🟠 CVE-2026-32049 - High (7.5)

OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger elevated me...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33038 - High (8.1)

WWBN AVideo is an open source video platform. Versions 25.0 and below are vulnerable to unauthenticated application takeover through the install/checkConfiguration.php endpoint. install/checkConfiguration.php performs full application initializati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33038/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33039 - High (8.6)

WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32055 - High (7.6)

OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that allows attackers to write files outside the workspace through in-workspace symlinks pointing to non-existent out-of-root targets. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32055/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4437 - High (7.5)

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violatio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4437/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4437 - High (7.5)

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violatio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4437/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4404 - Critical (9.4)

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4404 - Critical (9.4)

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31903 - High (7.5)

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31903/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24060 - Critical (9.1)

Service information is not encrypted when transmitted as BACnet packets
over the wire, and can be sniffed, intercepted, and modified by an
attacker. Valuable information such as the File Start Position and File
Data can be sniffed from network ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24060/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-24060 (CRITICAL): WebCTRL Premium Server sends BACnet data in cleartext, risking interception & modification. No patch yet — segment OT networks & use VPNs for BACnet traffic. Monitor for sniffing, restrict access. Details: https://radar.offseq.com/threat/cve-2026-24060-cwe-319-in-automated-logic-webctrl--ad487a9d #OffSeq #ICS #Vuln #BACnet

🛡️ CVE-2026-4601: CRITICAL bug in jsrsasign <11.1.1 misses a vital DSA signing step, letting attackers recover private keys if exploited. No active attacks yet, but update ASAP! Details: https://radar.offseq.com/threat/cve-2026-4601-missing-cryptographic-step-in-jsrsas-1b19c447 #OffSeq #CVE20264601 #Crypto #Vuln

🟠 CVE-2026-4601 - High (8.7)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zer...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4601/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ CVE-2026-4601: CRITICAL bug in jsrsasign <11.1.1 misses a vital DSA signing step, letting attackers recover private keys if exploited. No active attacks yet, but update ASAP! Details: https://radar.offseq.com/threat/cve-2026-4601-missing-cryptographic-step-in-jsrsas-1b19c447 #OffSeq #CVE20264601 #Crypto #Vuln

🟠 CVE-2026-4601 - High (8.7)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zer...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4601/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33297 - Critical (9.1)

WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33297/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33297 - Critical (9.1)

WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33297/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33297 - Critical (9.1)

WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33297/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33297 - Critical (9.1)

WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33297/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-46597 - High (7.5)

Bitcoin Core 0.13.0 through 29.x has an integer overflow.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-46597/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-46597 - High (7.5)

Bitcoin Core 0.13.0 through 29.x has an integer overflow.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-46597/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Posted yesterday, if you missed it:

WatchTower: A 32-Year-Old Bug Walks Into A Telnet Server (GNU inetutils Telnetd CVE-2026-32746 Pre-Auth RCE) https://labs.watchtowr.com/a-32-year-old-bug-walks-into-a-telnet-server-gnu-inetutils-telnetd-cve-2026-32746/ #infosec #threatresearch

🟠 CVE-2026-33043 - High (8.1)

WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Contro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33043/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33043 - High (8.1)

WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/phpsessionid.json.php exposes the current PHP session ID to any unauthenticated request. The allowOrigin() function reflects any Origin header back in Access-Contro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33043/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4434 - High (8.1)

Improper certificate validation in the PAM propagation WinRM connections
allows a network attacker to perform a man-in-the-middle attack via
disabled TLS certificate verification.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4434/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4434 - High (8.1)

Improper certificate validation in the PAM propagation WinRM connections
allows a network attacker to perform a man-in-the-middle attack via
disabled TLS certificate verification.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4434/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23554 - High (7.8)

The Intel EPT paging code uses an optimization to defer flushing of any cached
EPT state until the p2m lock is dropped, so that multiple modifications done
under the same locked region only issue a single flush.

Freeing of paging structures howev...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23554/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23554 - High (7.8)

The Intel EPT paging code uses an optimization to defer flushing of any cached
EPT state until the p2m lock is dropped, so that multiple modifications done
under the same locked region only issue a single flush.

Freeing of paging structures howev...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23554/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23554 - High (7.8)

The Intel EPT paging code uses an optimization to defer flushing of any cached
EPT state until the p2m lock is dropped, so that multiple modifications done
under the same locked region only issue a single flush.

Freeing of paging structures howev...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23554/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23554 - High (7.8)

The Intel EPT paging code uses an optimization to defer flushing of any cached
EPT state until the p2m lock is dropped, so that multiple modifications done
under the same locked region only issue a single flush.

Freeing of paging structures howev...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23554/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22163 - High (7.8)

Requires malware code to misuse the DDK kernel module IOCTL interface.

Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages.

The product utilises a shared re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22163/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22163 - High (7.8)

Requires malware code to misuse the DDK kernel module IOCTL interface.

Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages.

The product utilises a shared re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22163/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22163 - High (7.8)

Requires malware code to misuse the DDK kernel module IOCTL interface.

Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages.

The product utilises a shared re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22163/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22163 - High (7.8)

Requires malware code to misuse the DDK kernel module IOCTL interface.

Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages.

The product utilises a shared re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22163/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21732 - Critical (9.6)

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21732/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21732 - Critical (9.6)

A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash in the GPU shader compiler library. On certain platforms, when the compiler process has system privileges th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21732/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67260 - High (8.8)

The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.2020091...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67260/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67260 - High (8.8)

The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.2020091...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67260/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-63261 - High (7.8)

AWStats 8.0 is vulnerable to Command Injection via the open function

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-63261/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-63261 - High (7.8)

AWStats 8.0 is vulnerable to Command Injection via the open function

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-63261/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-03-16 - 2026-03-23)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1444

Severity:
- Critical: 89
- High: 472
- Medium: 648
- Low: 83
- None: 152

Status:
- : 57
- Analyzed: 366
- Awaiting Analysis: 475
- Modified: 12
- Received: 339
- Rejected: 13
- Undergoing Analysis: 182

Top CNAs:
- GitHub, Inc.: 376
- VulnCheck: 209
- VulDB: 151
- Wordfence: 133
- MITRE: 72
- N/A: 57
- kernel.org: 45
- Patchstack: 39
- Chrome: 26
- Zero Day Initiative: 23

Top Affected Products:
- UNKNOWN: 994
- Openclaw: 79
- Google Chrome: 26
- Mattermost Server: 20
- Canva Affinity: 19
- Dlink Dns-321 Firmware: 15
- Dlink Dns-320 Firmware: 15
- Dlink Dns-345 Firmware: 15
- Dlink Dns-326 Firmware: 15
- Dlink Dns-1100-4 Firmware: 15

Top EPSS Score:
- CVE-2026-2493 - 15.24 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2493)
- CVE-2025-71260 - 6.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-71260)
- CVE-2025-71257 - 3.58 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-71257)
- CVE-2026-32596 - 2.26 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-32596)
- CVE-2026-32583 - 2.09 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-32583)
- CVE-2026-4497 - 1.91 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4497)
- CVE-2025-71259 - 1.87 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-71259)
- CVE-2025-15060 - 1.71 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-15060)
- CVE-2025-71258 - 1.62 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-71258)
- CVE-2026-3838 - 1.57 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3838)

📈 CVE Published in last 7 days (2026-03-16 - 2026-03-23)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1444

Severity:
- Critical: 89
- High: 472
- Medium: 648
- Low: 83
- None: 152

Status:
- : 57
- Analyzed: 366
- Awaiting Analysis: 475
- Modified: 12
- Received: 339
- Rejected: 13
- Undergoing Analysis: 182

Top CNAs:
- GitHub, Inc.: 376
- VulnCheck: 209
- VulDB: 151
- Wordfence: 133
- MITRE: 72
- N/A: 57
- kernel.org: 45
- Patchstack: 39
- Chrome: 26
- Zero Day Initiative: 23

Top Affected Products:
- UNKNOWN: 994
- Openclaw: 79
- Google Chrome: 26
- Mattermost Server: 20
- Canva Affinity: 19
- Dlink Dns-321 Firmware: 15
- Dlink Dns-320 Firmware: 15
- Dlink Dns-345 Firmware: 15
- Dlink Dns-326 Firmware: 15
- Dlink Dns-1100-4 Firmware: 15

Top EPSS Score:
- CVE-2026-2493 - 15.24 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2493)
- CVE-2025-71260 - 6.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-71260)
- CVE-2025-71257 - 3.58 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-71257)
- CVE-2026-32596 - 2.26 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-32596)
- CVE-2026-32583 - 2.09 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-32583)
- CVE-2026-4497 - 1.91 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4497)
- CVE-2025-71259 - 1.87 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-71259)
- CVE-2025-15060 - 1.71 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-15060)
- CVE-2025-71258 - 1.62 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-71258)
- CVE-2026-3838 - 1.57 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3838)

🟠 CVE-2026-31904 - High (7.5)

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charge...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31904/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33180 - High (7.5)

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.0, when setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33243 - High (8.2)

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2025.09.3 and from version 2025.10.0 to before version 2026.03.1, when creating a FIT, mkimage(1) sets the hashed-nodes property of the FIT signature node to list which n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33243/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32064 - High (7.7)

OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32064/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1313 - High (8.3)

The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.20. This is due to the plugin making outbound HTTP requests to user-controlled URLs without proper validation when...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1313/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

MimeTypes Link Icons plugin (≤3.2.20) hit by HIGH severity SSRF (CVE-2026-1313, CVSS 8.3). Contributor+ users can abuse "Show file size" to access internal resources. Disable the feature & check user roles. https://radar.offseq.com/threat/cve-2026-1313-cwe-918-server-side-request-forgery--530406e8 #OffSeq #WordPress #SSRF #CVE20261313

🟠 CVE-2026-2468 - High (7.5)

The Quentn WP plugin for WordPress is vulnerable to SQL Injection via the 'qntn_wp_access' cookie in all versions up to, and including, 1.2.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2468/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2941 - High (8.8)

The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1.0.4. This make...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 HIGH severity SSRF in qrolic Performance Monitor (WordPress, all versions). Unauthenticated attackers can craft internal requests via REST API — RCE possible if chained with Redis. Urgent patch/mitigation needed! CVE-2026-1648. https://radar.offseq.com/threat/cve-2026-1648-cwe-918-server-side-request-forgery--062101f6 #OffSeq #WordPress #SSRF

🟠 CVE-2026-33172 - High (8.7)

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33172/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33172 - High (8.7)

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, a stored XSS vulnerability in SVG asset reuploads allows authenticated users with asset upload permissions to bypass SVG sanitization and i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33172/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23536 - High (7.5)

A security issue was discovered in the Feast Feature Server's `/read-document` endpoint that allows an unauthenticated remote attacker to read any file accessible to the server process. By sending a specially crafted HTTP POST request, an attacker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23536/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33142 - High (8.1)

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggregate query parameters) added column name validation to the _aggregateBy method but did not...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33142/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33156 - High (7.8)

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33156/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32969 - High (7.5)

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32969 - High (7.5)

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2026-025
Helmholz: Multiple Vulnerabilities in myREX24V2 / myREX24V2.virtual

Multiple vulnerabilities have been discovered in Helmholz myREX24V2 / myREX24V2.virtual that could allow unauthenticated RCE or SQLi.
#CVE CVE-2026-32968, CVE-2026-32969

https://certvde.com/en/advisories/vde-2026-025/

#CSAF https://helmholz.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-025.json

#OT #Advisory VDE-2026-024
MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow unauthenticated RCE or SQLi.
#CVE CVE-2026-32968, CVE-2026-32969

https://certvde.com/en/advisories/vde-2026-024/

#CSAF https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-024.json

🟠 CVE-2026-32969 - High (7.5)

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32969 - High (7.5)

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2026-025
Helmholz: Multiple Vulnerabilities in myREX24V2 / myREX24V2.virtual

Multiple vulnerabilities have been discovered in Helmholz myREX24V2 / myREX24V2.virtual that could allow unauthenticated RCE or SQLi.
#CVE CVE-2026-32968, CVE-2026-32969

https://certvde.com/en/advisories/vde-2026-025/

#CSAF https://helmholz.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-025.json

#OT #Advisory VDE-2026-024
MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow unauthenticated RCE or SQLi.
#CVE CVE-2026-32968, CVE-2026-32969

https://certvde.com/en/advisories/vde-2026-024/

#CSAF https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-024.json

🚨 HIGH: CVE-2026-4565 — Tenda AC21 (16.03.08.16) has a remote buffer overflow in /goform/SetNetControlList. Public exploit out; full device compromise possible. Disable WAN admin, monitor, and segment networks ASAP. https://radar.offseq.com/threat/cve-2026-4565-buffer-overflow-in-tenda-ac21-5d23ce15 #OffSeq #Vulnerability #NetSec #Router

🟠 CVE-2026-4565 - High (8.8)

A vulnerability was detected in Tenda AC21 16.03.08.16. Impacted is the function formSetQosBand of the file /goform/SetNetControlList. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4565/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 HIGH: CVE-2026-4565 — Tenda AC21 (16.03.08.16) has a remote buffer overflow in /goform/SetNetControlList. Public exploit out; full device compromise possible. Disable WAN admin, monitor, and segment networks ASAP. https://radar.offseq.com/threat/cve-2026-4565-buffer-overflow-in-tenda-ac21-5d23ce15 #OffSeq #Vulnerability #NetSec #Router

🟠 CVE-2026-4565 - High (8.8)

A vulnerability was detected in Tenda AC21 16.03.08.16. Impacted is the function formSetQosBand of the file /goform/SetNetControlList. Performing a manipulation of the argument list results in buffer overflow. The attack can be initiated remotely....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4565/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4534 - High (8.8)

A flaw has been found in Tenda FH451 1.0.0.9. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. This manipulation of the argument GO causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ New security advisory:

CVE-2026-4534 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-4534-tenda-fh451-buffer-overflow-update-firmware

#Cybersecurity #PatchNow #InfoSecCommunity

🔎 CVE-2026-4534 (HIGH, CVSS 8.7): Stack-based buffer overflow in Tenda FH451 (v1.0.0.9) lets remote attackers execute code. PoC exploit published. Patch/mitigate now — restrict access & monitor for attacks. Info: https://radar.offseq.com/threat/cve-2026-4534-stack-based-buffer-overflow-in-tenda-65a33e73 #OffSeq #Vulnerability #Tenda #InfoSec

🟠 CVE-2026-4534 - High (8.8)

A flaw has been found in Tenda FH451 1.0.0.9. This affects the function formWrlExtraSet of the file /goform/WrlExtraSet. This manipulation of the argument GO causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 CVE-2026-4534 (HIGH, CVSS 8.7): Stack-based buffer overflow in Tenda FH451 (v1.0.0.9) lets remote attackers execute code. PoC exploit published. Patch/mitigate now — restrict access & monitor for attacks. Info: https://radar.offseq.com/threat/cve-2026-4534-stack-based-buffer-overflow-in-tenda-65a33e73 #OffSeq #Vulnerability #Tenda #InfoSec

🟠 CVE-2026-4553 - High (8.8)

A vulnerability was identified in Tenda F453 1.0.0.3. Impacted is the function fromNatlimit of the file /goform/Natlimit of the component Parameters Handler. The manipulation of the argument page leads to stack-based buffer overflow. It is possibl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4553/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4553 - High (8.8)

A vulnerability was identified in Tenda F453 1.0.0.3. Impacted is the function fromNatlimit of the file /goform/Natlimit of the component Parameters Handler. The manipulation of the argument page leads to stack-based buffer overflow. It is possibl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4553/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4555 - High (8.8)

A weakness has been identified in D-Link DIR-513 1.10. The impacted element is the function formEasySetTimezone of the file /goform/formEasySetTimezone of the component boa. This manipulation of the argument curTime causes stack-based buffer overf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4555/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4555 - High (8.8)

A weakness has been identified in D-Link DIR-513 1.10. The impacted element is the function formEasySetTimezone of the file /goform/formEasySetTimezone of the component boa. This manipulation of the argument curTime causes stack-based buffer overf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4555/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-4543: Wavlink WL-WN578W2 (v221110) has a MEDIUM severity command injection flaw in /cgi-bin/firewall.cgi. No patch; public exploit exists. Isolate, restrict access, and monitor traffic urgently. https://radar.offseq.com/threat/cve-2026-4543-command-injection-in-wavlink-wl-wn57-50f96d33 #OffSeq #Infosec #Vulnerability #Router

⚠️ CVE-2026-4543: Wavlink WL-WN578W2 (v221110) has a MEDIUM severity command injection flaw in /cgi-bin/firewall.cgi. No patch; public exploit exists. Isolate, restrict access, and monitor traffic urgently. https://radar.offseq.com/threat/cve-2026-4543-command-injection-in-wavlink-wl-wn57-50f96d33 #OffSeq #Infosec #Vulnerability #Router

🟠 CVE-2026-4373 - High (7.5)

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Me...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 JetFormBuilder for WordPress is HIGH risk (CVE-2026-4373): Absolute path traversal in all versions allows unauth attackers to exfiltrate files via crafted Media Field form. Review & secure deployments! https://radar.offseq.com/threat/cve-2026-4373-cwe-36-absolute-path-traversal-in-je-12b1586f #OffSeq #WordPress #infosec

🔴 CVE-2026-4585 - Critical (9.8)

A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp of the component Configuration Handler. The manipu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4585/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4585 - Critical (9.8)

A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp of the component Configuration Handler. The manipu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4585/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4585 - Critical (9.8)

A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp of the component Configuration Handler. The manipu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4585/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4585 - Critical (9.8)

A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/ImportSystemConfiguration.jsp of the component Configuration Handler. The manipu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4585/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32968 - Critical (9.8)

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32968/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2026-025
Helmholz: Multiple Vulnerabilities in myREX24V2 / myREX24V2.virtual

Multiple vulnerabilities have been discovered in Helmholz myREX24V2 / myREX24V2.virtual that could allow unauthenticated RCE or SQLi.
#CVE CVE-2026-32968, CVE-2026-32969

https://certvde.com/en/advisories/vde-2026-025/

#CSAF https://helmholz.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-025.json

#OT #Advisory VDE-2026-024
MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow unauthenticated RCE or SQLi.
#CVE CVE-2026-32968, CVE-2026-32969

https://certvde.com/en/advisories/vde-2026-024/

#CSAF https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-024.json

🔴 CVE-2026-32968 - Critical (9.8)

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32968/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2026-025
Helmholz: Multiple Vulnerabilities in myREX24V2 / myREX24V2.virtual

Multiple vulnerabilities have been discovered in Helmholz myREX24V2 / myREX24V2.virtual that could allow unauthenticated RCE or SQLi.
#CVE CVE-2026-32968, CVE-2026-32969

https://certvde.com/en/advisories/vde-2026-025/

#CSAF https://helmholz.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-025.json

#OT #Advisory VDE-2026-024
MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow unauthenticated RCE or SQLi.
#CVE CVE-2026-32968, CVE-2026-32969

https://certvde.com/en/advisories/vde-2026-024/

#CSAF https://mbconnectline.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-024.json

WAGO 852-1812 switch hit with CRITICAL CVE-2026-3587 (CVSS 10.0): hidden CLI lets remote attackers gain root with no auth. No patch yet. Isolate, restrict access, & monitor closely. https://radar.offseq.com/threat/cve-2026-3587-cwe-912-hidden-functionality-in-wago-a4c55a72 #OffSeq #ICS #Infosec #Vulnerability

🔴 CVE-2026-3587 - Critical (10)

An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface and gain root access to the underlying Linux based OS, leading to full compromise of the device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3587/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2026-020
WAGO: Vulnerability in managed switches

A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.
#CVE CVE-2026-3587

https://certvde.com/en/advisories/vde-2026-020/

#CSAF https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-020.json

WAGO 852-1812 switch hit with CRITICAL CVE-2026-3587 (CVSS 10.0): hidden CLI lets remote attackers gain root with no auth. No patch yet. Isolate, restrict access, & monitor closely. https://radar.offseq.com/threat/cve-2026-3587-cwe-912-hidden-functionality-in-wago-a4c55a72 #OffSeq #ICS #Infosec #Vulnerability

🔴 CVE-2026-3587 - Critical (10)

An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface and gain root access to the underlying Linux based OS, leading to full compromise of the device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3587/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2026-020
WAGO: Vulnerability in managed switches

A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.
#CVE CVE-2026-3587

https://certvde.com/en/advisories/vde-2026-020/

#CSAF https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-020.json

🔥 CRITICAL: CVE-2026-4599 in jsrsasign 7.0.0 – 11.1.1 lets attackers recover private keys via DSA nonce bias. No auth needed — patch ASAP or add nonce checks! https://radar.offseq.com/threat/cve-2026-4599-incomplete-comparison-with-missing-f-9aee8aa7 #OffSeq #Vulnerability #Cryptography #CVE20264599

🔴 CVE-2026-4599 - Critical (9.1)

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recove...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4599/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4599 - Critical (9.1)

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recove...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4599/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 CRITICAL: CVE-2026-4599 in jsrsasign 7.0.0 – 11.1.1 lets attackers recover private keys via DSA nonce bias. No auth needed — patch ASAP or add nonce checks! https://radar.offseq.com/threat/cve-2026-4599-incomplete-comparison-with-missing-f-9aee8aa7 #OffSeq #Vulnerability #Cryptography #CVE20264599

🔴 CVE-2026-4599 - Critical (9.1)

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recove...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4599/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4599 - Critical (9.1)

Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recove...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4599/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4598 - High (7.5)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4598/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4598 - High (7.5)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4598/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4598 - High (7.5)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4598/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4598 - High (7.5)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Infinite loop via the bnModInverse function in ext/jsbn2.js when the BigInteger.modInverse implementation receives zero or negative inputs, allowing an attacker to hang the process ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4598/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4602 - High (7.5)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signatur...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4602/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4602 - High (7.5)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signatur...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4602/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4602 - High (7.5)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signatur...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4602/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4602 - High (7.5)

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to handling negative exponents in ext/jsbn2.js. An attacker can force the computation of incorrect modular inverses and break signatur...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4602/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-4606 in GeoVision GV-Edge Recording Manager 2.3.1 allows any local user to escalate to SYSTEM privileges (CVSS 10.0). Patch or restrict local access now! https://radar.offseq.com/threat/cve-2026-4606-cwe-250-execution-with-unnecessary-p-39d565c1 #OffSeq #Vulnerability #WindowsSecurity #GeoVision

🚨 CRITICAL: CVE-2026-4606 in GeoVision GV-Edge Recording Manager 2.3.1 allows any local user to escalate to SYSTEM privileges (CVSS 10.0). Patch or restrict local access now! https://radar.offseq.com/threat/cve-2026-4606-cwe-250-execution-with-unnecessary-p-39d565c1 #OffSeq #Vulnerability #WindowsSecurity #GeoVision

🟠 CVE-2026-4566 - High (8.8)

A flaw has been found in Belkin F9K1122 1.00.33. The affected element is the function formWISP5G of the file /goform/formWISP5G. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack can be launched r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4566/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4566 - High (8.8)

A flaw has been found in Belkin F9K1122 1.00.33. The affected element is the function formWISP5G of the file /goform/formWISP5G. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack can be launched r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4566/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4566 - High (8.8)

A flaw has been found in Belkin F9K1122 1.00.33. The affected element is the function formWISP5G of the file /goform/formWISP5G. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack can be launched r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4566/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4566 - High (8.8)

A flaw has been found in Belkin F9K1122 1.00.33. The affected element is the function formWISP5G of the file /goform/formWISP5G. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack can be launched r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4566/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 New security advisory:

CVE-2026-4567 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-4567-tenda-a15-buffer-overflow-vulnerability-update-firmware-now

#Cybersecurity #PatchNow #InfoSecCommunity

🔴 CVE-2026-4567 - Critical (9.8)

A vulnerability has been found in Tenda A15 15.13.07.13. The impacted element is the function UploadCfg of the file /cgi-bin/UploadCfg. The manipulation of the argument File leads to stack-based buffer overflow. The attack may be initiated remotel...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4567/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 CVE-2026-4567: Critical stack buffer overflow in Tenda A15 (v15.13.07.13). Remote, unauthenticated code execution possible via /cgi-bin/UploadCfg. Patch or restrict access immediately! https://radar.offseq.com/threat/cve-2026-4567-stack-based-buffer-overflow-in-tenda-27ff1845 #OffSeq #infosec #routersecurity #CVE20264567

🔴 CVE-2026-4567 - Critical (9.8)

A vulnerability has been found in Tenda A15 15.13.07.13. The impacted element is the function UploadCfg of the file /cgi-bin/UploadCfg. The manipulation of the argument File leads to stack-based buffer overflow. The attack may be initiated remotel...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4567/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 CVE-2026-4567: Critical stack buffer overflow in Tenda A15 (v15.13.07.13). Remote, unauthenticated code execution possible via /cgi-bin/UploadCfg. Patch or restrict access immediately! https://radar.offseq.com/threat/cve-2026-4567-stack-based-buffer-overflow-in-tenda-27ff1845 #OffSeq #infosec #routersecurity #CVE20264567

🟠 CVE-2026-2580 - High (7.5)

The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.9.1 due to insufficie...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2580/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity alert: CVE-2026-2580 – SQL Injection in flippercode WP Maps plugin for WordPress (all versions). Unauthenticated attackers can exfiltrate data via 'orderby'. Patch or mitigate ASAP. https://radar.offseq.com/threat/cve-2026-2580-cwe-89-improper-neutralization-of-sp-b93f1b1b #OffSeq #WordPress #Vuln #SQLi

🟠 CVE-2026-2580 - High (7.5)

The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.9.1 due to insufficie...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2580/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity alert: CVE-2026-2580 – SQL Injection in flippercode WP Maps plugin for WordPress (all versions). Unauthenticated attackers can exfiltrate data via 'orderby'. Patch or mitigate ASAP. https://radar.offseq.com/threat/cve-2026-2580-cwe-89-improper-neutralization-of-sp-b93f1b1b #OffSeq #WordPress #Vuln #SQLi

🟠 New security advisory:

CVE-2026-4558 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-4558-linksys-mr9600-os-command-injection-update-now

#Cybersecurity #PatchNow #InfoSecCommunity

🟠 CVE-2026-4558 - High (8.8)

A flaw has been found in Linksys MR9600 2.0.6.206937. Affected is the function smartConnectConfigure of the file SmartConnect.lua. Executing a manipulation of the argument configApSsid/configApPassphrase/srpLogin/srpPassword can lead to os command...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4558 - High (8.8)

A flaw has been found in Linksys MR9600 2.0.6.206937. Affected is the function smartConnectConfigure of the file SmartConnect.lua. Executing a manipulation of the argument configApSsid/configApPassphrase/srpLogin/srpPassword can lead to os command...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4552 - High (8.8)

A vulnerability was determined in Tenda F453 1.0.0.3. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component Parameters Handler. Executing a manipulation of the argument page can lead to stack-based buffer o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4552/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4552 - High (8.8)

A vulnerability was determined in Tenda F453 1.0.0.3. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component Parameters Handler. Executing a manipulation of the argument page can lead to stack-based buffer o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4552/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4551 - High (8.8)

A vulnerability was found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeClientFilter of the component Parameters Handler. Performing a manipulation of the argument menufacturer/Go resul...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4551 - High (8.8)

A vulnerability was found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeClientFilter of the component Parameters Handler. Performing a manipulation of the argument menufacturer/Go resul...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ CVE-2026-4540: MEDIUM-severity SQL Injection in projectworlds Online Notes Sharing System v1.0. Exploit code is public, no active attacks yet. Patch or mitigate — focus on the 'Benutzer' param in /login.php. More info: https://radar.offseq.com/threat/cve-2026-4540-sql-injection-in-projectworlds-onlin-4351ab2e #OffSeq #SQLInjection #Vuln

🛡️ CVE-2026-4540: MEDIUM-severity SQL Injection in projectworlds Online Notes Sharing System v1.0. Exploit code is public, no active attacks yet. Patch or mitigate — focus on the 'Benutzer' param in /login.php. More info: https://radar.offseq.com/threat/cve-2026-4540-sql-injection-in-projectworlds-onlin-4351ab2e #OffSeq #SQLInjection #Vuln

🟠 CVE-2026-4314 - High (8.8)

The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the `isDashboardOrProfileRequest()` method in the Menu Editor module using ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4314/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4314 - High (8.8)

The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the `isDashboardOrProfileRequest()` method in the Menu Editor module using ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4314/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4535 - High (8.8)

A vulnerability has been found in Tenda FH451 1.0.0.9. This vulnerability affects the function WrlclientSet of the file /goform/WrlclientSet. Such manipulation of the argument GO leads to stack-based buffer overflow. The attack can be launched rem...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4535/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: CVE-2026-4535 in Tenda FH451 (v1.0.0.9) — stack-based buffer overflow in /goform/WrlclientSet. Remote, unauthenticated code execution possible. Patch or mitigate now! https://radar.offseq.com/threat/cve-2026-4535-stack-based-buffer-overflow-in-tenda-8f2fc263 #OffSeq #vulnerability #IoT #bufferOverflow

🟠 CVE-2026-4535 - High (8.8)

A vulnerability has been found in Tenda FH451 1.0.0.9. This vulnerability affects the function WrlclientSet of the file /goform/WrlclientSet. Such manipulation of the argument GO leads to stack-based buffer overflow. The attack can be launched rem...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4535/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: CVE-2026-4535 in Tenda FH451 (v1.0.0.9) — stack-based buffer overflow in /goform/WrlclientSet. Remote, unauthenticated code execution possible. Patch or mitigate now! https://radar.offseq.com/threat/cve-2026-4535-stack-based-buffer-overflow-in-tenda-8f2fc263 #OffSeq #vulnerability #IoT #bufferOverflow

⚠️ MEDIUM: CVE-2026-4533 in code-projects Simple Food Ordering System v1.0 allows unauthenticated SQL injection via 'Status' in all-tickets.php. Public exploit code exists — patch or mitigate now! https://radar.offseq.com/threat/cve-2026-4533-sql-injection-in-code-projects-simpl-c9dcca98 #OffSeq #Infosec #SQLInjection #CVE2026_4533

⚠️ MEDIUM: CVE-2026-4533 in code-projects Simple Food Ordering System v1.0 allows unauthenticated SQL injection via 'Status' in all-tickets.php. Public exploit code exists — patch or mitigate now! https://radar.offseq.com/threat/cve-2026-4533-sql-injection-in-code-projects-simpl-c9dcca98 #OffSeq #Infosec #SQLInjection #CVE2026_4533

⚠️ CVE-2026-3629: HIGH severity in carazo's 'Import and export users and customers' WP plugin (≤1.29.7). Privilege escalation to admin possible if 'Show fields in profile' is on and CSV with 'wp_capabilities' imported. Mitigate now! https://radar.offseq.com/threat/cve-2026-3629-cwe-269-improper-privilege-managemen-61196a39 #OffSeq #WordPress #Infosec

🟠 CVE-2026-3629 - High (8.1)

The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7. This is due to the 'save_extra_user_profile_fields' function not properly restricting which user met...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3629/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-4529: HIGH severity stack-based buffer overflow in D-Link DHP-1320 (1.00WWB04) via SOAP Handler. Public exploit out. Device is EOL, no patch — isolate or replace now! https://radar.offseq.com/threat/cve-2026-4529-stack-based-buffer-overflow-in-d-lin-7f100378 #OffSeq #Vulnerability #DLink #BufferOverflow #InfoSec

🟠 CVE-2026-4529 - High (8.8)

A vulnerability was identified in D-Link DHP-1320 1.00WWB04. This affects the function redirect_count_down_page of the component SOAP Handler. Such manipulation leads to stack-based buffer overflow. The attack can be executed remotely. The exploit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4529/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

https://www.cve.org/CVERecord?id=CVE-2025-71263

#CVE being used as intended.

#ATT #Unixv4 #BellLabs

🟠 CVE-2026-4261 - High (8.8)

The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2. This is due to the plugin allowing a user to update the 'on_expire_default_to_role' meta through the 'save_extra_user_profile_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4261/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 HIGH severity: CVE-2026-4261 in Expire Users (WordPress, all versions) lets Subscribers escalate to Admin via missing authorization in 'save_extra_user_profile_fields'. Patch urgently or mitigate! https://radar.offseq.com/threat/cve-2026-4261-cwe-862-missing-authorization-in-hus-fa4ebb4d #OffSeq #WordPress #Vuln #Security

🔎 CVE-2026-3478: HIGH severity SSRF in benmoody Content Syndication Toolkit (WordPress, all versions). Unauthenticated AJAX endpoint lets attackers proxy requests, risking internal data exposure. Disable plugin or block endpoint! https://radar.offseq.com/threat/cve-2026-3478-cwe-918-server-side-request-forgery--aeeaf0a3 #OffSeq #WordPress #SSRF

🟠 CVE-2026-1800 - High (7.5)

The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSelectedFnt’ parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1800/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3334 - High (8.8)

The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up to, and including, 2.288. This is due to insufficient escaping on the user suppli...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3334/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-14037 - High (8.1)

The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This is due to missing validation and sanitization in the 'createManageFeedPage' function. Thi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14037/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32056 - High (7.5)

OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious startup files ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32042 - High (8.8)

OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requirements and self-assign elevated operator scopes including operator.admin. Attackers wi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32048 - High (7.5)

OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session can exploit ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32048/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32051 - High (8.8)

OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only tool surfaces including gateway and cron through agent runs in scoped-token deploy...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32051/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3584 - Critical (9.8)

The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into intern...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3584/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3584 - Critical (9.8)

The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into intern...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3584/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25192 - Critical (9.4)

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a kno...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25192/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-25192 (CRITICAL, CVSS 9.4): All CTEK Chargeportal versions lack authentication on OCPP WebSocket endpoints. Enables remote station impersonation & command injection. Restrict network access and monitor closely! https://radar.offseq.com/threat/cve-2026-25192-cwe-306-in-ctek-chargeportal-a1a8a9ed #OffSeq #EVSecurity #CVE202625192

🔴 CVE-2026-29796 - Critical (9.4)

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a kno...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29796/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-29796 affects all IGL-Technologies eParking.fi versions. Missing WebSocket auth allows attackers to impersonate charging stations, disrupt operations, and corrupt data. Restrict access, monitor traffic, and secure now! https://radar.offseq.com/threat/cve-2026-29796-cwe-306-in-igl-technologies-eparkin-fcf429f8 #OffSeq #EVCharging #Infosec

IGL-Technologies Patches Critical Authentication Bypass in eParking.fi Platform

IGL-Technologies patched four vulnerabilities in its eParking.fi platform, including a critical authentication bypass (CVE-2026-29796) that allows attackers to impersonate EV charging stations and gain administrative control.

**Isolate your EV charging infrastructure as much as possible from the public internet and public network access. Verify that your hardware supports the vendor's new security profiles. Since station identifiers were leaked on public maps, you should treat existing IDs as compromised and implement device whitelisting.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/igl-technologies-patches-critical-authentication-bypass-in-eparking-fi-platform-a-5-9-c-q/gD2P6Ple2L

🟠 CVE-2026-32666 - High (7.5)

WebCTRL systems that communicate over BACnet inherit the protocol's lack
of network layer authentication. WebCTRL does not implement additional
validation of BACnet traffic so an attacker with network access could
spoof BACnet packets directed ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32666/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25086 - High (7.7)

Under certain conditions, an attacker could bind to the same port used
by WebCTRL. This could allow the attacker to craft and send malicious
packets and impersonate the WebCTRL service without requiring code
injection into the WebCTRL software.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25086/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33154 - High (7.5)

dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaco...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33154/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33010 - High (8.1)

mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.25.1, when the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_cre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33010/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:0320] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0320)

CISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-31277 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-31277)
- Name: Apple Multiple Products Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/124147 ; https://support.apple.com/en-us/124149 ; https://support.apple.com/en-us/124152 ; https://support.apple.com/en-us/124153 ; https://support.apple.com/en-us/124155 ; https://nvd.nist.gov/vuln/detail/CVE-2025-31277

⚠️ CVE-2025-32432 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-32432)
- Name: Craft CMS Code Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Craft CMS
- Product: Craft CMS
- Notes: https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432 ; https://github.com/craftcms/cms/security/advisories/GHSA-f3gw-9ww9-jmc3 ; https://nvd.nist.gov/vuln/detail/CVE-2025-32432

⚠️ CVE-2025-43510 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-43510)
- Name: Apple Multiple Products Improper Locking Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/125632 ; https://support.apple.com/en-us/125633 ; https://support.apple.com/en-us/125634 ; https://support.apple.com/en-us/125635 ; https://support.apple.com/en-us/125636 ; https://support.apple.com/en-us/125637 ; https://support.apple.com/en-us/125638 ; https://support.apple.com/en-us/125639 ; https://nvd.nist.gov/vuln/detail/CVE-2025-43510

⚠️ CVE-2025-43520 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-43520)
- Name: Apple Multiple Products Classic Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/125632 ; https://support.apple.com/en-us/125633 ; https://support.apple.com/en-us/125634 ; https://support.apple.com/en-us/125635 ; https://support.apple.com/en-us/125636 ; https://support.apple.com/en-us/125637 ; https://support.apple.com/en-us/125638 ; https://support.apple.com/en-us/125639 ; https://nvd.nist.gov/vuln/detail/CVE-2025-43520

⚠️ CVE-2025-54068 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-54068)
- Name: Laravel Livewire Code Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Laravel
- Product: Livewire
- Notes: https://github.com/livewire/livewire/security/advisories/GHSA-29cq-5w36-x7w3 ; https://github.com/livewire/livewire/commit/ef04be759da41b14d2d129e670533180a44987dc ; https://nvd.nist.gov/vuln/detail/CVE-2025-54068

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260320 #cisa20260320 #cve_2025_31277 #cve_2025_32432 #cve_2025_43510 #cve_2025_43520 #cve_2025_54068 #cve202531277 #cve202532432 #cve202543510 #cve202543520 #cve202554068

🟠 CVE-2026-33128 - High (7.5)

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and format...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

RAXE-2026-040: Claude Code Workspace Trust Dialog Bypass via Repository Settings (CVE-2026-33068) | RAXE Labs

https://raxe.ai/labs/advisories/RAXE-2026-040

Short summary: https://hackerworkspace.com/article/raxe-2026-040-claude-code-workspace-trust-dialog-bypass-via-repository-settings-cve-2026-33068-raxe-labs

#cybersecurity #vulnerability #exploit

Claude Code workspace trust dialog bypass via repository settings loading order [CVE-2026-33068, CVSS 7.7]. Settings resolved before trust dialog shown. https://raxe.ai/labs/advisories/RAXE-2026-040

🔴 CVE-2026-33057 - Critical (9.8)

Mesop is a Python-based UI framework that allows users to build web applications. In versions 1.2.2 and below, an explicit web endpoint inside the ai/ testing module infrastructure directly ingests untrusted Python code strings unconditionally wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33057/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33054 - Critical (10)

Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted state_token through the UI stream payload to arbitrarily ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33054/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33036 - High (7.5)

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33036/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33012 - High (7.5)

Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily testable JVM applications. Versions 4.7.0 through 4.10.16 used an unbounded ConcurrentHashMap cache with no eviction policy in its DefaultHtmlError...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33012/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32938 - Critical (9.9)

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the /api/lute/html2BlockDOM on the desktop copies local files pointed to by file:// links in pasted HTML into the workspace assets directory without validating paths ag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22172 - Critical (9.9)

OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding. Attackers ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22172/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33485 - High (7.5)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `plugin/Live/on_publish.php` is accessible without authentication. The `$_POST['name']` parameter (stream key) is interpolated di...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33485/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33485 - High (7.5)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `plugin/Live/on_publish.php` is accessible without authentication. The `$_POST['name']` parameter (stream key) is interpolated di...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33485/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33483 - High (7.5)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33483/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33483 - High (7.5)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` endpoint is a completely standalone PHP script with no authentication, no framework includes, and no resource limits. An unauthen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33483/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33482 - High (8.1)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangero...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33482/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33482 - High (8.1)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` function in `plugin/API/standAlone/functions.php` is designed to prevent OS command injection in ffmpeg commands by stripping dangero...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33482/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33480 - High (8.6)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33480 - High (8.6)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33479 - High (8.8)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Gallery plugin's `saveSort.json.php` endpoint passes unsanitized user input from `$_REQUEST['sections']` array values directly into PHP's `eval()` function. Wh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33479/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33479 - High (8.8)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Gallery plugin's `saveSort.json.php` endpoint passes unsanitized user input from `$_REQUEST['sections']` array values directly into PHP's `eval()` function. Wh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33479/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33478 - Critical (10)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The `clones.j...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33478/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33478 - Critical (10)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's CloneSite plugin chain together to allow a completely unauthenticated attacker to achieve remote code execution. The `clones.j...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33478/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack