. Versions prior to 3.20.0 are vulnerable to Remote Code Execution through the /save-column-filter endpoint. Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attacke...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27194/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 Critical SAML SSO vuln (CVE-2026-27197, CVSS 9.1) in Sentry 21.12.0 – 26.1.0 allows remote account takeover in multi-org instances. Upgrade to 26.2.0+, enable user 2FA, audit SSO settings! Full details: https://radar.offseq.com/threat/cve-2026-27197-cwe-287-improper-authentication-in--f7f67e7c #OffSeq #Sentry #CVE202627197 #infosec

🔴 CVE-2026-27197 - Critical (9.1)

Sentry is a developer-first error tracking and performance monitoring tool. Versions 21.12.0 through 26.1.0 have a critical vulnerability in its SAML SSO implementation which allows an attacker to take over any user account by using a malicious S...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27197/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2876 - High (8.8)

A vulnerability was determined in Tenda A18 15.13.07.13. This affects the function parse_macfilter_rule of the file /goform/setBlackRule. This manipulation of the argument deviceList causes stack-based buffer overflow. The attack may be initiated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2876/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2588 - Critical (9.1)

Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems.

Sodium.xs casts a STRLEN (size_t) to unsigned long long when passing a length pointer to libsodium functions. On 32-bit systems size_t is typical...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2588/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24956 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada Download Manager Addons for Elementor wpdm-elementor allows Blind SQL Injection.This issue affects Download Manager Addons for Elementor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24956/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2856 - High (8.8)

A vulnerability was found in D-Link DWR-M960 1.01.07. Affected by this vulnerability is the function sub_424AFC of the file /boafrm/formFilter of the component Filter Configuration Endpoint. The manipulation of the argument submit-url results in s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2856/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2857 - High (8.8)

A vulnerability was determined in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_423E00 of the file /boafrm/formPortFw of the component Port Forwarding Configuration Endpoint. This manipulation of the argument submit-url cause...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2907 - High (8.8)

A weakness has been identified in Tenda HG9 300001138. Affected by this vulnerability is an unknown functionality of the file /boaform/formgponConf of the component GPON Configuration Endpoint. This manipulation of the argument fmgpon_loid/fmgpon_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2907/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2908 - High (8.8)

A security vulnerability has been detected in Tenda HG9 300001138. Affected by this issue is some unknown functionality of the file /boaform/formLoopBack of the component Loopback Detection Configuration Endpoint. Such manipulation of the argument...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2908/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2911 - High (8.8)

A vulnerability has been found in Tenda FH451 up to 1.0.0.9. This issue affects some unknown processing of the file /goform/GstDhcpSetSer. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2911/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2874 - High (8.8)

A flaw has been found in Tenda A21 1.0.0.0. Impacted is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. Executing a manipulation of the argument ssid can lead to stack-based buffer overflow. It is possible to lau...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2874/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2883 - High (8.8)

A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_427D74 of the file /boafrm/formIpQoS. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be executed r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2883/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2929 - High (8.8)

A vulnerability was determined in D-Link DWR-M960 1.01.07. Impacted is the function sub_453140 of the file /boafrm/formWlAc of the component Wireless Access Control Endpoint. This manipulation of the argument submit-url causes stack-based buffer o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2929/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: Stack-based buffer overflow in D-Link DWR-M960 (v1.01.07) via /boafrm/formWlAc (CVE-2026-2929) enables remote code execution. Public exploit is out — review defenses now! https://radar.offseq.com/threat/cve-2026-2929-stack-based-buffer-overflow-in-d-lin-63e7a69b #OffSeq #CVE20262929 #DLink #Vuln

CVE-2026-2926: HIGH-severity stack buffer overflow in D-Link DWR-M960 v1.01.07. Remote, unauthenticated code execution possible. Public PoC released — no vendor patch yet. Isolate devices, monitor endpoints, restrict access. Details: https://radar.offseq.com/threat/cve-2026-2926-stack-based-buffer-overflow-in-d-lin-b63cbef8 #OffSeq #DLink #Infosec

🟠 CVE-2026-2926 - High (8.8)

A flaw has been found in D-Link DWR-M960 1.01.07. This affects the function sub_4237AC of the file /boafrm/formLteSetup of the component LTE Configuration Endpoint. Executing a manipulation of the argument submit-url can lead to stack-based buffer...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2926/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-2928: HIGH-severity stack buffer overflow in D-Link DWR-M960 (v1.01.07) enables remote code execution — no auth needed. Public exploit code is out. Isolate & restrict access, monitor for attacks, patch ASAP. https://radar.offseq.com/threat/cve-2026-2928-stack-based-buffer-overflow-in-d-lin-ba314a06 #OffSeq #DLink #Vuln #BlueTeam

🟠 CVE-2026-2928 - High (8.8)

A vulnerability was found in D-Link DWR-M960 1.01.07. This issue affects the function sub_452CCC of the file /boafrm/formWlEncrypt of the component WLAN Encryption Configuration Endpoint. The manipulation of the argument submit-url results in stac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2959 - High (8.8)

A vulnerability was detected in D-Link DWR-M960 1.01.07. Affected by this vulnerability is the function sub_44E0F8 of the file /boafrm/formNewSchedule. Performing a manipulation of the argument url results in stack-based buffer overflow. Remote ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2959/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2959 - High (8.8)

A vulnerability was detected in D-Link DWR-M960 1.01.07. Affected by this vulnerability is the function sub_44E0F8 of the file /boafrm/formNewSchedule. Performing a manipulation of the argument url results in stack-based buffer overflow. Remote ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2959/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: D-Link DWR-M960 v1.01.07 hit by stack-based buffer overflow (CVE-2026-2959) via /boafrm/formNewSchedule. Remote exploitation possible — public exploit available! Assess & monitor. https://radar.offseq.com/threat/cve-2026-2959-stack-based-buffer-overflow-in-d-lin-54cc012d #OffSeq #DLink #CVE20262959 #Security

🛡️ CVE-2026-2960: HIGH severity stack-based buffer overflow in D-Link DWR-M960 (fw 1.01.07). Remote, unauthenticated RCE possible; PoC exploit published. Patch or restrict access now! https://radar.offseq.com/threat/cve-2026-2960-stack-based-buffer-overflow-in-d-lin-29b3b35d #OffSeq #DLink #Infosec #Vulnerability

🟠 CVE-2026-2960 - High (8.8)

A flaw has been found in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_468D64 of the file /boafrm/formDhcpv6s. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be exe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2960/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-23552 in Apache Camel 4.15.0 – 4.17.x breaks tenant isolation — JWT tokens from any Keycloak realm may be accepted! Upgrade to 4.18.0 ASAP to secure multi-tenant systems. https://radar.offseq.com/threat/cve-2026-23552-cwe-346-origin-validation-error-in--099c72c7 #OffSeq #ApacheCamel #Vuln #Keycloak

🔴 CVE-2026-23552 - Critical (9.1)

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. 

The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss (issuer) claim of JWT tokens against the configured realm. A token issued by one ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23552/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 New security advisory:

CVE-2025-70043 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://yazoul.net/advisory/cve/cve-2025-70043

#Cybersecurity #ZeroDay #ThreatIntel

🔴 CVE-2025-70043 - Critical (9.1)

An issue pertaining to CWE-295: Improper Certificate Validation was discovered in Ayms node-To master. The application disables TLS/SSL certificate validation by setting 'rejectUnauthorized': false in TLS socket options

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70043/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3016 - High (8.8)

A vulnerability was identified in UTT HiPER 810G up to 1.7.7-171114. The affected element is the function strcpy of the file /goform/formP2PLimitConfig. The manipulation of the argument except leads to buffer overflow. Remote exploitation of the a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3016/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3015 - High (8.8)

A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/formPolicyRouteConf. Executing a manipulation of the argument GroupName can lead to buffer overflow. The attack may be launche...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3015/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3015 - High (8.8)

A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/formPolicyRouteConf. Executing a manipulation of the argument GroupName can lead to buffer overflow. The attack may be launche...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3015/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-02-16 - 2026-02-23)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1338

Severity:
- Critical: 74
- High: 301
- Medium: 602
- Low: 33
- None: 328

Status:
- : 9
- Analyzed: 277
- Awaiting Analysis: 747
- Modified: 3
- Received: 170
- Rejected: 40
- Undergoing Analysis: 92

Top CNAs:
- Patchstack: 334
- GitHub, Inc.: 170
- VulDB: 164
- Wordfence: 148
- VulnCheck: 145
- MITRE: 53
- kernel.org: 33
- IBM Corporation: 33
- Fortinet, Inc.: 25
- Zero Day Initiative: 20

Top Affected Products:
- UNKNOWN: 1037
- Comodo Dome Firewall: 29
- Gfi Mailessentials: 18
- Smoothwall Express: 17
- Openclaw: 16
- Invoiceplane: 11
- Spip: 10
- Nvidia Nemo: 10
- Mjdm Majordomo: 8
- Ibm Concert: 7

Top EPSS Score:
- CVE-2026-22769 - 28.78 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22769)
- CVE-2026-2033 - 10.53 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2033)
- CVE-2019-25441 - 2.65 % (https://secdb.nttzen.cloud/cve/detail/CVE-2019-25441)
- CVE-2026-2426 - 1.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2426)
- CVE-2026-2533 - 1.28 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2533)
- CVE-2026-2544 - 1.28 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2544)
- CVE-2026-2041 - 1.25 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2041)
- CVE-2026-2042 - 1.25 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2042)
- CVE-2026-2635 - 1.17 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2635)
- CVE-2026-2548 - 1.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2548)

CVE-2026-25896 (CVSS 9.3) disclosed in fast-xml-parser

A critical entity encoding bypass affects fast-xml-parser (40M+ weekly npm downloads).
-Allows attackers to shadow built-in XML entities (<, >, &, ", ')
-Can lead to XSS or injection when parsing untrusted XML and rendering the output
-Exploitable with default settings (processEntities: true)
-Impacts >= 4.1.3 and < 5.3.5, including transitive dependencies

Fix: upgrade to v5.3.5+
Advisory: GHSA-m7jm-9gc2-mpf2

https://www.endorlabs.com/learn/cve-2026-25896-fast-xml-parser

🚨 CRITICAL: CVE-2026-25896 in fast-xml-parser (<5.3.5) lets attackers override built-in XML entities, enabling XSS via crafted XML. Affects web apps using vulnerable versions. Patch to 5.3.5+ ASAP! https://radar.offseq.com/threat/cve-2026-25896-cwe-185-incorrect-regular-expressio-a786da3a #OffSeq #Infosec #XSS #NodeJS

🔴 CVE-2026-25896 - Critical (9.3)

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during en...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25896/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24892 - High (7.5)

openITCOCKPIT is an open source monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus. openITCOCKPIT Community Edition 5.3.1 and earlier contains an unsafe PHP deserialization pattern in the processing of change...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24892/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22567 - High (7.6)

Improper validation of user-supplied input in the ZIA Admin UI could allow an authenticated administrator to initiate backend functions through specific input fields in limited scenarios.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22567/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-24494 (CRITICAL, CVSS 9.8): SQL Injection in Order Up Online Ordering System v1.0 lets unauthenticated attackers run arbitrary SQL via /api/integrations/getintegrations. Patch or mitigate now! https://radar.offseq.com/threat/cve-2026-24494-cwe-89-improper-neutralization-of-s-fae4075c #OffSeq #SQLInjection #Vulnerability #Infosec

🔴 CVE-2026-24494 - Critical (9.8)

SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to access sensitive backend database data via a crafted store_id parameter in a POST request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack