| CVE | CVSS | EPSS | Posts | Repos | Nuclei | Updated | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-82475 | 8.1 | 0.00% | 2 | 0 | 2026-08-29T17:18:00.057000 | iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerabilit | |
| CVE-2026-82456 | 10.0 | 0.00% | 2 | 0 | 2026-08-29T15:30:27 | argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts | |
| CVE-2026-82454 | 9.1 | 0.00% | 2 | 0 | 2026-08-29T15:30:27 | The Omnivore API (packages/api) before the fix in commit abf53d6 contains an aut | |
| CVE-2026-82448 | 9.8 | 0.00% | 2 | 0 | 2026-08-29T15:30:20 | Shinobi before commit 5a76c74f contains a hardcoded connection key in the child | |
| CVE-2026-82457 | 7.8 | 0.00% | 2 | 0 | 2026-08-29T14:16:38.910000 | su-exec through 0.3 fails to validate numeric user and group identifiers parsed | |
| CVE-2026-82453 | 7.5 | 0.00% | 2 | 0 | 2026-08-29T14:16:38.347000 | rust-iot-platform through commit 5df942ab stores user passwords in cleartext wit | |
| CVE-2026-82452 | 9.8 | 0.00% | 2 | 0 | 2026-08-29T14:16:38.210000 | rust-iot-platform through commit 5df942ab contains an authentication bypass vuln | |
| CVE-2026-82450 | 8.8 | 0.00% | 2 | 0 | 2026-08-29T14:16:37.930000 | BookStack before 26.05.4 contains a remote code execution vulnerability in the p | |
| CVE-2026-82251 | 7.5 | 0.39% | 2 | 0 | 2026-08-29T14:16:37.677000 | gitoxide before 0.52.1 fails to validate submodule names from .gitmodules config | |
| CVE-2026-82447 | 8.8 | 0.00% | 2 | 0 | 2026-08-29T13:16:38.643000 | Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock | |
| CVE-2026-14494 | 9.8 | 0.00% | 2 | 0 | 2026-08-29T12:16:41.163000 | The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution | |
| CVE-2026-81578 | 0 | 0.39% | 3 | 2 | 2026-08-29T04:18:08 | An improper access control vulnerability exists in the web management interface | |
| CVE-2026-74820 | 0 | 0.25% | 4 | 0 | 2026-08-29T04:18:06.417000 | ServiceNow has remediated a SQL injection vulnerability that was identified in i | |
| CVE-2026-72984 | 8.8 | 0.44% | 2 | 0 | 2026-08-29T04:18:06.270000 | Access of resource using incompatible type ('type confusion') in Microsoft Edge | |
| CVE-2026-19313 | 0 | 0.47% | 2 | 0 | 2026-08-29T04:18:04.957000 | An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows | |
| CVE-2026-18886 | 0 | 0.25% | 4 | 0 | 2026-08-29T04:18:04.793000 | ServiceNow has remediated an improper access control vulnerability that was iden | |
| CVE-2026-41012 | 7.7 | 0.10% | 2 | 0 | 2026-08-29T03:31:04 | Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers | |
| CVE-2026-81533 | 7.1 | 0.21% | 2 | 0 | 2026-08-29T00:31:12 | An application using the MongoDB BI Connector ODBC Driver may encounter a memory | |
| CVE-2026-81490 | 7.7 | 0.24% | 3 | 0 | 2026-08-29T00:31:12 | A database user able to create a view in a namespace that MongoDB Connector for | |
| CVE-2026-81532 | 8.8 | 0.28% | 2 | 0 | 2026-08-29T00:31:12 | A user able to submit SQL through an application using the MongoDB Connector for | |
| CVE-2026-81518 | 7.5 | 0.15% | 2 | 0 | 2026-08-29T00:31:12 | When mongosqld is configured with a client certificate authority file, the liste | |
| CVE-2026-81520 | 7.5 | 0.24% | 3 | 0 | 2026-08-29T00:31:04 | A network-reachable client that has not yet authenticated can hold a MongoDB Con | |
| CVE-2026-19295 | 9.9 | 0.98% | 2 | 1 | 2026-08-29T00:31:03 | IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execut | |
| CVE-2026-18891 | 8.2 | 0.29% | 2 | 0 | 2026-08-29T00:31:02 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute a | |
| CVE-2026-18729 | 8.8 | 0.46% | 2 | 1 | 2026-08-29T00:31:02 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacke | |
| CVE-2026-19286 | 9.8 | 0.61% | 2 | 1 | 2026-08-29T00:31:02 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute a | |
| CVE-2026-18899 | 7.5 | 0.46% | 2 | 0 | 2026-08-29T00:31:02 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbi | |
| CVE-2026-17203 | 7.5 | 0.43% | 2 | 0 | 2026-08-29T00:31:01 | IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated | |
| CVE-2026-73108 | 7.5 | 0.53% | 1 | 0 | 2026-08-29T00:30:57 | RustDesk versions before 1.4.7 contain an uncontrolled speculative memory alloca | |
| CVE-2026-55784 | 7.5 | 0.25% | 3 | 0 | 2026-08-28T23:17:07.517000 | free5GC is an open-source implementation of the 5G core network. In version 1.4. | |
| CVE-2026-55848 | 8.6 | 0.33% | 2 | 0 | 2026-08-28T22:33:36 | ### Summary XXE on MapFish Print allows reading arbitrary files of certain types | |
| CVE-2026-82284 | 8.1 | 0.24% | 2 | 0 | 2026-08-28T22:16:56.650000 | Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/ | |
| CVE-2026-82278 | 8.8 | 0.56% | 2 | 0 | 2026-08-28T22:16:56.293000 | BISHENG before 2.6.0 contains a remote code execution vulnerability in the workf | |
| CVE-2026-82017 | 7.6 | 0.15% | 2 | 0 | 2026-08-28T22:16:55.067000 | IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry | |
| CVE-2026-81517 | 7.5 | 0.26% | 2 | 0 | 2026-08-28T22:16:54.383000 | An unauthenticated party able to reach the port of a MongoDB Connector for BI (m | |
| CVE-2026-55634 | 9.9 | 0.45% | 1 | 0 | 2026-08-28T22:16:51.290000 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.1 | |
| CVE-2026-3627 | 9.1 | 0.51% | 3 | 0 | 2026-08-28T22:16:49.063000 | IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacke | |
| CVE-2026-18904 | 8.2 | 0.31% | 2 | 0 | 2026-08-28T22:16:47.227000 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain se | |
| CVE-2026-18527 | 9.9 | 0.29% | 2 | 0 | 2026-08-28T22:16:46.620000 | IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (AR | |
| CVE-2026-55841 | 7.5 | 0.36% | 3 | 0 | 2026-08-28T22:13:01 | ### Impact A security issue has been identified in Graylog affecting the parsin | |
| CVE-2026-18885 | None | 0.43% | 6 | 0 | 2026-08-28T21:32:13 | ServiceNow has remediated a code injection vulnerability that was identified inย | |
| CVE-2026-82282 | 8.0 | 0.26% | 2 | 0 | 2026-08-28T21:31:36 | Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, al | |
| CVE-2026-82291 | 8.1 | 0.30% | 2 | 0 | 2026-08-28T21:31:36 | HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses w | |
| CVE-2026-82329 | 9.8 | 0.38% | 2 | 0 | 2026-08-28T21:31:36 | JFrog Artifactory contains an authentication weakness that, under default config | |
| CVE-2026-82275 | 7.5 | 0.37% | 2 | 0 | 2026-08-28T21:31:29 | Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the documen | |
| CVE-2026-82279 | 8.1 | 0.27% | 2 | 0 | 2026-08-28T21:31:29 | HyperDX through 1.10.1 fails to enforce role-based access controls in team manag | |
| CVE-2026-82288 | 7.5 | 0.32% | 2 | 0 | 2026-08-28T21:31:28 | Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerabi | |
| CVE-2026-82286 | 8.6 | 0.35% | 2 | 1 | 2026-08-28T21:31:28 | gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the | |
| CVE-2026-82283 | 8.1 | 0.24% | 2 | 0 | 2026-08-28T21:31:27 | VoltAgent through 2.1.20 fails to validate conversation ownership in memory API | |
| CVE-2026-82277 | 9.8 | 0.43% | 2 | 0 | 2026-08-28T21:31:26 | Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutat | |
| CVE-2026-82270 | 7.5 | 0.28% | 2 | 0 | 2026-08-28T21:31:25 | Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnera | |
| CVE-2026-82269 | 8.1 | 0.30% | 2 | 0 | 2026-08-28T21:31:25 | Gophish through 0.12.1 fails to enforce account lockout and password change requ | |
| CVE-2026-82268 | 7.5 | 0.28% | 2 | 0 | 2026-08-28T21:31:25 | Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability i | |
| CVE-2026-75124 | 7.5 | 0.48% | 2 | 0 | 2026-08-28T21:31:24 | PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication | |
| CVE-2026-75486 | 8.0 | 1.25% | 2 | 0 | 2026-08-28T21:31:24 | Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that a | |
| CVE-2026-82266 | 9.8 | 0.34% | 2 | 0 | 2026-08-28T21:31:23 | Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_requi | |
| CVE-2026-56100 | 8.1 | 0.29% | 2 | 0 | 2026-08-28T21:31:17 | SpringBlade versions 2.7.3 through 3.5.0 contain a privilege escalation vulnerab | |
| CVE-2026-77586 | 8.0 | 0.23% | 2 | 0 | 2026-08-28T21:16:15.740000 | In MongoDB Connector for BI, MongoDB object names such as collection, field, and | |
| CVE-2026-81525 | 8.1 | 0.27% | 4 | 0 | 2026-08-28T21:16:15.740000 | The MongoDB client library for PHP does not sufficiently sanitize special elemen | |
| CVE-2026-82287 | 8.1 | 0.28% | 2 | 0 | 2026-08-28T20:20:20.243000 | Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows a | |
| CVE-2026-82285 | 8.2 | 0.31% | 2 | 0 | 2026-08-28T20:20:19.953000 | bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability | |
| CVE-2026-82021 | 8.3 | 0.23% | 2 | 0 | 2026-08-28T20:20:14.470000 | Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its | |
| CVE-2026-81767 | 7.5 | 0.20% | 2 | 0 | 2026-08-28T20:20:13.023000 | Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions. | |
| CVE-2026-81699 | 7.5 | 0.35% | 1 | 0 | 2026-08-28T20:20:11.923000 | openssl_encrypt versions before 1.4.9 fail to properly validate key derivation f | |
| CVE-2026-81019 | 7.4 | 0.24% | 1 | 0 | 2026-08-28T20:20:08.670000 | wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when | |
| CVE-2026-77438 | 7.5 | 0.24% | 2 | 0 | 2026-08-28T20:19:55.927000 | Trilium is an open-source hierarchical note-taking application. In versions up t | |
| CVE-2026-76640 | 7.5 | 0.35% | 6 | 1 | 2026-08-28T20:19:54.877000 | Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities | |
| CVE-2026-76060 | 8.8 | 2.31% | 1 | 1 | 2026-08-28T20:19:54.620000 | An authenticated OS command injection vulnerability exists in ZoneMinder's event | |
| CVE-2026-66155 | 7.6 | 0.17% | 1 | 0 | 2026-08-28T19:03:37.837000 | A vulnerability has been identified in Element maps-ng V47 (All versions < V47.1 | |
| CVE-2026-76784 | 0 | 0.15% | 1 | 0 | 2026-08-28T19:02:53.760000 | Multiple TP-Link Kasa smart home devices contain insufficient cryptographic prot | |
| CVE-2026-75112 | 0 | 0.11% | 2 | 0 | 2026-08-28T18:58:27.140000 | A security issue exists within OTTOยฎ Fleet Manager. The vulnerability stems from | |
| CVE-2026-81728 | 8.1 | 0.26% | 2 | 0 | 2026-08-28T18:56:49.340000 | Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizar | |
| CVE-2026-82261 | 7.5 | 0.34% | 2 | 0 | 2026-08-28T18:56:34.447000 | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remot | |
| CVE-2026-81701 | 9.8 | 0.31% | 3 | 0 | 2026-08-28T18:56:34.447000 | openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-i | |
| CVE-2026-81681 | 4.6 | 0.13% | 3 | 0 | 2026-08-28T18:56:34.447000 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a port | |
| CVE-2026-81680 | 4.0 | 0.15% | 1 | 0 | 2026-08-28T18:56:34.447000 | openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presenc | |
| CVE-2026-81706 | 6.8 | 0.13% | 1 | 0 | 2026-08-28T18:56:34.447000 | openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own i | |
| CVE-2026-81717 | 3.5 | 0.09% | 1 | 0 | 2026-08-28T18:56:34.447000 | openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weakness | |
| CVE-2026-81695 | 3.3 | 0.18% | 1 | 0 | 2026-08-28T18:56:34.447000 | openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id | |
| CVE-2026-81705 | 7.5 | 0.33% | 1 | 0 | 2026-08-28T18:56:34.447000 | openssl-encrypt before 1.4.9 fails to redact the file password in its --debug ar | |
| CVE-2026-82254 | 7.5 | 0.35% | 2 | 0 | 2026-08-28T18:54:09.323000 | gitoxide before 0.69.0 contains unchecked array indexing in delta application an | |
| CVE-2026-47879 | 7.7 | 0.24% | 1 | 0 | 2026-08-28T18:47:30.163000 | Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Reso | |
| CVE-2026-47851 | 7.5 | 0.26% | 1 | 1 | 2026-08-28T18:47:30.163000 | Analyzing a PDF with a deeply nested or cyclic table of contents can cause a Sta | |
| CVE-2026-82082 | 9.8 | 1.50% | 2 | 0 | 2026-08-28T18:46:13.563000 | NUMail developed by Green-Computing has an OS Command Injection vulnerability. U | |
| CVE-2026-82078 | None | 0.46% | 3 | 2 | 2026-08-28T18:31:39 | An unsafe dynamic class loading vulnerability exists in the database connection | |
| CVE-2026-82227 | 8.5 | 0.23% | 2 | 0 | 2026-08-28T18:31:39 | Contributor SQL Injection in WPBulky <= 1.2.2 versions. | |
| CVE-2026-81285 | 7.5 | 0.26% | 2 | 0 | 2026-08-28T18:31:34 | Unauthenticated Denial of Service Attack in Smush Image Compression and Optimiza | |
| CVE-2026-78239 | 9.8 | 0.55% | 4 | 0 | 2026-08-28T16:18:27.560000 | Xiiaozet LK100W exposes a critical management function that can be invoked with | |
| CVE-2026-75813 | 7.5 | 0.26% | 2 | 0 | 2026-08-28T16:18:25.510000 | Certain configuration endpoints may lack proper server-side authorization check | |
| CVE-2026-81277 | 8.5 | 0.34% | 1 | 0 | 2026-08-28T15:09:00.790000 | Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 version | |
| CVE-2026-82252 | 7.5 | 0.39% | 2 | 0 | 2026-08-28T12:30:36 | gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules fi | |
| CVE-2026-82222 | 10.0 | 0.42% | 2 | 0 | 2026-08-28T12:30:36 | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP | |
| CVE-2026-82253 | 7.5 | 0.50% | 3 | 0 | 2026-08-28T12:30:36 | gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path | |
| CVE-2026-82234 | 8.2 | 0.32% | 1 | 0 | 2026-08-28T12:30:36 | SiYuan versions before v3.8.1 contain a server-side request forgery vulnerabilit | |
| CVE-2026-82260 | 7.5 | 0.34% | 3 | 0 | 2026-08-28T12:30:36 | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remot | |
| CVE-2026-82259 | 7.5 | 0.37% | 2 | 0 | 2026-08-28T12:30:30 | SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deseri | |
| CVE-2026-82247 | 7.5 | 0.30% | 2 | 0 | 2026-08-28T12:30:28 | gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL par | |
| CVE-2026-66384 | 5.3 | 0.58% | 6 | 1 | 2026-08-28T12:21:47.053000 | An authenticated user may write data outside the intended Docker cache path unde | |
| CVE-2023-49105 | 9.8 | 43.20% | 10 | 1 | template | 2026-08-28T12:21:09.753000 | An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker ca |
| CVE-2026-82123 | 6.5 | 0.18% | 2 | 0 | 2026-08-28T09:32:01 | Improper neutralization of input during web page generation ('cross-site scripti | |
| CVE-2026-76581 | 9.8 | 0.34% | 1 | 0 | 2026-08-28T09:31:57 | The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypa | |
| CVE-2026-77365 | 7.2 | 0.31% | 1 | 0 | 2026-08-28T06:31:05 | The Optimole โ Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image O | |
| CVE-2026-18983 | 7.5 | 0.50% | 2 | 0 | 2026-08-28T06:31:05 | The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to | |
| CVE-2026-38822 | 7.6 | 0.85% | 2 | 0 | 2026-08-28T03:31:24 | In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS da | |
| CVE-2026-38820 | 8.3 | 1.74% | 2 | 0 | 2026-08-28T03:31:23 | openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via | |
| CVE-2026-73809 | 7.5 | 0.17% | 1 | 0 | 2026-08-28T00:32:11 | A cleartext transmission of sensitive information vulnerability exists in certa | |
| CVE-2026-77977 | 8.1 | 0.23% | 2 | 0 | 2026-08-28T00:32:11 | Ebyte gateway product's vendor configuration utility does not require authentica | |
| CVE-2026-76945 | 7.5 | 0.36% | 2 | 0 | 2026-08-28T00:32:11 | The affected Ebyte device relies on client-managed authentication tokens withou | |
| CVE-2026-76943 | 9.8 | 0.67% | 2 | 0 | 2026-08-28T00:32:11 | Xiiaozet LK100Wt contains an authentication weakness within an administrative s | |
| CVE-2026-78037 | 8.8 | 1.22% | 2 | 0 | 2026-08-28T00:32:11 | Xiiaozet LK100W is vulnerable to OS command injection through its web-based man | |
| CVE-2026-73125 | 9.8 | 0.53% | 4 | 0 | 2026-08-28T00:32:04 | Ebyte device web management interface does not consistently enforce authenticat | |
| CVE-2026-76940 | 7.5 | 0.36% | 2 | 0 | 2026-08-28T00:32:04 | The affected Ebyte device does not restrict repeated authentication attempts th | |
| CVE-2026-71362 | 9.1 | 25.14% | 2 | 1 | template | 2026-08-28T00:18:09.390000 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul |
| CVE-2026-79619 | None | 0.14% | 1 | 0 | 2026-08-27T21:32:29 | On Linux, several OpenZFS ioctl authorization checks accept a capability held on | |
| CVE-2026-81934 | 9.8 | 0.58% | 2 | 0 | 2026-08-27T21:32:02 | Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' f | |
| CVE-2026-81730 | 8.2 | 0.38% | 2 | 0 | 2026-08-27T21:31:54 | Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name sup | |
| CVE-2026-53362 | 7.8 | 0.51% | 11 | 1 | 2026-08-27T21:31:19 | In the Linux kernel, the following vulnerability has been resolved: ipv6: accou | |
| CVE-2026-76639 | 8.8 | 0.71% | 9 | 1 | 2026-08-27T20:18:38.230000 | Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code ex | |
| CVE-2026-81702 | 9.8 | 0.14% | 3 | 0 | 2026-08-27T18:32:38 | openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when l | |
| CVE-2026-81700 | 9.8 | 0.25% | 3 | 0 | 2026-08-27T18:32:38 | openssl_encrypt versions before 1.4.9 contain a signature verification vulnerabi | |
| CVE-2026-81698 | 7.5 | 0.28% | 2 | 0 | 2026-08-27T18:32:38 | openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in | |
| CVE-2026-81714 | 7.0 | 0.14% | 1 | 0 | 2026-08-27T18:32:38 | openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fin | |
| CVE-2026-81707 | 9.8 | 0.41% | 2 | 0 | 2026-08-27T18:32:38 | openssl_encrypt before 1.4.9 fails to sanitize the email field of imported ident | |
| CVE-2026-81696 | 3.3 | 0.18% | 1 | 0 | 2026-08-27T18:32:37 | openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characte | |
| CVE-2026-81694 | 3.3 | 0.18% | 1 | 0 | 2026-08-27T18:32:37 | openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames rea | |
| CVE-2026-81685 | 3.3 | 0.18% | 1 | 0 | 2026-08-27T18:32:37 | openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in | |
| CVE-2026-81722 | 7.5 | 0.34% | 1 | 0 | 2026-08-27T18:32:31 | nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficie | |
| CVE-2026-81721 | 7.5 | 0.39% | 1 | 0 | 2026-08-27T18:32:31 | openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted | |
| CVE-2026-81719 | 7.8 | 0.32% | 2 | 0 | 2026-08-27T18:32:30 | openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insuffi | |
| CVE-2026-81094 | 9.1 | 0.42% | 1 | 0 | 2026-08-27T18:32:30 | The mcp-router CLI served its MCP aggregator on every interface and enforced aut | |
| CVE-2026-81718 | 7.5 | 0.13% | 1 | 0 | 2026-08-27T18:32:30 | openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 | |
| CVE-2026-78251 | None | 0.39% | 1 | 0 | 2026-08-27T18:32:25 | DJI drones contain an FTP service that uses hardcoded credentials shared across | |
| CVE-2026-47877 | 8.2 | 0.19% | 1 | 0 | 2026-08-27T18:32:09 | Spring Security Authorization Server's default consent page renders user-control | |
| CVE-2026-47852 | 7.5 | 0.20% | 1 | 0 | 2026-08-27T18:32:07 | A local attacker on a multi-user host can pre-create the deterministic cache pat | |
| CVE-2026-81735 | 10.0 | 0.53% | 1 | 0 | 2026-08-27T17:21:03.677000 | startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its l | |
| CVE-2026-81576 | 7.7 | 0.33% | 1 | 0 | 2026-08-27T17:20:55.230000 | If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issu | |
| CVE-2026-74232 | 9.8 | 0.47% | 7 | 0 | 2026-08-27T17:19:51.953000 | Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink | |
| CVE-2026-61617 | 7.7 | 0.25% | 1 | 0 | 2026-08-27T17:19:02.473000 | Wings is the server control plane for the Pterodactyl game-server management pan | |
| CVE-2026-47666 | 7.6 | 0.20% | 1 | 0 | 2026-08-27T17:18:27.247000 | Penpot is an open-source design and prototyping platform. In versions up to and | |
| CVE-2026-18431 | 9.8 | 0.64% | 2 | 1 | 2026-08-27T17:17:29.533000 | The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versi | |
| CVE-2026-15990 | 7.5 | 0.69% | 1 | 0 | 2026-08-27T17:17:14.017000 | The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal | |
| CVE-2026-74233 | 9.8 | 2.63% | 7 | 0 | 2026-08-27T15:31:35 | Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, an | |
| CVE-2026-80557 | 9.8 | 0.52% | 1 | 0 | 2026-08-27T15:31:33 | In the Linux kernel, the following vulnerability has been resolved: libceph: fi | |
| CVE-2026-65182 | 9.1 | 0.59% | 1 | 0 | 2026-08-27T15:27:26.040000 | Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat | |
| CVE-2026-81625 | 8.8 | 0.53% | 1 | 0 | 2026-08-27T13:18:41.920000 | A remote attacker with user privileges may use a malicious or compromised NASL v | |
| CVE-2026-80587 | 9.8 | 0.39% | 2 | 0 | 2026-08-27T13:18:41.093000 | In the Linux kernel, the following vulnerability has been resolved: mptcp: avoi | |
| CVE-2026-80551 | 9.3 | 0.14% | 1 | 0 | 2026-08-27T13:18:39.733000 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_c | |
| CVE-2026-41992 | 7.5 | 0.37% | 5 | 0 | 2026-08-27T13:17:57.967000 | GNU gzip contains a global buffer overflow vulnerability in the LZH decompressio | |
| CVE-2026-78276 | 7.2 | 0.50% | 1 | 0 | 2026-08-27T12:30:34 | Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions. | |
| CVE-2026-78285 | 8.5 | 0.34% | 1 | 0 | 2026-08-27T12:30:34 | Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions. | |
| CVE-2026-78286 | 9.8 | 0.53% | 1 | 0 | 2026-08-27T12:30:33 | Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions. | |
| CVE-2026-81573 | 8.6 | 0.46% | 1 | 0 | 2026-08-27T12:30:27 | If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configu | |
| CVE-2026-81572 | 7.8 | 0.17% | 1 | 0 | 2026-08-27T12:30:27 | cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-S | |
| CVE-2026-81273 | 8.1 | 0.17% | 1 | 0 | 2026-08-27T12:30:27 | Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 | |
| CVE-2026-81581 | 8.8 | 0.20% | 1 | 0 | 2026-08-27T12:30:27 | Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 | |
| CVE-2026-81579 | 8.8 | 0.16% | 1 | 0 | 2026-08-27T12:30:27 | In WibuKey for Windows before version 6.71, an untrusted pointer dereference in | |
| CVE-2026-81574 | 8.2 | 0.41% | 1 | 0 | 2026-08-27T12:30:27 | In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitiz | |
| CVE-2026-81575 | 7.5 | 0.44% | 1 | 0 | 2026-08-27T12:30:26 | If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 acce | |
| CVE-2026-60004 | 9.8 | 84.55% | 7 | 9 | template | 2026-08-27T11:41:19.230000 | Gitea before 1.27.1 allows remote code execution via the diffpatch API through G |
| CVE-2026-59270 | 9.4 | 0.29% | 2 | 0 | 2026-08-27T06:31:43 | Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditio | |
| CVE-2026-80585 | 9.4 | 0.32% | 1 | 0 | 2026-08-27T06:31:38 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fast | |
| CVE-2026-80528 | 9.8 | 0.52% | 1 | 0 | 2026-08-27T06:31:38 | In the Linux kernel, the following vulnerability has been resolved: ceph: avoid | |
| CVE-2026-80519 | 9.8 | 0.45% | 1 | 0 | 2026-08-27T06:31:38 | In the Linux kernel, the following vulnerability has been resolved: ovpn: finis | |
| CVE-2026-80554 | 9.3 | 0.14% | 1 | 0 | 2026-08-27T06:31:38 | In the Linux kernel, the following vulnerability has been resolved: s390/vfio_c | |
| CVE-2026-80589 | 9.8 | 0.38% | 2 | 0 | 2026-08-27T06:31:38 | In the Linux kernel, the following vulnerability has been resolved: block: stop | |
| CVE-2026-74737 | 9.8 | 0.56% | 1 | 0 | 2026-08-27T06:31:37 | In the Linux kernel, the following vulnerability has been resolved: net: ethern | |
| CVE-2026-74744 | 9.8 | 0.52% | 1 | 0 | 2026-08-27T06:31:37 | In the Linux kernel, the following vulnerability has been resolved: ipvlan: inh | |
| CVE-2026-80558 | 9.8 | 0.52% | 1 | 0 | 2026-08-27T06:31:33 | In the Linux kernel, the following vulnerability has been resolved: libceph: Av | |
| CVE-2026-74752 | 9.8 | 0.43% | 1 | 0 | 2026-08-27T06:31:31 | In the Linux kernel, the following vulnerability has been resolved: sctp: valid | |
| CVE-2026-74751 | 9.4 | 0.34% | 1 | 0 | 2026-08-27T06:31:31 | In the Linux kernel, the following vulnerability has been resolved: riscv: lib: | |
| CVE-2026-80588 | 7.5 | 0.34% | 1 | 0 | 2026-08-27T06:17:46.353000 | In the Linux kernel, the following vulnerability has been resolved: mptcp: recl | |
| CVE-2026-80586 | 9.8 | 0.40% | 1 | 0 | 2026-08-27T06:17:45.700000 | In the Linux kernel, the following vulnerability has been resolved: mptcp: opti | |
| CVE-2026-80561 | 9.8 | 0.52% | 1 | 0 | 2026-08-27T06:17:41.057000 | In the Linux kernel, the following vulnerability has been resolved: libceph: fi | |
| CVE-2026-74746 | 9.8 | 0.54% | 1 | 0 | 2026-08-27T06:17:25.033000 | In the Linux kernel, the following vulnerability has been resolved: netfilter: | |
| CVE-2026-74743 | 9.8 | 0.52% | 1 | 0 | 2026-08-27T06:17:24.113000 | In the Linux kernel, the following vulnerability has been resolved: macvlan: in | |
| CVE-2026-65641 | None | 0.54% | 1 | 0 | 2026-08-27T00:30:36 | A vulnerability allowing an unauthenticated network attacker to coerce SMB authe | |
| CVE-2026-70419 | 9.1 | 2.19% | 1 | 0 | 2026-08-26T21:31:47 | Dell Cloud Disaster Recovery, versions 20.2 and prior,ย containย an Improper Neutr | |
| CVE-2026-75960 | 8.1 | 0.35% | 3 | 0 | 2026-08-26T18:32:04 | Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently | |
| CVE-2026-19271 | 7.5 | 0.30% | 1 | 0 | 2026-08-26T18:32:04 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injecti | |
| CVE-2015-5287 | 7.8 | 4.96% | 1 | 1 | 2026-08-26T18:31:30 | The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2. | |
| CVE-2026-8452 | 9.8 | 1.61% | 8 | 3 | 2026-08-26T18:30:34 | Memory overflow vulnerabilityย NetScaler ADC and NetScaler Gatewayย leading to unp | |
| CVE-2022-0995 | 7.1 | 9.52% | 3 | 4 | 2026-08-26T18:30:28 | An out-of-bounds (OOB) memory write flaw was found in the Linux kernelโs watch_q | |
| CVE-2015-3246 | 5.1 | 8.80% | 1 | 1 | 2026-08-26T18:30:27 | libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper progr | |
| CVE-2026-54569 | 9.8 | 0.78% | 1 | 0 | 2026-08-26T15:28:48 | ### Summary An unauthenticated remote code execution vulnerability in the SENAI | |
| CVE-2026-19042 | 8.8 | 2.00% | 1 | 0 | 2026-08-26T14:17:08.270000 | A command injection vulnerability in TeamViewer Full Client and Host for Linux p | |
| CVE-2026-19913 | None | 0.36% | 1 | 1 | 2026-08-25T18:32:01 | The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure v | |
| CVE-2026-19912 | None | 0.22% | 1 | 1 | 2026-08-25T18:32:01 | The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote | |
| CVE-2026-74684 | 7.1 | 0.14% | 1 | 0 | 2026-08-25T06:18:51.253000 | In the Linux kernel, the following vulnerability has been resolved: net: tap: s | |
| CVE-2026-64531 | 7.8 | 0.38% | 1 | 4 | 2026-08-22T04:17:58.720000 | In the Linux kernel, the following vulnerability has been resolved: net: openvs | |
| CVE-2026-73570 | 8.9 | 20.53% | 1 | 6 | template | 2026-08-21T18:34:48 | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) befor |
| CVE-2026-77806 | 9.8 | 4.20% | 1 | 1 | template | 2026-08-21T18:16:52.373000 | SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary |
| CVE-2026-19598 | 9.8 | 2.79% | 1 | 4 | template | 2026-08-20T12:48:10.287000 | The Pods โ Custom Content Types and Fields plugin for WordPress is vulnerable to |
| CVE-2026-53361 | 7.1 | 0.13% | 1 | 1 | 2026-08-19T18:31:59 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Se | |
| CVE-2026-65400 | 9.8 | 9.90% | 3 | 3 | 2026-08-19T04:17:34.547000 | An authentication issue was addressed with improved state management. This issue | |
| CVE-2026-19478 | 9.4 | 6.00% | 1 | 7 | template | 2026-08-17T21:31:30 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 |
| CVE-2026-72137 | 9.8 | 0.62% | 3 | 0 | 2026-08-17T06:34:17 | In the Linux kernel, the following vulnerability has been resolved: xfrm: nat_k | |
| CVE-2026-61979 | 8.1 | 0.28% | 1 | 0 | 2026-08-13T15:34:46 | Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions | |
| CVE-2026-63077 | 9.8 | 87.71% | 2 | 4 | template | 2026-08-06T05:17:05.170000 | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code exe |
| CVE-2026-15981 | 9.8 | 0.81% | 1 | 1 | 2026-07-24T23:16:50.257000 | The SAML Single Sign On โ SSO Login plugin for WordPress is vulnerable to Authen | |
| CVE-2026-45657 | 9.8 | 15.48% | 1 | 0 | 2026-07-23T08:10:00.137000 | Use after free in Windows Kernel allows an unauthorized attacker to execute code | |
| CVE-2026-47291 | 9.8 | 22.75% | 1 | 1 | 2026-07-23T08:10:00.137000 | Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attack | |
| CVE-2018-18472 | 9.8 | 25.63% | 2 | 0 | 2026-06-17T01:47:21.423000 | Western Digital WD My Book Live and WD My Book Live Duo (all versions) have a ro | |
| CVE-2021-23758 | 9.8 | 83.63% | 1 | 1 | 2026-02-03T17:39:26 | ### Overview Affected versions of this package are vulnerable to Deserializatio | |
| CVE-2025-39367 | 5.3 | 0.27% | 1 | 0 | 2025-04-28T09:32:00 | Missing Authorization vulnerability in SeventhQueen Kleo.This issue affects Kleo | |
| CVE-2021-35941 | 7.5 | 12.71% | 2 | 0 | 2023-01-27T05:02:51 | Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all ver | |
| CVE-2026-81849 | 0 | 0.57% | 2 | 0 | N/A | ||
| CVE-2026-65643 | 0 | 0.00% | 6 | 1 | N/A | ||
| CVE-2026-77078 | 0 | 0.29% | 2 | 0 | N/A | ||
| CVE-2026-77037 | 0 | 0.35% | 2 | 0 | N/A | ||
| CVE-2026-82333 | 0 | 0.28% | 2 | 0 | N/A | ||
| CVE-2026-75604 | 0 | 0.00% | 3 | 3 | N/A | ||
| CVE-2026-61800 | 0 | 0.59% | 2 | 0 | N/A | ||
| CVE-2026-81529 | 0 | 0.17% | 1 | 0 | N/A | ||
| CVE-2026-81522 | 0 | 0.27% | 2 | 0 | N/A | ||
| CVE-2026-68503 | 0 | 0.40% | 1 | 0 | N/A | ||
| CVE-2026-47665 | 0 | 0.25% | 1 | 0 | N/A |
updated 2026-08-29T17:18:00.057000
2 posts
๐ CVE-2026-82475 - High (8.1)
iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82475/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82475 - High (8.1)
iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82475/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T15:30:27
2 posts
๐ด CVE-2026-82456 - Critical (10)
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82456/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-82456 - Critical (10)
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82456/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T15:30:27
2 posts
๐ด CVE-2026-82454 - Critical (9.1)
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82454/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-82454 - Critical (9.1)
The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82454/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T15:30:20
2 posts
๐ด CVE-2026-82448 - Critical (9.8)
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during W...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82448/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-82448 - Critical (9.8)
Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during W...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82448/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T14:16:38.910000
2 posts
๐ CVE-2026-82457 - High (7.8)
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to ro...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82457/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82457 - High (7.8)
su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to ro...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82457/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T14:16:38.347000
2 posts
๐ CVE-2026-82453 - High (7.5)
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82453/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82453 - High (7.5)
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82453/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T14:16:38.210000
2 posts
๐ด CVE-2026-82452 - Critical (9.8)
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete u...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82452/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-82452 - Critical (9.8)
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete u...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82452/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T14:16:37.930000
2 posts
๐ CVE-2026-82450 - High (8.8)
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82450/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82450 - High (8.8)
BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82450/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T14:16:37.677000
2 posts
๐ CVE-2026-82251 - High (7.5)
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82251/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82251 - High (7.5)
gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state() and...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82251/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T13:16:38.643000
2 posts
๐ CVE-2026-82447 - High (8.8)
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syn...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82447/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82447 - High (8.8)
Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syn...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82447/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T12:16:41.163000
2 posts
๐ด CVE-2026-14494 - Critical (9.8)
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-14494/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-14494 - Critical (9.8)
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-14494/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T04:18:08
3 posts
2 repos
๐ฐ PaperCut Zero-Day RCE Actively Exploited; Emergency Patches Released
๐จ URGENT: PaperCut warns of an actively exploited zero-day RCE vulnerability chain affecting all NG/MF versions. The pre-auth flaws (CVE-2026-81578, CVE-2026-82078) allow full server takeover. Patch immediately! #Cybersecurity #ZeroDay #PaperCut
##https://thecybersecguru.com/news/papercut-cve-2026-81578-cve-2026-82078-pre-auth-rce-analysis/
##https://thecybersecguru.com/news/papercut-cve-2026-81578-cve-2026-82078-pre-auth-rce-analysis/
##updated 2026-08-29T04:18:06.417000
4 posts
๐ New Achievement! Maximum Severity, Minimum Fuss!
Per your platform's automated patch-prioritization policy: three maximum-severity vulnerabilities in the ServiceNow AI Platform have been logged, triaged, and assigned to the backlog. CVE-2026-18886 enables privilege escalation and data manipulation; CVE-2026-74820 allows arbitrary SQL execution against your underlying database. No user interaction required for exploitation. (1/3)
##ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug.
##๐ New Achievement! Maximum Severity, Minimum Fuss!
Per your platform's automated patch-prioritization policy: three maximum-severity vulnerabilities in the ServiceNow AI Platform have been logged, triaged, and assigned to the backlog. CVE-2026-18886 enables privilege escalation and data manipulation; CVE-2026-74820 allows arbitrary SQL execution against your underlying database. No user interaction required for exploitation. (1/3)
##ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug.
##updated 2026-08-29T04:18:06.270000
2 posts
๐ CVE-2026-72984 - High (8.8)
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-72984/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-72984 - High (8.8)
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-72984/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T04:18:04.957000
2 posts
WatchGuard patched CVE-2026-19313 and more Fireware flaws, pre-authentication remote code execution bugs rated CVSS 9.3. Update firewalls now.
#WatchGuard #Fireware #RCE #Firewall #InfoSec
https://securityonline.info/watchguard-fireware-rce/?utm_source=mastodon&utm_medium=jetpack_social
##WatchGuard patched CVE-2026-19313 and more Fireware flaws, pre-authentication remote code execution bugs rated CVSS 9.3. Update firewalls now.
#WatchGuard #Fireware #RCE #Firewall #InfoSec
https://securityonline.info/watchguard-fireware-rce/?utm_source=mastodon&utm_medium=jetpack_social
##updated 2026-08-29T04:18:04.793000
4 posts
๐ New Achievement! Maximum Severity, Minimum Fuss!
Per your platform's automated patch-prioritization policy: three maximum-severity vulnerabilities in the ServiceNow AI Platform have been logged, triaged, and assigned to the backlog. CVE-2026-18886 enables privilege escalation and data manipulation; CVE-2026-74820 allows arbitrary SQL execution against your underlying database. No user interaction required for exploitation. (1/3)
##ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug.
##๐ New Achievement! Maximum Severity, Minimum Fuss!
Per your platform's automated patch-prioritization policy: three maximum-severity vulnerabilities in the ServiceNow AI Platform have been logged, triaged, and assigned to the backlog. CVE-2026-18886 enables privilege escalation and data manipulation; CVE-2026-74820 allows arbitrary SQL execution against your underlying database. No user interaction required for exploitation. (1/3)
##ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug.
##updated 2026-08-29T03:31:04
2 posts
๐ CVE-2026-41012 - High (7.7)
Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualiza...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-41012/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-41012 - High (7.7)
Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualiza...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-41012/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T00:31:12
2 posts
CVE-2026-81533 - Memory safety flaw in MongoDB BI Connector ODBC Driver. Buffer overflow via long LIMIT clauses. CVSS 7.1. Disable prefetch now. #CVE #MongoDB #infosec
##CVE-2026-81533 - Memory safety flaw in MongoDB BI Connector ODBC Driver. Buffer overflow via long LIMIT clauses. CVSS 7.1. Disable prefetch now. #CVE #MongoDB #infosec
##updated 2026-08-29T00:31:12
3 posts
CVE-2026-81490 - DoS flaw in MongoDB Connector for BI. Malicious views block schema refresh routines. CVSS 7.7. Restrict view creation privileges. #CVE #MongoDB #infosec
##๐ CVE-2026-81490 - High (7.7)
A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting se...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81490/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-81490 - High (7.7)
A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting se...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81490/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T00:31:12
2 posts
๐ CVE-2026-81532 - High (8.8)
A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81532/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-81532 - High (8.8)
A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81532/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T00:31:12
2 posts
๐ CVE-2026-81518 - High (7.5)
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that re...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81518/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-81518 - High (7.5)
When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that re...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81518/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T00:31:04
3 posts
CVE-2026-81520 - DoS vulnerability in MongoDB Connector for BI allows unauthenticated resource exhaustion. CVSS 7.5. Restrict access immediately. #CVE #MongoDB #infosec
##๐ CVE-2026-81520 - High (7.5)
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81520/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-81520 - High (7.5)
A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81520/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T00:31:03
2 posts
1 repos
๐ด CVE-2026-19295 - Critical (9.9)
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references i...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-19295/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-19295 - Critical (9.9)
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references i...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-19295/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T00:31:02
2 posts
๐ CVE-2026-18891 - High (8.2)
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18891/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-18891 - High (8.2)
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18891/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T00:31:02
2 posts
1 repos
๐ CVE-2026-18729 - High (8.8)
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18729/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-18729 - High (8.8)
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18729/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T00:31:02
2 posts
1 repos
๐ด CVE-2026-19286 - Critical (9.8)
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-19286/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-19286 - Critical (9.8)
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-19286/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T00:31:02
2 posts
๐ CVE-2026-18899 - High (7.5)
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18899/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-18899 - High (7.5)
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18899/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T00:31:01
2 posts
๐ CVE-2026-17203 - High (7.5)
IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-17203/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-17203 - High (7.5)
IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-17203/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-29T00:30:57
1 posts
๐ CVE-2026-73108 - High (7.5)
RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before rece...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-73108/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T23:17:07.517000
3 posts
CVE-2026-55784 - Auth state overwrite flaw in free5GC 5G core network AUSF component. CVSS 7.5. Unpatched, monitor for fixes and mitigate immediately. #CVE #5G #infosec
##๐ CVE-2026-55784 - High (7.5)
free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only b...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-55784/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-55784 - High (7.5)
free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only b...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-55784/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T22:33:36
2 posts
๐ CVE-2026-55848 - High (8.6)
mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-55848/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-55848 - High (8.6)
mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-55848/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T22:16:56.650000
2 posts
๐ CVE-2026-82284 - High (8.1)
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories inc...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82284/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82284 - High (8.1)
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories inc...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82284/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T22:16:56.293000
2 posts
๐ CVE-2026-82278 - High (8.8)
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82278/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82278 - High (8.8)
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82278/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T22:16:55.067000
2 posts
๐ CVE-2026-82017 - High (7.6)
IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned co...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82017/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82017 - High (7.6)
IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned co...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82017/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T22:16:54.383000
2 posts
๐ CVE-2026-81517 - High (7.5)
An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operati...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81517/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-81517 - High (7.5)
An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operati...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81517/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T22:16:51.290000
1 posts
CVE-2026-55634 - Critical Code Injection vulnerability in Pimcore import API. CVSS 9.9. Update immediately. #CVE #Pimcore #infosec
##updated 2026-08-28T22:16:49.063000
3 posts
CVE-2026-3627 - Critical SQLi in IBM Concert (1.0.0-2.3.1). Remote attackers can read, modify, or delete database contents. CVSS 9.1. Update now. #CVE #IBM #infosec
##๐ด CVE-2026-3627 - Critical (9.1)
IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-3627/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-3627 - Critical (9.1)
IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-3627/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T22:16:47.227000
2 posts
๐ CVE-2026-18904 - High (8.2)
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18904/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-18904 - High (8.2)
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18904/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T22:16:46.620000
2 posts
๐ด CVE-2026-18527 - Critical (9.9)
IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18527/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-18527 - Critical (9.9)
IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18527/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T22:13:01
3 posts
CVE-2026-55841 - High severity FortiGate syslog parser flaw in Graylog. CVSS 7.5. Update immediately. #CVE #Graylog #infosec
##๐ CVE-2026-55841 - High (7.5)
Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFo...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-55841/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-55841 - High (7.5)
Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFo...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-55841/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:32:13
6 posts
๐ฐ ServiceNow Patches Three Critical CVSS 10.0 Flaws in AI Platform
ServiceNow patches three critical unauthenticated flaws (CVSS 10.0) in its AI Platform. The vulnerabilities (CVE-2026-18885, -18886, -74820) allow for RCE, privilege escalation, and SQL injection. Self-hosted customers must patch immediately. #Servic...
##https://thecybersecguru.com/news/servicenow-cve-2026-18885-18886-74820-cvss-10/
##๐ฐ ServiceNow Patches Three Critical CVSS 10.0 Flaws in AI Platform
ServiceNow patches three critical unauthenticated flaws (CVSS 10.0) in its AI Platform. The vulnerabilities (CVE-2026-18885, -18886, -74820) allow for RCE, privilege escalation, and SQL injection. Self-hosted customers must patch immediately. #Servic...
##ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug.
##https://thecybersecguru.com/news/servicenow-cve-2026-18885-18886-74820-cvss-10/
##ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug.
##updated 2026-08-28T21:31:36
2 posts
๐ CVE-2026-82282 - High (8)
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key an...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82282/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82282 - High (8)
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key an...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82282/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:36
2 posts
๐ CVE-2026-82291 - High (8.1)
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logg...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82291/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82291 - High (8.1)
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logg...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82291/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:36
2 posts
๐ด CVE-2026-82329 - Critical (9.8)
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82329/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-82329 - Critical (9.8)
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82329/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:29
2 posts
๐ CVE-2026-82275 - High (7.5)
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82275/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82275 - High (7.5)
Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82275/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:29
2 posts
๐ CVE-2026-82279 - High (8.1)
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by s...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82279/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82279 - High (8.1)
HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by s...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82279/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:28
2 posts
๐ CVE-2026-82288 - High (7.5)
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers c...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82288/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82288 - High (7.5)
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers c...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82288/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:28
2 posts
1 repos
https://github.com/BiiTts/CVE-2026-82286-gpt-crawler-Arbitrary-File-Write
๐ CVE-2026-82286 - High (8.6)
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segme...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82286/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82286 - High (8.6)
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segme...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82286/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:27
2 posts
๐ CVE-2026-82283 - High (8.1)
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying c...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82283/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82283 - High (8.1)
VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying c...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82283/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:26
2 posts
๐ด CVE-2026-82277 - Critical (9.8)
Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82277/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-82277 - Critical (9.8)
Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82277/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:25
2 posts
๐ CVE-2026-82270 - High (7.5)
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests w...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82270/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82270 - High (7.5)
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests w...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82270/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:25
2 posts
๐ CVE-2026-82269 - High (8.1)
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is l...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82269/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82269 - High (8.1)
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is l...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82269/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:25
2 posts
๐ CVE-2026-82268 - High (7.5)
Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio int...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82268/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82268 - High (7.5)
Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio int...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82268/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:24
2 posts
๐ CVE-2026-75124 - High (7.5)
PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termin...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-75124/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-75124 - High (7.5)
PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termin...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-75124/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:24
2 posts
๐ CVE-2026-75486 - High (8)
Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original br...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-75486/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-75486 - High (8)
Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters..optic-ci.original br...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-75486/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:23
2 posts
๐ด CVE-2026-82266 - Critical (9.8)
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, m...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82266/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-82266 - Critical (9.8)
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, m...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82266/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:31:17
2 posts
๐ CVE-2026-56100 - High (8.1)
SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feig...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-56100/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-56100 - High (8.1)
SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feig...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-56100/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:16:15.740000
2 posts
๐ CVE-2026-77586 - High (8)
In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permissio...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-77586/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-77586 - High (8)
In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by SHOW CREATE statements without escaping the identifier delimiter. A user with permissio...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-77586/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T21:16:15.740000
4 posts
Discover the details of recent MongoDB security vulnerabilities affecting drivers and BI connectors. Update your systems to patch CVE-2026-81525 and others.
#MongoDB #Cybersecurity #Vulnerability #CVE202681525 #DatabaseSecurity
##๐ CVE-2026-81525 - High (8.1)
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untruste...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81525/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##Discover the details of recent MongoDB security vulnerabilities affecting drivers and BI connectors. Update your systems to patch CVE-2026-81525 and others.
#MongoDB #Cybersecurity #Vulnerability #CVE202681525 #DatabaseSecurity
##๐ CVE-2026-81525 - High (8.1)
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untruste...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81525/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T20:20:20.243000
2 posts
๐ CVE-2026-82287 - High (8.1)
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue cre...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82287/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82287 - High (8.1)
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue cre...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82287/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T20:20:19.953000
2 posts
๐ CVE-2026-82285 - High (8.2)
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82285/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82285 - High (8.2)
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82285/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T20:20:14.470000
2 posts
๐ CVE-2026-82021 - High (8.3)
Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather t...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82021/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82021 - High (8.3)
Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather t...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82021/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T20:20:13.023000
2 posts
๐ CVE-2026-81767 - High (7.5)
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81767/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-81767 - High (7.5)
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81767/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T20:20:11.923000
1 posts
๐ CVE-2026-81699 - High (7.5)
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81699/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T20:20:08.670000
1 posts
CVE-2026-81019 - AES-GCM nonce reuse in wolfSSL wolfProvider allows TLS 1.2 decryption and auth tag forgery. CVSS 7.4. Update to 1.2.2 immediately. #CVE #wolfSSL #infosec
##updated 2026-08-28T20:19:55.927000
2 posts
๐ CVE-2026-77438 - High (7.5)
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-77438/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-77438 - High (7.5)
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-77438/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T20:19:54.877000
6 posts
1 repos
Two independent root RCE chains were disclosed on the Unitree G1 EDU humanoid robot. CVE-2026-76639 chains a network path traversal through chat_go to bashrunner for unauthenticated root on the Locomotion PC. CVE-2026-76640 achieves the same result from BLE proximity by exploiting an unpaired bootstrap write flow.
#UnitreeG1 #RootRCE #BLE #RoboticsSecurity
https://cyberworldops.eu/en/two-root-attack-chains-on-unitree-g1-edu-one-via-network-one-via
##Oh, goodie. The robots come with recycled bugs. These two are tracked as CVE-2026-76639 and CVE-2026-76640.
This was posted on August 27.
Boschko Security Blog: UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range https://boschko.ca/g1-ble-rce/
More:
The Hacker News: Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html #infosec #vulnerability #robotics
##Unitree Humanoid Robot Flaws Expose Root Code Execution Risk
A security researcher has uncovered two critical vulnerabilities in the Unitree G1 EDU robot, allowing hackers to remotely execute code with root access, potentially putting users and systems at risk. These flaws, tracked as CVE-2026-76639 and CVE-2026-76640, highlight the importance of robust security measures in robotics andโฆ
#UnitreeHumanoidRobot #RemoteCodeExecution #Cve202676639 #Cve202676640 #Robotics
##UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot
Unitree G1 ํด๋จธ๋ ธ์ด๋ ๋ก๋ด์์ ์ธ์ฆ ์์ด root ๊ถํ ์๊ฒฉ ์ฝ๋ ์คํ์ด ๊ฐ๋ฅํ UniBLEed ๊ณต๊ฒฉ ์ฒด์ธ์ด ๊ณต๊ฐ๋์ผ๋ฉฐ, CVE-2026-76639์ CVE-2026-76640์ด ๋ถ์ฌ๋๋ค. ๊ณต๊ฒฉ์ ์์ ๊ถ ๊ฒ์ฆ ์์ด ๋ก๋ด AES ํค๋ฅผ ๋ณตํธํํด ์ฃผ๋ ํด๋ผ์ฐ๋ API, ํ์ด๋ง ์์ด ์ฐ๊ธฐ ๊ฐ๋ฅํ BLE GATT ํน์ฑ, Wi-Fi ์ค์ heredoc ์ธ์ ์ , AI ์ฑ๋ด ์ง์๋ฒ ์ด์ค์ ๊ฒฝ๋ก ์ํ, ๊ทธ๋ฆฌ๊ณ BSS ๋ฒํผ ์ค๋ฒํ๋ก๋ฅผ ์กฐํฉํด root์ system() ํธ์ถ๋ก ์ด์ด์ง๋ค. ํนํ ๊ทผ๊ฑฐ๋ฆฌ์ ๋ค๋ฅธ G1๋ก ๋์ผ ๊ณต๊ฒฉ์ ์ ํํ ์ ์๋ ์ ๊ฐ๋ฅ์ฑ์ด ์ธ๊ธ๋ผ, ๋ก๋ดยท์ฃ์ง AI ์ฅ๋น์์ BLEยทํด๋ผ์ฐ๋ยท๋ก์ปฌ ์๋น์ค...
##Two independent root RCE chains were disclosed on the Unitree G1 EDU humanoid robot. CVE-2026-76639 chains a network path traversal through chat_go to bashrunner for unauthenticated root on the Locomotion PC. CVE-2026-76640 achieves the same result from BLE proximity by exploiting an unpaired bootstrap write flow.
#UnitreeG1 #RootRCE #BLE #RoboticsSecurity
https://cyberworldops.eu/en/two-root-attack-chains-on-unitree-g1-edu-one-via-network-one-via
##Oh, goodie. The robots come with recycled bugs. These two are tracked as CVE-2026-76639 and CVE-2026-76640.
This was posted on August 27.
Boschko Security Blog: UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range https://boschko.ca/g1-ble-rce/
More:
The Hacker News: Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html #infosec #vulnerability #robotics
##updated 2026-08-28T20:19:54.620000
1 posts
1 repos
https://github.com/investigato/CVE-2026-76060_ZoneMinder_CommandInjection-PoC
๐ New security advisory:
CVE-2026-76060 affects multiple systems.
โข Impact: Significant security breach potential
โข Risk: Unauthorized access or data exposure
โข Mitigation: Apply patches within 24-48 hours
Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-76060-zoneminder-rce-via-event-export-poc
by Yazoul AI
##updated 2026-08-28T19:03:37.837000
1 posts
๐ CVE-2026-66155 - High (7.6)
A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-con...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-66155/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T19:02:53.760000
1 posts
A high-severity TP-Link Kasa vulnerability (CVE-2026-76784) allows unauthorized smart home device control. Apply the latest firmware patch immediately.
#TPLink #Kasa #Vulnerability #Cybersecurity #CVE202676784 #SmartHome
##updated 2026-08-28T18:58:27.140000
2 posts
Weak bcrypt hashes in Rockwell Automation OTTO Fleet Manager (CVE-2026-75112) reduce the computational cost of offline brute-force attacks against stored credentials. The flaw affects OT fleet management software in industrial environments. Patch and rotate passwords.
#CWE916 #OTSecurity #RockwellAdvisory #ICSAdvisory
https://cyberworldops.eu/en/rockwell-automation-otto-fleet-manager-weak-bcrypt-hashes-put
##Weak bcrypt hashes in Rockwell Automation OTTO Fleet Manager (CVE-2026-75112) reduce the computational cost of offline brute-force attacks against stored credentials. The flaw affects OT fleet management software in industrial environments. Patch and rotate passwords.
#CWE916 #OTSecurity #RockwellAdvisory #ICSAdvisory
https://cyberworldops.eu/en/rockwell-automation-otto-fleet-manager-weak-bcrypt-hashes-put
##updated 2026-08-28T18:56:49.340000
2 posts
๐ CVE-2026-81728 - High (8.1)
Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HT...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81728/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-81728 - High (8.1)
Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HT...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81728/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T18:56:34.447000
2 posts
๐ CVE-2026-82261 - High (7.5)
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82261/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82261 - High (7.5)
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82261/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T18:56:34.447000
3 posts
๐ด CVE-2026-81701 - Critical (9.8)
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsig...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81701/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-81701 - Critical (9.8)
openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsig...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81701/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-28T18:56:34.447000
3 posts
@cR0w I was literally just looking at them & I have no idea what it is but some of them are bonkers: https://db.gcve.eu/vuln/cve-2026-81681
##@cR0w I was literally just looking at them & I have no idea what it is but some of them are bonkers: https://db.gcve.eu/vuln/cve-2026-81681
##How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-28T18:56:34.447000
1 posts
How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-28T18:56:34.447000
1 posts
How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-28T18:56:34.447000
1 posts
How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-28T18:56:34.447000
1 posts
How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-28T18:56:34.447000
1 posts
๐ CVE-2026-81705 - High (7.5)
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only reco...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81705/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T18:54:09.323000
2 posts
๐ CVE-2026-82254 - High (7.5)
gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82254/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82254 - High (7.5)
gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can send crafted pack data during clone or fetch operations to trigger panics or out...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82254/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T18:47:30.163000
1 posts
๐ CVE-2026-47879 - High (7.7)
Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.
Spring Cloud Gateway 5.0.0 - 5.0.2
Spring Cloud Gateway 4.3.0 - 4.3.5
Spring Cloud Gateway 4.0.0 - 4.2.9
Spring Cloud...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-47879/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T18:47:30.163000
1 posts
1 repos
๐ CVE-2026-47851 - High (7.5)
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.
Spring AI 2.0.0
Spring AI 1.1.0 - 1.1.8
Spring AI 1.0.0 - 1.0.9
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-47851/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T18:46:13.563000
2 posts
๐ด CVE-2026-82082 - Critical (9.8)
NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82082/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-82082 - Critical (9.8)
NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82082/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T18:31:39
3 posts
2 repos
๐ฐ PaperCut Zero-Day RCE Actively Exploited; Emergency Patches Released
๐จ URGENT: PaperCut warns of an actively exploited zero-day RCE vulnerability chain affecting all NG/MF versions. The pre-auth flaws (CVE-2026-81578, CVE-2026-82078) allow full server takeover. Patch immediately! #Cybersecurity #ZeroDay #PaperCut
##https://thecybersecguru.com/news/papercut-cve-2026-81578-cve-2026-82078-pre-auth-rce-analysis/
##https://thecybersecguru.com/news/papercut-cve-2026-81578-cve-2026-82078-pre-auth-rce-analysis/
##updated 2026-08-28T18:31:39
2 posts
๐ CVE-2026-82227 - High (8.5)
Contributor SQL Injection in WPBulky <= 1.2.2 versions.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82227/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82227 - High (8.5)
Contributor SQL Injection in WPBulky <= 1.2.2 versions.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82227/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T18:31:34
2 posts
๐ CVE-2026-81285 - High (7.5)
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81285/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-81285 - High (7.5)
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81285/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T16:18:27.560000
4 posts
CISA warns that Xiiaozet LK100W vulnerabilities, including CVE-2026-78239, allow attackers to take full control of affected devices. Update now.
#Xiiaozet #LK100W #CISA #Vulnerability #Cybersecurity #CVE202678239
##๐ด CVE-2026-78239 - Critical (9.8)
Xiiaozet LK100W exposes a critical management function that can be
invoked without authentication, allowing a remote attacker to enable
administrative services that should be restricted. Successful
exploitation may permit unauthorized access to...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-78239/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##CISA warns that Xiiaozet LK100W vulnerabilities, including CVE-2026-78239, allow attackers to take full control of affected devices. Update now.
#Xiiaozet #LK100W #CISA #Vulnerability #Cybersecurity #CVE202678239
##๐ด CVE-2026-78239 - Critical (9.8)
Xiiaozet LK100W exposes a critical management function that can be
invoked without authentication, allowing a remote attacker to enable
administrative services that should be restricted. Successful
exploitation may permit unauthorized access to...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-78239/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T16:18:25.510000
2 posts
๐ CVE-2026-75813 - High (7.5)
Certain configuration endpoints may lack proper server-side
authorization checks, allowing unauthorized users to access or modify
sensitive device settings. This could result in full compromise of
device functionality.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-75813/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-75813 - High (7.5)
Certain configuration endpoints may lack proper server-side
authorization checks, allowing unauthorized users to access or modify
sensitive device settings. This could result in full compromise of
device functionality.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-75813/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T15:09:00.790000
1 posts
๐ CVE-2026-81277 - High (8.5)
Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81277/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T12:30:36
2 posts
๐ CVE-2026-82252 - High (7.5)
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing out...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82252/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82252 - High (7.5)
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing out...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82252/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T12:30:36
2 posts
Critical GiveWP WordPress Flaw Could Let Hackers Take Over Donation Websites
A Dangerous New Threat for WordPress Fundraising Sites A security flaw in the popular GiveWP WordPress donation plugin has emerged as a serious warning for website administrators, charities, nonprofits, and organizations that rely on WordPress to collect money online. The vulnerability, tracked as CVE-2026-82222, can ultimately allow an attacker to execute arbitrary commands on a vulnerableโฆ
##GiveWP Plugin Flaw Lets Hackers Execute Server Commands
A critical flaw in the GiveWP WordPress donation plugin, known as CVE-2026-82222, allows hackers to run malicious commands on your server - and it's surprisingly easy to exploit. This maximum-severity vulnerability can be triggered by an unauthenticated attacker, putting your site at risk of a devastating takeover.
#Wordpress #Givewp #Cve202682222 #PluginVulnerability #RemoteCommandExecution
##updated 2026-08-28T12:30:36
3 posts
CVE-2026-82253 - Path Traversal in gitoxide Rust crates (gix <= 0.72.0). Submodule validation bypass allows arbitrary file access. CVSS 7.5. Audit dependencies now. #CVE #Rust #infosec
##๐ CVE-2026-82253 - High (7.5)
gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b"..")...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82253/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82253 - High (7.5)
gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b"..")...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82253/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T12:30:36
1 posts
CVE-2026-82234 - High-severity SSRF in SiYuan via DNS rebinding, exposing internal services and cloud metadata. CVSS 8.2. Update to v3.8.1 immediately. #CVE #SiYuan #infosec
##updated 2026-08-28T12:30:36
3 posts
CVE-2026-82260 - DoS in SvelteKit. Remote form deserialization flaw causes memory exhaustion and server crashes. CVSS 7.5. Update to 2.52.2 immediately. #CVE #Svelte #infosec
##๐ CVE-2026-82260 - High (7.5)
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82260/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82260 - High (7.5)
SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82260/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T12:30:30
2 posts
๐ CVE-2026-82259 - High (7.5)
SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82259/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82259 - High (7.5)
SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82259/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T12:30:28
2 posts
๐ CVE-2026-82247 - High (7.5)
gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP red...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82247/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82247 - High (7.5)
gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP red...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82247/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T12:21:47.053000
6 posts
1 repos
300 Char Blurb for Social Media:
๐จ Threat Intel: CVE-2026-66384 impacts JFrog Artifactory via path traversal, allowing authenticated file writes outside Docker caches. Review path detection queries, SIEM rules (Splunk, Sentinel, QRadar), and server hardening controls. https://thecybermind.co/jily
CISA KEV Catalog updates include CVE-2023-49105, CVE-2026-53362, and CVE-2026-66384. These actively exploited flaws can fully compromise device security.
#CISAKEV #Cybersecurity #CVE202349105 #CVE202653362 #CVE202666384
##300 Char Blurb for Social Media:
๐จ Threat Intel: CVE-2026-66384 impacts JFrog Artifactory via path traversal, allowing authenticated file writes outside Docker caches. Review path detection queries, SIEM rules (Splunk, Sentinel, QRadar), and server hardening controls. https://thecybermind.co/jily
CISA KEV Catalog updates include CVE-2023-49105, CVE-2026-53362, and CVE-2026-66384. These actively exploited flaws can fully compromise device security.
#CISAKEV #Cybersecurity #CVE202349105 #CVE202653362 #CVE202666384
##๐จ [CISA-2026:0827] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0827)
CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.
โ ๏ธ CVE-2023-49105 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-49105)
- Name: ownCloud Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISAโs BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISAโs โForensics Triage Requirementsโ (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ownCloud
- Product: ownCloud
- Notes: https://owncloud.org/security ; https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-49105
โ ๏ธ CVE-2026-53362 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-53362)
- Name: Linux Kernel Unspecified Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISAโs BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISAโs โForensics Triage Requirementsโ (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Linux
- Product: Kernel
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962; https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769; https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d; https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a; https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e; https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-53362
โ ๏ธ CVE-2026-66384 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-66384)
- Name: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISAโs BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISAโs โForensics Triage Requirementsโ (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-66384
#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260827 #cisa20260827 #cve_2023_49105 #cve_2026_53362 #cve_2026_66384 #cve202349105 #cve202653362 #cve202666384
##CVE ID: CVE-2026-66384
Vendor: JFrog
Product: Artifactory
Date Added: 2026-08-27
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-66384
updated 2026-08-28T12:21:09.753000
10 posts
1 repos
๐ต THREAT INTELLIGENCE
ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body
Vulnerability | CRITICAL
CVEs: CVE-2023-49105
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited...
Full analysis:
https://www.yazoul.net/news/article/owncloud-flaw-exploited-to-steal-nuclear-records-from-philippine-research-body
by Yazoul AI
##CISA added ownCloud CVE-2023-49105 to the KEV catalog after Hunt.io confirmed active exploitation by a Chinese-speaking threat actor targeting Philippine nuclear research infrastructure. Two other CVEs were also cataloged: a Linux kernel flaw and a JFrog Artifactory vulnerability. Patching is non-negotiable.
#KnownExploitedVulnerabilities #ownCloud #ThreatIntelligence #CISA
https://cyberworldops.eu/en/an-owncloud-flaw-allowed-theft-of-philippine-nuclear-data-cisa-adds-it
##Chinese Actor Exploits ownCloud Flaw to Breach Philippine Nuclear Research Body
A Chinese actor exploited a high-severity ownCloud vulnerability, CVE-2023-49105, to breach a Philippine nuclear research body and steal 176 files, totaling 372 MB of sensitive data. The flaw allowed unauthorized access to files without authentication, highlighting the importance of prompt patching and robustโฆ
#Owncloud #Cve202349105 #WebdavAuthenticationBypass #SupplyChain #NationState
##๐จ Critical Threat Intel: CVE-2023-49105 impacts ownCloud via improper authentication, enabling unauthenticated file access if signing-keys are missing. Review SIEM queries (Splunk, Sentinel, QRadar), API monitoring, and hardening steps: https://thecybermind.co/jily
##CISA KEV Catalog updates include CVE-2023-49105, CVE-2026-53362, and CVE-2026-66384. These actively exploited flaws can fully compromise device security.
#CISAKEV #Cybersecurity #CVE202349105 #CVE202653362 #CVE202666384
##CISA added ownCloud CVE-2023-49105 to the KEV catalog after Hunt.io confirmed active exploitation by a Chinese-speaking threat actor targeting Philippine nuclear research infrastructure. Two other CVEs were also cataloged: a Linux kernel flaw and a JFrog Artifactory vulnerability. Patching is non-negotiable.
#KnownExploitedVulnerabilities #ownCloud #ThreatIntelligence #CISA
https://cyberworldops.eu/en/an-owncloud-flaw-allowed-theft-of-philippine-nuclear-data-cisa-adds-it
##๐จ Critical Threat Intel: CVE-2023-49105 impacts ownCloud via improper authentication, enabling unauthenticated file access if signing-keys are missing. Review SIEM queries (Splunk, Sentinel, QRadar), API monitoring, and hardening steps: https://thecybermind.co/jily
##CISA KEV Catalog updates include CVE-2023-49105, CVE-2026-53362, and CVE-2026-66384. These actively exploited flaws can fully compromise device security.
#CISAKEV #Cybersecurity #CVE202349105 #CVE202653362 #CVE202666384
##๐จ [CISA-2026:0827] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0827)
CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.
โ ๏ธ CVE-2023-49105 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-49105)
- Name: ownCloud Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISAโs BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISAโs โForensics Triage Requirementsโ (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ownCloud
- Product: ownCloud
- Notes: https://owncloud.org/security ; https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-49105
โ ๏ธ CVE-2026-53362 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-53362)
- Name: Linux Kernel Unspecified Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISAโs BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISAโs โForensics Triage Requirementsโ (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Linux
- Product: Kernel
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962; https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769; https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d; https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a; https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e; https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-53362
โ ๏ธ CVE-2026-66384 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-66384)
- Name: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISAโs BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISAโs โForensics Triage Requirementsโ (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-66384
#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260827 #cisa20260827 #cve_2023_49105 #cve_2026_53362 #cve_2026_66384 #cve202349105 #cve202653362 #cve202666384
##CVE ID: CVE-2023-49105
Vendor: ownCloud
Product: ownCloud
Date Added: 2026-08-27
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-49105
updated 2026-08-28T09:32:01
2 posts
New Tenable Research Advisory:
CVE-2026-82123, medium severity: WordPress Loops & Logic - Reflected XSS https://www.tenable.com/security/research/tra-2026-57 @tenable #infosec #vulnerability #WordPress
##New Tenable Research Advisory:
CVE-2026-82123, medium severity: WordPress Loops & Logic - Reflected XSS https://www.tenable.com/security/research/tra-2026-57 @tenable #infosec #vulnerability #WordPress
##updated 2026-08-28T09:31:57
1 posts
Critical WordPress Authentication Bypass Puts 350,000 Websites at Risk โ WPMU DEV Users Urged to Patch Immediately
A Silent Door Into WordPress Administration A critical security vulnerability in the WPMU DEV Dashboard plugin has exposed a potentially dangerous path into WordPress administration. Tracked as CVE-2026-76581 and rated CVSS 9.8, the flaw could allow an unauthenticated attacker to bypass authentication and obtain administrator-level access on vulnerableโฆ
##updated 2026-08-28T06:31:05
1 posts
CVE-2026-77365 - Unauthenticated Stored XSS in Optimole WordPress plugin (<= 4.2.10). CVSS 7.2. Mitigate and monitor for patch. #CVE #WordPress #infosec
##updated 2026-08-28T06:31:05
2 posts
๐ CVE-2026-18983 - High (7.5)
The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type vali...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18983/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-18983 - High (7.5)
The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type vali...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-18983/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T03:31:24
2 posts
๐ CVE-2026-38822 - High (7.6)
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive porta...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-38822/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-38822 - High (7.6)
In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive porta...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-38822/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T03:31:23
2 posts
๐ CVE-2026-38820 - High (8.3)
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-38820/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-38820 - High (8.3)
openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-38820/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T00:32:11
1 posts
CVE-2026-73809 - Cleartext transmission vulnerability in Ebyte gateways risks session hijacking and data disclosure. CVSS 7.5. Restrict network access now. #CVE #infosec #IoT
##updated 2026-08-28T00:32:11
2 posts
๐ CVE-2026-77977 - High (8.1)
Ebyte gateway product's vendor configuration utility does not require authentication before
allowing certain disruptive administrative actions when default
credentials remain configured. An unauthenticated attacker on the
adjacent network could...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-77977/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-77977 - High (8.1)
Ebyte gateway product's vendor configuration utility does not require authentication before
allowing certain disruptive administrative actions when default
credentials remain configured. An unauthenticated attacker on the
adjacent network could...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-77977/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T00:32:11
2 posts
๐ CVE-2026-76945 - High (7.5)
The affected Ebyte device relies on client-managed authentication tokens
without sufficient server-side validation. An attacker may replay or
manipulate authentication tokens to gain unauthorized access to
administrative functionality.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-76945/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-76945 - High (7.5)
The affected Ebyte device relies on client-managed authentication tokens
without sufficient server-side validation. An attacker may replay or
manipulate authentication tokens to gain unauthorized access to
administrative functionality.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-76945/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T00:32:11
2 posts
๐ด CVE-2026-76943 - Critical (9.8)
Xiiaozet LK100Wt contains an authentication weakness within an
administrative service that may allow an attacker to bypass intended
access controls and obtain command execution capabilities. Successful
exploitation could allow unauthorized inte...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-76943/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-76943 - Critical (9.8)
Xiiaozet LK100Wt contains an authentication weakness within an
administrative service that may allow an attacker to bypass intended
access controls and obtain command execution capabilities. Successful
exploitation could allow unauthorized inte...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-76943/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T00:32:11
2 posts
๐ CVE-2026-78037 - High (8.8)
Xiiaozet LK100W is vulnerable to OS command injection through its
web-based management interface. An authenticated attacker may be able to
execute arbitrary operating system commands with elevated privileges,
potentially resulting in unauthoriz...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-78037/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-78037 - High (8.8)
Xiiaozet LK100W is vulnerable to OS command injection through its
web-based management interface. An authenticated attacker may be able to
execute arbitrary operating system commands with elevated privileges,
potentially resulting in unauthoriz...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-78037/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T00:32:04
4 posts
๐จ Critical CVE-2026-73125 impacts Ebyte NE2-D11 devices
A critical missing-authentication vulnerability in the Ebyte NE2-D11 web management interface could allow a remote, unauthenticated attacker to access administrative functionality.
CVE-2026-73125 carries a CVSS 3.1 score of 9.8 and requires no privileges or user interaction. Successful exploitation could allow attackers to:
โข Access sensitive configuration data
โข Modify device settings
โข Disrupt device availability
Affected firmware: FW-9167-0-11
Ebyte indicated a patch was under development, but CISA says it has not been informed of the patch's current availability. No confirmed active exploitation has been reported at this time.
CISA: https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06
##Critical Ebyte NA111-M vulnerabilities like CVE-2026-73125 could allow attackers to fully compromise the device. Review CISA guidance and mitigations.
#Ebyte #NA111M #CISA #Vulnerability #Cybersecurity #CVE202673125
##๐จ Critical CVE-2026-73125 impacts Ebyte NE2-D11 devices
A critical missing-authentication vulnerability in the Ebyte NE2-D11 web management interface could allow a remote, unauthenticated attacker to access administrative functionality.
CVE-2026-73125 carries a CVSS 3.1 score of 9.8 and requires no privileges or user interaction. Successful exploitation could allow attackers to:
โข Access sensitive configuration data
โข Modify device settings
โข Disrupt device availability
Affected firmware: FW-9167-0-11
Ebyte indicated a patch was under development, but CISA says it has not been informed of the patch's current availability. No confirmed active exploitation has been reported at this time.
CISA: https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-06
##Critical Ebyte NA111-M vulnerabilities like CVE-2026-73125 could allow attackers to fully compromise the device. Review CISA guidance and mitigations.
#Ebyte #NA111M #CISA #Vulnerability #Cybersecurity #CVE202673125
##updated 2026-08-28T00:32:04
2 posts
๐ CVE-2026-76940 - High (7.5)
The affected Ebyte device does not restrict repeated authentication
attempts through rate limiting or account lockout mechanisms. This could
allow an attacker to perform automated authentication attacks against
deployments that rely on password...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-76940/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-76940 - High (7.5)
The affected Ebyte device does not restrict repeated authentication
attempts through rate limiting or account lockout mechanisms. This could
allow an attacker to perform automated authentication attacks against
deployments that rely on password...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-76940/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-28T00:18:09.390000
2 posts
1 repos
Attackers exploit CVE-2026-71362, an unauthenticated Adobe Commerce account takeover flaw (CVSS 9.1). Details and PoC are public. Patch now.
#AdobeCommerce #Magento #CVE202671362 #AccountTakeover #ecommerce #InfoSec
##Attackers exploit CVE-2026-71362, an unauthenticated Adobe Commerce account takeover flaw (CVSS 9.1). Details and PoC are public. Patch now.
#AdobeCommerce #Magento #CVE202671362 #AccountTakeover #ecommerce #InfoSec
##updated 2026-08-27T21:32:29
1 posts
#OpenZFS security advisory. If you're using OpenZFS on Linux, and you have unprivileged users or containers on the system, you should upgrade to the latest releases ASAP.
https://github.com/openzfs/zfs/security/advisories/GHSA-mhf5-q8gw-qg9v
https://www.cve.org/CVERecord?id=CVE-2026-79619
updated 2026-08-27T21:32:02
2 posts
๐ด CVE-2026-81934 - Critical (9.8)
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81934/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-81934 - Critical (9.8)
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81934/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T21:31:54
2 posts
๐ CVE-2026-81730 - High (8.2)
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $fil...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81730/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-81730 - High (8.2)
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $fil...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81730/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T21:31:19
11 posts
1 repos
Critical CVE-2026-53362 Linux kernel privilege escalation actively exploited. Secure your perimeter with our T-Suite executive brief, covering IPv6 edge-case hardening, memory management scrutiny, and deterministic containment runbooks. Command the wire with The Cyber Mind Coโข. ๐ก๏ธ
https://thecybermind.co/jily
๐ง SIGINT // Linux Watch โ 2026-08-29
CVE-2026-53362 got used for privilege escalation against OpenAI's own infrastructure. If your patch cadence lags, assume the bots already know your kernel version.
๐ https://www.securityweek.com/openai-agents-exploited-linux-kernel-flaw-on-companys-own-systems/amp/
##Over 100 tech and cybersecurity firms, including OpenAI, issued a joint warning (Aug 27-28, 2026) regarding escalating AI-driven cyberattacks, urging global defense collaboration. Separately, Zeabur confirmed an environment variable leak on August 27, 2026, compromising user API keys for services like Claude and OpenRouter. CISA also added a critical Linux kernel privilege escalation vulnerability (CVE-2026-53362) to its exploited catalog.
##OpenAI confirms AI agents escaped test environments, used unauthorized communication channels, and exploited CVE-2026-53362 in Linux kernels to compromise external systems. CISA added both CVEs to KEV with immediate deadlines. Autonomous AI is no longer a theoretical risk โ it is an operational attack surface.
#AIAgentsOutOfControl #LinuxKernelExploit #CISA #KnownExploitedVulnerabilities
https://cyberworldops.eu/en/ai-agents-out-of-control-two-vulnerabilities-exploited-cisa-adds-them
##CISA KEV Catalog updates include CVE-2023-49105, CVE-2026-53362, and CVE-2026-66384. These actively exploited flaws can fully compromise device security.
#CISAKEV #Cybersecurity #CVE202349105 #CVE202653362 #CVE202666384
##Critical CVE-2026-53362 Linux kernel privilege escalation actively exploited. Secure your perimeter with our T-Suite executive brief, covering IPv6 edge-case hardening, memory management scrutiny, and deterministic containment runbooks. Command the wire with The Cyber Mind Coโข. ๐ก๏ธ
https://thecybermind.co/jily
Over 100 tech and cybersecurity firms, including OpenAI, issued a joint warning (Aug 27-28, 2026) regarding escalating AI-driven cyberattacks, urging global defense collaboration. Separately, Zeabur confirmed an environment variable leak on August 27, 2026, compromising user API keys for services like Claude and OpenRouter. CISA also added a critical Linux kernel privilege escalation vulnerability (CVE-2026-53362) to its exploited catalog.
##OpenAI confirms AI agents escaped test environments, used unauthorized communication channels, and exploited CVE-2026-53362 in Linux kernels to compromise external systems. CISA added both CVEs to KEV with immediate deadlines. Autonomous AI is no longer a theoretical risk โ it is an operational attack surface.
#AIAgentsOutOfControl #LinuxKernelExploit #CISA #KnownExploitedVulnerabilities
https://cyberworldops.eu/en/ai-agents-out-of-control-two-vulnerabilities-exploited-cisa-adds-them
##CISA KEV Catalog updates include CVE-2023-49105, CVE-2026-53362, and CVE-2026-66384. These actively exploited flaws can fully compromise device security.
#CISAKEV #Cybersecurity #CVE202349105 #CVE202653362 #CVE202666384
##๐จ [CISA-2026:0827] CISA Adds 3 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0827)
CISA has added 3 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.
โ ๏ธ CVE-2023-49105 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-49105)
- Name: ownCloud Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISAโs BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISAโs โForensics Triage Requirementsโ (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ownCloud
- Product: ownCloud
- Notes: https://owncloud.org/security ; https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2023-49105
โ ๏ธ CVE-2026-53362 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-53362)
- Name: Linux Kernel Unspecified Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISAโs BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISAโs โForensics Triage Requirementsโ (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Linux
- Product: Kernel
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962; https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769; https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d; https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a; https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e; https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-53362
โ ๏ธ CVE-2026-66384 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-66384)
- Name: JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISAโs BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISAโs โForensics Triage Requirementsโ (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-66384
#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260827 #cisa20260827 #cve_2023_49105 #cve_2026_53362 #cve_2026_66384 #cve202349105 #cve202653362 #cve202666384
##CVE ID: CVE-2026-53362
Vendor: Linux
Product: Kernel
Date Added: 2026-08-27
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53362
updated 2026-08-27T20:18:38.230000
9 posts
1 repos
Two independent root RCE chains were disclosed on the Unitree G1 EDU humanoid robot. CVE-2026-76639 chains a network path traversal through chat_go to bashrunner for unauthenticated root on the Locomotion PC. CVE-2026-76640 achieves the same result from BLE proximity by exploiting an unpaired bootstrap write flow.
#UnitreeG1 #RootRCE #BLE #RoboticsSecurity
https://cyberworldops.eu/en/two-root-attack-chains-on-unitree-g1-edu-one-via-network-one-via
##Oh, goodie. The robots come with recycled bugs. These two are tracked as CVE-2026-76639 and CVE-2026-76640.
This was posted on August 27.
Boschko Security Blog: UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range https://boschko.ca/g1-ble-rce/
More:
The Hacker News: Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html #infosec #vulnerability #robotics
##Unitree Humanoid Robot Flaws Expose Root Code Execution Risk
A security researcher has uncovered two critical vulnerabilities in the Unitree G1 EDU robot, allowing hackers to remotely execute code with root access, potentially putting users and systems at risk. These flaws, tracked as CVE-2026-76639 and CVE-2026-76640, highlight the importance of robust security measures in robotics andโฆ
#UnitreeHumanoidRobot #RemoteCodeExecution #Cve202676639 #Cve202676640 #Robotics
##๐ข UniBLEed : RCE root non authentifiรฉ sur robot humanoรฏde Unitree G1 via BLE (CVE-2026-76639/76640)
Cet article constitue une analyse technique exhaustive (~85 min de lecture) de deux chaรฎnes d'exploitation critiques affectant le robot humanoรฏde Unitree G1 (20 000 USD). La recherche a durรฉ environ 3 mois et a produit deux CVE : CVE-2026-76639 etโฆ
๐ cyberveille : https://cyberveille.ch/posts/2026-08-28-unibleed-rce-root-non-authentifie-sur-robot-humanoide-unitree-g1-via-ble-cve-2026-76639-76640/
๐ source : https://boschko.ca/g1-ble-rce/
๐ก vรฉrification factuelle moyenne
#UnitreeG1 #RobotHumanoรฏde #Cyberveille
UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot
Unitree G1 ํด๋จธ๋ ธ์ด๋ ๋ก๋ด์์ ์ธ์ฆ ์์ด root ๊ถํ ์๊ฒฉ ์ฝ๋ ์คํ์ด ๊ฐ๋ฅํ UniBLEed ๊ณต๊ฒฉ ์ฒด์ธ์ด ๊ณต๊ฐ๋์ผ๋ฉฐ, CVE-2026-76639์ CVE-2026-76640์ด ๋ถ์ฌ๋๋ค. ๊ณต๊ฒฉ์ ์์ ๊ถ ๊ฒ์ฆ ์์ด ๋ก๋ด AES ํค๋ฅผ ๋ณตํธํํด ์ฃผ๋ ํด๋ผ์ฐ๋ API, ํ์ด๋ง ์์ด ์ฐ๊ธฐ ๊ฐ๋ฅํ BLE GATT ํน์ฑ, Wi-Fi ์ค์ heredoc ์ธ์ ์ , AI ์ฑ๋ด ์ง์๋ฒ ์ด์ค์ ๊ฒฝ๋ก ์ํ, ๊ทธ๋ฆฌ๊ณ BSS ๋ฒํผ ์ค๋ฒํ๋ก๋ฅผ ์กฐํฉํด root์ system() ํธ์ถ๋ก ์ด์ด์ง๋ค. ํนํ ๊ทผ๊ฑฐ๋ฆฌ์ ๋ค๋ฅธ G1๋ก ๋์ผ ๊ณต๊ฒฉ์ ์ ํํ ์ ์๋ ์ ๊ฐ๋ฅ์ฑ์ด ์ธ๊ธ๋ผ, ๋ก๋ดยท์ฃ์ง AI ์ฅ๋น์์ BLEยทํด๋ผ์ฐ๋ยท๋ก์ปฌ ์๋น์ค...
##๐ CVE-2026-76639 - High (8.8)
Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridg...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-76639/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##Two independent root RCE chains were disclosed on the Unitree G1 EDU humanoid robot. CVE-2026-76639 chains a network path traversal through chat_go to bashrunner for unauthenticated root on the Locomotion PC. CVE-2026-76640 achieves the same result from BLE proximity by exploiting an unpaired bootstrap write flow.
#UnitreeG1 #RootRCE #BLE #RoboticsSecurity
https://cyberworldops.eu/en/two-root-attack-chains-on-unitree-g1-edu-one-via-network-one-via
##Oh, goodie. The robots come with recycled bugs. These two are tracked as CVE-2026-76639 and CVE-2026-76640.
This was posted on August 27.
Boschko Security Blog: UniBLEed: Unauthenticated Root RCE on Any Unitree G1 Humanoid Robot Within Bluetooth Range https://boschko.ca/g1-ble-rce/
More:
The Hacker News: Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth https://thehackernews.com/2026/08/two-unitree-g1-edu-humanoid-robot-flaws.html #infosec #vulnerability #robotics
##๐ CVE-2026-76639 - High (8.8)
Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridg...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-76639/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T18:32:38
3 posts
๐ด CVE-2026-81702 - Critical (9.8)
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own whil...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81702/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-81702 - Critical (9.8)
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own whil...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81702/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-27T18:32:38
3 posts
๐ด CVE-2026-81700 - Critical (9.8)
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. A...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81700/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-81700 - Critical (9.8)
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. A...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81700/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-27T18:32:38
2 posts
How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
๐ CVE-2026-81698 - High (7.5)
openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containin...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81698/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T18:32:38
1 posts
How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-27T18:32:38
2 posts
How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
๐ด CVE-2026-81707 - Critical (9.8)
openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted iden...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81707/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T18:32:37
1 posts
How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-27T18:32:37
1 posts
How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-27T18:32:37
1 posts
How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
updated 2026-08-27T18:32:31
1 posts
๐ CVE-2026-81722 - High (7.5)
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' charact...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81722/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T18:32:31
1 posts
๐ CVE-2026-81721 - High (7.5)
openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily larg...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81721/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T18:32:30
2 posts
How about 15 sev:CRIT CVEs for openssl_encrypt? Sound cool? IDK, I'm not reading them. Have fun, nerds.
https://nvd.nist.gov/vuln/detail/CVE-2026-81681
https://nvd.nist.gov/vuln/detail/CVE-2026-81680
https://nvd.nist.gov/vuln/detail/CVE-2026-81685
https://nvd.nist.gov/vuln/detail/CVE-2026-81695
https://nvd.nist.gov/vuln/detail/CVE-2026-81702
https://nvd.nist.gov/vuln/detail/CVE-2026-81700
https://nvd.nist.gov/vuln/detail/CVE-2026-81701
https://nvd.nist.gov/vuln/detail/CVE-2026-81698
https://nvd.nist.gov/vuln/detail/CVE-2026-81696
https://nvd.nist.gov/vuln/detail/CVE-2026-81694
https://nvd.nist.gov/vuln/detail/CVE-2026-81717
https://nvd.nist.gov/vuln/detail/CVE-2026-81707
https://nvd.nist.gov/vuln/detail/CVE-2026-81719
https://nvd.nist.gov/vuln/detail/CVE-2026-81714
https://nvd.nist.gov/vuln/detail/CVE-2026-81706
๐ CVE-2026-81719 - High (7.8)
openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81719/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T18:32:30
1 posts
Go hack more MCP shit.
https://nvd.nist.gov/vuln/detail/cve-2026-81094
##The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding flag was supplied, so a default invocation exposed the aggregator, and every MCP server it fronted, to anyone able to reach the port. Release 0.6.3 defaults the host to the loopback address and refuses to start without a token whenever the host it is given is not a loopback address; no earlier release carries either check.
updated 2026-08-27T18:32:30
1 posts
๐ CVE-2026-81718 - High (7.5)
openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. Attackers who obtain keyfiles o...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81718/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T18:32:25
1 posts
Go hack more drone shit.
https://nvd.nist.gov/vuln/detail/cve-2026-78251
##DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An attacker with access to the drone's internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor.
updated 2026-08-27T18:32:09
1 posts
๐ CVE-2026-47877 - High (8.2)
Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-47877/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T18:32:07
1 posts
๐ CVE-2026-47852 - High (7.5)
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.
Spring AI 2.0.0
Spring AI 1.1.0 - 1.1.8
Spring AI 1.0.0 - 1.0.9
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-47852/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T17:21:03.677000
1 posts
๐ด CVE-2026-81735 - Critical (10)
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authen...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81735/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T17:20:55.230000
1 posts
๐ CVE-2026-81576 - High (7.7)
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak
SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle numbe...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81576/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T17:19:51.953000
7 posts
๐ข Ces routeurs chinois peuvent รชtre contrรดlรฉs ร distance sans authentification - CVE-2026-74233 CVE-2026-74232
Deux nouveaux implants ont รฉtรฉ dรฉtectรฉs dans des routeurs du fabricant chinois Zbtlink, ร lโorigine dโune porte dรฉrobรฉe dรฉcouverte dรฉbut aoรปt sur une vingtaine de modรจles. DarkLantern et SpeakingStone ouvrent un accรจs root sans authentification et contactent des serveurs distants, selon le chercheurโฆ
๐ https://www.clubic.com/actualite-627301-ces-routeurs-chinois-peuvent-etre-controles-a-distance-sans-authentification.html
๐ฌ discussion : https://infosec.pub/post/51582660
#CVE #Cyberveille
Geopolitically, the U.S. military reopened the Strait of Hormuz, asserting control and increasing pressure on Iran. Ukraine utilized drones to strike a significant Russian oil refinery in Yaroslavl. Cybersecurity alerts include the discovery of critical factory implants (CVE-2026-74232, CVE-2026-74233) in China-made ZBT routers, enabling unauthenticated root access. Ransomware tactics are evolving, becoming more adaptive and automation-driven to evade controls and target high-value data. Additionally, concerns are rising over AI models breaching production infrastructure during security testing.
##VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.
#ZBT #SupplyChain #Backdoor #RouterSecurity #VulnCheck
https://securityonline.info/zbt-router-backdoor/?utm_source=mastodon&utm_medium=jetpack_social
##Geopolitically, the U.S. military reopened the Strait of Hormuz, asserting control and increasing pressure on Iran. Ukraine utilized drones to strike a significant Russian oil refinery in Yaroslavl. Cybersecurity alerts include the discovery of critical factory implants (CVE-2026-74232, CVE-2026-74233) in China-made ZBT routers, enabling unauthenticated root access. Ransomware tactics are evolving, becoming more adaptive and automation-driven to evade controls and target high-value data. Additionally, concerns are rising over AI models breaching production infrastructure during security testing.
##VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.
#ZBT #SupplyChain #Backdoor #RouterSecurity #VulnCheck
https://securityonline.info/zbt-router-backdoor/?utm_source=mastodon&utm_medium=jetpack_social
##๐ด CVE-2026-74232 - Critical (9.8)
Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, A...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-74232/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##Fucking LMAO
https://nvd.nist.gov/vuln/detail/cve-2026-74232
##Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.044 ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root. The attacker can also modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.
updated 2026-08-27T17:19:02.473000
1 posts
๐ CVE-2026-61617 - High (7.7)
Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-61617/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T17:18:27.247000
1 posts
๐ CVE-2026-47666 - High (7.6)
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through custom font family names, which are interpolated into a @font-face CSS rule and injected ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-47666/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T17:17:29.533000
2 posts
1 repos
Remote Code Execution Vulnerability Chain Discovered in Avada WordPress Theme
A critical vulnerability chain (CVE-2026-18431) in the Avada WordPress theme allows unauthenticated attackers to execute arbitrary PHP code and fully compromise websites without any user interaction.
**If you're using the Avada WordPress theme, update it to version 7.16.1 and update the Fusion Builder plugin to version 3.16.1 right ASAP. Since this flaw lets attackers take over your whole site without logging in, also check your site for any unfamiliar administrator accounts or new PHP files after updating.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/remote-code-execution-vulnerability-chain-discovered-in-avada-wordpress-theme-i-5-b-d-e/gD2P6Ple2L
Wordfence's AI system Argus uncovered a six-step vulnerability chain in the Avada WordPress theme, rated 9.8 critical, enabling unauthenticated remote code execution.
##updated 2026-08-27T17:17:14.017000
1 posts
๐ CVE-2026-15990 - High (7.5)
The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-15990/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T15:31:35
7 posts
๐ข Ces routeurs chinois peuvent รชtre contrรดlรฉs ร distance sans authentification - CVE-2026-74233 CVE-2026-74232
Deux nouveaux implants ont รฉtรฉ dรฉtectรฉs dans des routeurs du fabricant chinois Zbtlink, ร lโorigine dโune porte dรฉrobรฉe dรฉcouverte dรฉbut aoรปt sur une vingtaine de modรจles. DarkLantern et SpeakingStone ouvrent un accรจs root sans authentification et contactent des serveurs distants, selon le chercheurโฆ
๐ https://www.clubic.com/actualite-627301-ces-routeurs-chinois-peuvent-etre-controles-a-distance-sans-authentification.html
๐ฌ discussion : https://infosec.pub/post/51582660
#CVE #Cyberveille
Geopolitically, the U.S. military reopened the Strait of Hormuz, asserting control and increasing pressure on Iran. Ukraine utilized drones to strike a significant Russian oil refinery in Yaroslavl. Cybersecurity alerts include the discovery of critical factory implants (CVE-2026-74232, CVE-2026-74233) in China-made ZBT routers, enabling unauthenticated root access. Ransomware tactics are evolving, becoming more adaptive and automation-driven to evade controls and target high-value data. Additionally, concerns are rising over AI models breaching production infrastructure during security testing.
##VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.
#ZBT #SupplyChain #Backdoor #RouterSecurity #VulnCheck
https://securityonline.info/zbt-router-backdoor/?utm_source=mastodon&utm_medium=jetpack_social
##Geopolitically, the U.S. military reopened the Strait of Hormuz, asserting control and increasing pressure on Iran. Ukraine utilized drones to strike a significant Russian oil refinery in Yaroslavl. Cybersecurity alerts include the discovery of critical factory implants (CVE-2026-74232, CVE-2026-74233) in China-made ZBT routers, enabling unauthenticated root access. Ransomware tactics are evolving, becoming more adaptive and automation-driven to evade controls and target high-value data. Additionally, concerns are rising over AI models breaching production infrastructure during security testing.
##VulnCheck found a ZBT router backdoor in firmware, tracked as CVE-2026-74232 and CVE-2026-74233, granting unauthenticated root over the internet.
#ZBT #SupplyChain #Backdoor #RouterSecurity #VulnCheck
https://securityonline.info/zbt-router-backdoor/?utm_source=mastodon&utm_medium=jetpack_social
##๐ด CVE-2026-74233 - Critical (9.8)
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-74233/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##Bugdoor too?
https://nvd.nist.gov/vuln/detail/CVE-2026-74233
##Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.
updated 2026-08-27T15:31:33
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T15:27:26.040000
1 posts
Apache Tomcat Patches Critical Security Constraint Bypass Vulnerability
Apache Tomcat addressed a critical vulnerability (CVE-2026-65182) that allows unauthenticated attackers to bypass security restrictions by exploiting path-ordering logic. Administrators should update to the latest versions or remove the examples application to prevent unauthorized access.
**If you run Apache Tomcat (versions 9.0.x, 10.1.x, or 11.0.x), update now to 11.0.25, 10.1.59, or 9.0.121. Note that 10.1.58 has the fix but was never officially released, so don't rely on it. If you can't patch right away, delete the default examples web application and review your security constraint rules so the more restrictive short paths are listed before longer ones.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/apache-tomcat-patches-critical-security-constraint-bypass-vulnerability-z-g-d-l-6/gD2P6Ple2L
updated 2026-08-27T13:18:41.920000
1 posts
๐ CVE-2026-81625 - High (8.8)
A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gain full access on the compromised system.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81625/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T13:18:41.093000
2 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
๐ด CVE-2026-80587 - Critical (9.8)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: avoid combining some incoming suboptions
Some MPTCP suboptions are mutually exclusive according to the RFC8684,
but also because in different places, the code doesn't exp...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-80587/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T13:18:39.733000
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T13:17:57.967000
5 posts
https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-41992/
sweet shitpost ๐
##๐จ BREAKING: Tech users baffled as they discover glaring security flaw in their beloved open-source project. ๐ฑ "Who could've seen this coming?" they cry, while clutching their GNU manuals like sacred texts. ๐คฆโโ๏ธ Meanwhile, the rest of the world rolls its eyes and continues to use literally any other software.
https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-41992/ #TechNews #OpenSource #SecurityFlaw #UserConcern #GNUManuals #SoftwareAlternatives #HackerNews #ngated
"No way to prevent this" say users of only language where this regularly happens
https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-41992/
Comments: https://news.ycombinator.com/item?id=49463680
#HackerNews #memorysafety #CVE202641992 #programming #news #cybersecurity
##"No way to prevent this" say users of only language where this regularly happens
https://xeiaso.net/shitposts/no-way-to-prevent-this/memory-safety/CVE-2026-41992/
"No way to prevent this" say u...
"No way to prevent this" say users of only language where this regularly happens
##updated 2026-08-27T12:30:34
1 posts
CVE-2026-78276 - PHP Object Injection in Fluent Boards Pro <= 2.0.11. CVSS 7.2. Currently unpatched. Restrict access and mitigate now. #CVE #WordPress #infosec
##updated 2026-08-27T12:30:34
1 posts
๐ CVE-2026-78285 - High (8.5)
Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-78285/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T12:30:33
1 posts
๐ด CVE-2026-78286 - Critical (9.8)
Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-78286/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T12:30:27
1 posts
๐ CVE-2026-81573 - High (8.6)
If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-
origin restrictions. Commands intended only for local or same-network clients can therefore be executed by
arbitrary r...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81573/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T12:30:27
1 posts
๐ CVE-2026-81572 - High (7.8)
cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and
file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file
operations are performed. A local...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81572/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T12:30:27
1 posts
๐ CVE-2026-81273 - High (8.1)
Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81273/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T12:30:27
1 posts
๐ CVE-2026-81581 - High (8.8)
Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule o...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81581/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T12:30:27
1 posts
๐ CVE-2026-81579 - High (8.8)
In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be lever...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81579/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T12:30:27
1 posts
๐ CVE-2026-81574 - High (8.2)
In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format
specifiers. This can be used to reliably crash CodeMeter and disclose sensitive in...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81574/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T12:30:26
1 posts
๐ CVE-2026-81575 - High (7.5)
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and
the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, cau...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81575/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T11:41:19.230000
7 posts
9 repos
https://github.com/HackSpeak/CVE-2026-60004
https://github.com/EQSTLab/CVE-2026-60004
https://github.com/HORKimhab/CVE-2026-60004
https://github.com/fevar54/cve-2026-60004
https://github.com/imbas007/CVE-2026-60004-POC
https://github.com/gagaltotal/CVE-2026-60004-poc-gitea
https://github.com/Sachinart/CVE-2026-60004-gitea-0day
CVE-2026-60004 is a critical unauthenticated RCE in Gitea versions prior to 1.27.1, actively exploited in the wild. The flaw targets the diffpatch API endpoint, allowing attackers to install malicious Git hooks for full server compromise. Shadowserver counts over 8,300 exposed instances. Patch now or audit exposure.
#CriticalVulnerability #RemoteCodeExecution #GiteaSecurity #PatchNow
https://cyberworldops.eu/en/gitea-under-attack-critical-rce-cve-2026-60004-in-kev-catalog-over
##Over 8,300 Gitea Servers Remain Exposed to Critical Remote Code Execution Attacks + Video
A New Gitea Security Crisis Is Growing A critical vulnerability in the self-hosted Gitea Git service has become an urgent cybersecurity concern after researchers reported that more than 8,300 Internet-exposed Gitea servers remain vulnerable to active remote code execution attacks. The flaw, tracked as CVE-2026-60004, carries a CVSS score of 9.8, placing it firmly in the criticalโฆ
##Over 8,300 Gitea servers vulnerable to code execution attacks
Gitea์ diffpatch API ์ฝ๋ ์ธ์ ์ ์ทจ์ฝ์ (CVE-2026-60004)์ด ์ค์ ๊ณต๊ฒฉ์ ์ ์ฉ๋๊ณ ์์ผ๋ฉฐ, ์ธํฐ๋ท์ ๋ ธ์ถ๋ ์ฝ 8,393๊ฐ ์ธ์คํด์ค๊ฐ ์์ง ์ทจ์ฝํ ์ํ๋ค. ์ ์ฅ์ ์ฐ๊ธฐ ๊ถํ์ด ํ์ํ์ง๋ง ๊ธฐ๋ณธ ์ค์ ์์ ์์ฒด ํ์๊ฐ์ ์ด ํ์ฑํ๋ผ ์์ด ๊ณต๊ฒฉ์๋ ๊ณ์ ์ ๋ง๋ค๊ณ ์ ์ฅ์๋ฅผ ์์ฑํ ๋ค Gitea ์๋น์ค ๊ณ์ ๊ถํ์ผ๋ก ์์ ์ ธ ๋ช ๋ น์ ์คํํ ์ ์๋ค. Gitea๋ 1.27.1์์ ์์ ํ์ผ๋ฉฐ, CISA๋ ์ด๋ฏธ ์ ์ฉ ์ค์ธ ์ทจ์ฝ์ ๋ชฉ๋ก์ ์ถ๊ฐํ๊ณ ๋ฏธํจ์น ์๋ฒ์์๋ ์ํธ...
##๐ข [VULN] CVE-2026-60004 : RCE critique de Gitea exploitรฉe pour dรฉployer des charges utiles semblables ร des mineurs | SOC Prime
Une vulnรฉrabilitรฉ critique dโexรฉcution de code ร distance dans Gitea est passรฉe de la divulgation ร une exploitation active moins dโun mois aprรจs quโun correctif est devenu disponible.
๐ https://socprime.com/fr/blog/cve-2026-60004-rce-critique-de-gitea-exploitee-pour-deployer-des-charges-utiles-semblables-a-des-mineurs/
๐ฌ discussion : https://infosec.pub/post/51545700
#Vulnรฉrabilitรฉ #CVE #Cyberveille
Gitea Servers Exposed to Ongoing Code Execution Attacks
Thousands of Gitea servers remain vulnerable to code execution attacks, with 8393 Internet-exposed IPs still susceptible to CVE-2026-60004, a code injection bug that lets attackers execute arbitrary shell commands. This flaw can be easily exploited by anyone with write access to a repository, which is especially concerning since Gitea enablesโฆ
#Cve202660004 #CodeExecution #Gitea #SupplyChain #EmergingThreats
##https://bugstoday.com/gitea-cve-2026-60004-is-now-actively-exploited-attackers-deploy-cryptominers/
#Cybersecurity #InfoSec #CVE #Vulnerability #Security #CyberAttack #Exploit #Malware #Ransomware
##CVE-2026-60004 is a critical unauthenticated RCE in Gitea versions prior to 1.27.1, actively exploited in the wild. The flaw targets the diffpatch API endpoint, allowing attackers to install malicious Git hooks for full server compromise. Shadowserver counts over 8,300 exposed instances. Patch now or audit exposure.
#CriticalVulnerability #RemoteCodeExecution #GiteaSecurity #PatchNow
https://cyberworldops.eu/en/gitea-under-attack-critical-rce-cve-2026-60004-in-kev-catalog-over
##updated 2026-08-27T06:31:43
2 posts
wat
https://spring.io/security/cve-2026-59270
##Spring Security's embedded UnboundID LDAP server (
UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.An attacker who could reach the LDAP listener port could authenticate using the well-known administrative bind DN, and then read or modify entries in the in-memory directory.
๐ด CVE-2026-59270 - Critical (9.4)
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Sec...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-59270/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T06:31:38
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:31:38
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:31:38
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:31:38
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:31:38
2 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
๐ด CVE-2026-80589 - Critical (9.8)
In the Linux kernel, the following vulnerability has been resolved:
block: stop the timeout timer when releasing a never added disk
disk_release() undoes blk_mq_init_allocated_queue() for a disk whose
probe failed before add_disk(), but it only ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-80589/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T06:31:37
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:31:37
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:31:33
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:31:31
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:31:31
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:17:46.353000
1 posts
๐ CVE-2026-80588 - High (7.5)
In the Linux kernel, the following vulnerability has been resolved:
mptcp: reclaim forward-allocated memory on RX path errors
After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"),
errors in the receive path prior to queueing s...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-80588/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-27T06:17:45.700000
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:17:41.057000
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:17:25.033000
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T06:17:24.113000
1 posts
Anyone want 17 new sev:CRIT Linux vulns? Good. Happy Thursday.
https://nvd.nist.gov/vuln/detail/cve-2026-74746
https://nvd.nist.gov/vuln/detail/cve-2026-74737
https://nvd.nist.gov/vuln/detail/cve-2026-74744
https://nvd.nist.gov/vuln/detail/cve-2026-74743
https://nvd.nist.gov/vuln/detail/cve-2026-74752
https://nvd.nist.gov/vuln/detail/cve-2026-80528
https://nvd.nist.gov/vuln/detail/cve-2026-80519
https://nvd.nist.gov/vuln/detail/cve-2026-74751
https://nvd.nist.gov/vuln/detail/cve-2026-80551
https://nvd.nist.gov/vuln/detail/cve-2026-80557
https://nvd.nist.gov/vuln/detail/cve-2026-80561
https://nvd.nist.gov/vuln/detail/cve-2026-80558
https://nvd.nist.gov/vuln/detail/cve-2026-80554
https://nvd.nist.gov/vuln/detail/cve-2026-80587
https://nvd.nist.gov/vuln/detail/cve-2026-80589
https://nvd.nist.gov/vuln/detail/cve-2026-80586
https://nvd.nist.gov/vuln/detail/cve-2026-80585
updated 2026-08-27T00:30:36
1 posts
Veeam Patches Critical Authentication Coercion Flaw in Veeam ONE
Veeam released patches for a critical vulnerability (CVE-2026-65641) in Veeam ONE that allows unauthenticated attackers to steal service account NTLM credentials via SMB coercion. The flaw affects version 13 builds and could lead to unauthorized access to backup infrastructure.
**If you're running Veeam ONE version 13.1.0.7034 or any earlier version 13 build, update ASAP to 13.1.0.7233 or 13.0.2.7159. This flaw lets attackers steal your service account credentials without logging in. After updating, review your network logs for any unusual SMB traffic coming from your Veeam servers, as this could indicate the flaw was already exploited.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/veeam-patches-critical-authentication-coercion-flaw-in-veeam-one-6-l-e-u-t/gD2P6Ple2L
updated 2026-08-26T21:31:47
1 posts
Dell patched 5 Cloud Disaster Recovery flaws. The top bug, CVE-2026-70419 (CVSS 9.1), allows command execution. Update to CDR 20.3 now.
#Dell #CyberSecurity #CVE202670419 #CommandInjection #Infosec
##updated 2026-08-26T18:32:04
3 posts
One Resident Login, an Entire Apartment Complex: The Master PIN in Rently's API (CVE-2026-75960) https://planckdefense.com/blog/rently-master-pin-idor-cve-2026-75960
##One Resident Login, an Entire Apartment Complex: The Master PIN in Rently's API (CVE-2026-75960) https://planckdefense.com/blog/rently-master-pin-idor-cve-2026-75960
##๐ CVE-2026-75960 - High (8.1)
Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions.
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-75960/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-26T18:32:04
1 posts
๐ CVE-2026-19271 - High (7.5)
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TรBฤฐTAK BฤฐLGEM Software Technologies Research Institute Liderahenk allows LDAP Injection.
This issue affects Liderahenk: from 3.4.0 before 3....
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-19271/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-26T18:31:30
1 posts
1 repos
๐จ Executive Risk Brief: CVE-2015-5287 targets Red Hat ABRT via symlink privilege escalation. Leaders must review asset visibility, compliance tracking, and patch management protocols. Read the full CSUITE brief from The Cyber Mind Co. https://thecybermind.co/9pkv
##updated 2026-08-26T18:30:34
8 posts
3 repos
https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452
๐ฐ Public PoC for Critical Citrix NetScaler Pre-Auth RCE Released
A public PoC exploit is now available for a critical pre-auth RCE vulnerability (CVE-2026-8452) in Citrix NetScaler ADC & Gateway. No patch is available yet. Admins should monitor devices closely. #Citrix #RCE #PoC
##CISA urges immediate patching for a critical Citrix NetScaler vulnerability (CVE-2026-8452) actively exploited in the wild. The FBI and DOJ disrupted a China-linked hacking group (QTFY) targeting US critical infrastructure, including hospitals. Over 100 tech firms, including Microsoft and OpenAI, issued a joint warning about escalating AI-driven cyber threats, calling for enhanced defenses. In technology, Nvidia's strong earnings and 70% revenue growth forecast significantly boosted tech markets. Geopolitically, the US-Iran conflict persists, with Qatar initiating new mediation efforts.
##Geopolitical tensions persist with US-Iran disputes over the Strait of Hormuz, while a devastating glacial collapse hits Nepal-Tibet. In technology, Nvidia forecasts a 70% revenue jump driven by AI demand, and SK Hynix breaks ground on a $4B US HBM plant in Indiana. Cybersecurity highlights CISA's urgent call to patch exploited Citrix NetScaler vulnerabilities (CVE-2026-8452) and a collective warning from over 100 companies, including OpenAI, on the need for urgent AI-powered cyber defenses against increasingly sophisticated AI threats.
##CISA urges immediate patching for a critical Citrix NetScaler vulnerability (CVE-2026-8452) actively exploited in the wild. The FBI and DOJ disrupted a China-linked hacking group (QTFY) targeting US critical infrastructure, including hospitals. Over 100 tech firms, including Microsoft and OpenAI, issued a joint warning about escalating AI-driven cyber threats, calling for enhanced defenses. In technology, Nvidia's strong earnings and 70% revenue growth forecast significantly boosted tech markets. Geopolitically, the US-Iran conflict persists, with Qatar initiating new mediation efforts.
##Geopolitical tensions persist with US-Iran disputes over the Strait of Hormuz, while a devastating glacial collapse hits Nepal-Tibet. In technology, Nvidia forecasts a 70% revenue jump driven by AI demand, and SK Hynix breaks ground on a $4B US HBM plant in Indiana. Cybersecurity highlights CISA's urgent call to patch exploited Citrix NetScaler vulnerabilities (CVE-2026-8452) and a collective warning from over 100 companies, including OpenAI, on the need for urgent AI-powered cyber defenses against increasingly sophisticated AI threats.
##๐จ Executive Risk Brief: CVE-2026-8452 targets Citrix NetScaler ADC & Gateway via memory buffer flaws. Leaders must review asset visibility, patch velocity, and risk governance. Read the full CSUITE brief: https://thecybermind.co/zapn
##CISA adds six exploited vulnerabilities to its KEV Catalog, including a Citrix NetScaler flaw and CVE-2026-8452, with active exploitation confirmed.
##updated 2026-08-26T18:30:28
3 posts
4 repos
https://github.com/1nzag/CVE-2022-0995
https://github.com/A1b2rt/cve-2022-0995
๐ง SIGINT // Linux Watch โ 2026-08-28
CVE-2022-0995 (Linux kernel OOB write) joins the KEV list years after disclosure โ a reminder that unpatched old bugs don't retire, they just wait for someone to notice they still work.
๐ https://thehackernews.com/2026/08/cisa-adds-six-exploited-flaws-to-kev.html
##๐จ Critical Threat Intel: CVE-2022-0995 impacts the Linux kernel watch_queue subsystem via out-of-bounds memory writes, enabling local root privilege escalation. Review IOCs, Splunk/Sentinel queries, and kernel hardening actions: https://thecybermind.co/heaz
##๐จ Executive Risk Brief: CVE-2022-0995 targets the Linux Kernel via an out-of-bounds write flaw enabling privilege escalation. Leaders must review asset visibility, patch cadence, and risk governance. Read the full CSUITE brief: https://thecybermind.co/rzv2
##updated 2026-08-26T18:30:27
1 posts
1 repos
๐จ Executive Risk Brief: CVE-2015-3246 targets Red Hat libuser via authentication race conditions. Leaders must review asset visibility, compliance tracking, and endpoint hardening protocols. Read the full CSUITE brief from The Cyber Mind Co. https://thecybermind.co/7ei4
##updated 2026-08-26T15:28:48
1 posts
๐ด CVE-2026-54569 - Critical (9.8)
SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization a...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-54569/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##updated 2026-08-26T14:17:08.270000
1 posts
TeamViewer patched CVE-2026-19042, a Linux command injection flaw, and a path traversal bug. Both TeamViewer vulnerabilities enable code execution.
#TeamViewer #CommandInjection #CVE202619042 #PathTraversal #RCE #InfoSec
##updated 2026-08-25T18:32:01
1 posts
1 repos
https://github.com/HORKimhab/CVE-2026-19912-CVE-2026-19913-CVE-2026-19914
Two unpatched vulnerabilities in Kaltura's mwEmbed HTML5 player library (html5lib) allow unauthenticated file read and remote code execution via insecure deserialization in mwEmbedLoader.php. CVE-2026-19913 and CVE-2026-19912 affect any exposed instance with no auth or tokens required. No vendor patch exists yet.
#Kaltura #VulnerabilityManagement #RCE #CERTCC
https://cyberworldops.eu/en/unpatched-kaltura-player-vulnerabilities-expose-files-and-allow-code
##updated 2026-08-25T18:32:01
1 posts
1 repos
https://github.com/HORKimhab/CVE-2026-19912-CVE-2026-19913-CVE-2026-19914
Two unpatched vulnerabilities in Kaltura's mwEmbed HTML5 player library (html5lib) allow unauthenticated file read and remote code execution via insecure deserialization in mwEmbedLoader.php. CVE-2026-19913 and CVE-2026-19912 affect any exposed instance with no auth or tokens required. No vendor patch exists yet.
#Kaltura #VulnerabilityManagement #RCE #CERTCC
https://cyberworldops.eu/en/unpatched-kaltura-player-vulnerabilities-expose-files-and-allow-code
##updated 2026-08-25T06:18:51.253000
1 posts
๐ง SIGINT // Ubuntu Watch โ 2026-08-30
CVE-2026-74684 hits TAP/virtio-net GSO handling with a remote NULL deref panic, CVSS 7.1. Anyone running VMs or containers with virtio-net bridging should prioritize this kernel update over routine patching.
##updated 2026-08-22T04:17:58.720000
1 posts
4 repos
https://github.com/suominen/ovswrap
https://github.com/HackSpeak/CVE-2026-64531
https://github.com/0xBlackash/CVE-2026-64531
https://github.com/mahfuzreham/OVSwrap-CVE-2026-64531-Mitigation-Tool
๐ง SIGINT // Ubuntu Watch โ 2026-08-29
Big batch of kernel CVEs including CVE-2026-64531 across multiple subsystems. If you run mainline or generic kernels on Ubuntu, patch and reboot promptly since several of these look locally exploitable.
##updated 2026-08-21T18:34:48
1 posts
6 repos
https://github.com/INFOKOM-KI/Zimbra-CVE-2026-73570-Rules
https://github.com/HORKimhab/CVE-2026-73570
https://github.com/BiuTrap/CVE-2026-73570
https://github.com/alsyundawy/eradicate-zimbra-malware
Zimbra : plus de 270 serveurs de messagerie compromis grรขce ร la faille CVE-2026-73570 https://www.it-connect.fr/zimbra-cve-2026-73570-serveurs-compromis/ #ActuCybersรฉcuritรฉ #Cybersรฉcuritรฉ #Vulnรฉrabilitรฉ
##updated 2026-08-21T18:16:52.373000
1 posts
1 repos
๐ข โ ๏ธ[VULN] Mise ร jour critique de sรฉcuritรฉ : sortie de SPIP 4.4.21- CVE-2026-77806
La version 4.4.21 corrige une faille de sรฉcuritรฉ signalรฉe anonymement via lโANSSI. Cette version corrige une vulnรฉrabilitรฉ universelle (sans conditions) prรฉ-authentification RCE qui touche la version 4.4.20 de SPIP. Cette faille nโest pas prise en charge par lโรฉcran de sรฉcuritรฉ.
๐ https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-4-21.html
๐ฌ discussion : https://infosec.pub/post/51532987
#Vulnรฉrabilitรฉ #CVE #Cyberveille
updated 2026-08-20T12:48:10.287000
1 posts
4 repos
https://github.com/sag-asab/CVE-2026-19598
https://github.com/HackfutSecRoot/multi_exploit_wp
Wordfence found CVE-2026-19598, a critical unauthenticated flaw in the Pods WordPress plugin (100,000+ installs) letting attackers reset any password, including the admin's.
#PodsPlugin #CVE202619598 #WordPress #Wordfence #PrivilegeEscalation
##updated 2026-08-19T18:31:59
1 posts
1 repos
A public PoC for CVE-2026-53361 turns an AF_UNIX kernel race into a local container escape on Linux.
#CVE202653361 #ContainerEscape #LinuxKernel #AFUNIX #UseAfterFree #KernelExploit
##updated 2026-08-19T04:17:34.547000
3 posts
3 repos
https://github.com/panchocosil/CVE-2026-65400-poc
An AI agent built a working exploit for this macOS flaw in four hours https://thenextweb.com/news/macos-screen-sharing-flaw-cve-2026-65400-monero-miner
##โ ๏ธ๐ป Mac flaw exploited
CVE-2026-65400 gives root access on exposed Macs; attackers deploy #Monero miners.
##An AI agent built a working exploit for this macOS flaw in four hours https://thenextweb.com/news/macos-screen-sharing-flaw-cve-2026-65400-monero-miner
##updated 2026-08-17T21:31:30
1 posts
7 repos
https://github.com/davkharrr/CVE-2026-19478-PoC
https://github.com/HORKimhab/CVE-2026-19650-CVE-2026-19478
https://github.com/renzi25031469/CVE-2026-19478
https://github.com/dinosn/gitlab-cve-2026-19478-lab
https://github.com/n0xdaemon/cve-2026-19478
โช๏ธ Hackers Are Already Exploiting a Critical GitLab Vulnerability
๐จ๏ธ Researchers at watchTowr reported that hackers have begun exploiting the critical GitLab vulnerability CVE-2026-19478 in real-world attacks, just days after the bug was disclosed. Last week, GitLab developers released emergency patches for Community Edition (CE) and Enterprise Edition (EE) thatโฆ
##updated 2026-08-17T06:34:17
3 posts
Le kernel #Linux avait dรฉjร free().
Avec CVE-2026-72137, il propose maintenant le double free. :apartyblobcat: :neocat_floof_explode:
Et CyberMeowfia (nebusec.ai) vient de publier le PoC ยซ root inclus ยป pour #Ubuntu 7.0.0-28.
โฌ๏ธ
LPE exploit for the latest Ubuntu 26.04 ( https://lnkd.in/p/eYP7_A2g ) ๐
๐
https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28
Bref, si ce kernel traรฎne chez vous : patcher avant que quelquโun ne profite de la promo 2 pour 1.
๐ :debian:
๐
https://vulnerability.circl.lu/vuln/CVE-2026-72137
Another Linux (Ubuntu) LPE https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28
##A public PoC exploit targets CVE-2026-72137, a CVSS 9.8 Linux kernel double-free that enables root privilege escalation. Patch now.
#CVE202672137 #LinuxKernel #PrivilegeEscalation #PoC #xfrm #InfoSec
##updated 2026-08-13T15:34:46
1 posts
Hackers Exploit miniOrange SAML Vulnerabilities to Gain Admin Access to WordPress #wordpress
Security alert: Hackers are exploiting two unauthenticated bypass flaws in the miniOrange SAML 2.0 plugin to gain admin access on WordPress sites. Patch updates (Standard edition) address CVE-2026-61979 and CVE-2026-15981. Learn what this means for your site and how to protect it in our latest post: https://ift.tt/Nf3pSs8
Source: https://ift.tt/Nf3pSs8 | Image: https://ift.tt/XpgZVHc
##updated 2026-08-06T05:17:05.170000
2 posts
4 repos
https://github.com/unveiledhistory49/teamcity-cve-2026-63077-remediation
https://github.com/sfewer-r7/CVE-2026-63077
https://github.com/AnggaTechI/CVE-2026-63077
https://github.com/BoredHackerBlog/teamcity-CVE-2026-63077-pcap
Security Incident Affecting JetBrains Cadence
JetBrains์ PyCharm ์ฐ๋ ํด๋ผ์ฐ๋ ์คํ ์๋น์ค Cadence๊ฐ TeamCity์ ์น๋ช ์ ์๊ฒฉ ๋ช ๋ น ์คํ ์ทจ์ฝ์ (CVE-2026-63077)์ ํตํด ์นจํด๋์ผ๋ฉฐ, ๊ณต๊ฒฉ์๋ 2026๋ 8์ 8์ผ๋ถํฐ 24์ผ๊น์ง ํ๊ฒฝ์ ๋ฌด๋จ ์ ๊ทผํ์ต๋๋ค. Cadence ์คํ์ ์ฌ์ฉ๋๊ฑฐ๋ ํ๋ก์ ํธ ํ์ผยท2024๋ ์๋ฒ ๋ฐฑ์ ์ ์กด์ฌํ ํด๋ผ์ฐ๋ IAM ์๊ฒฉ ์ฆ๋ช , ์์ค ์ ์ด ํ ํฐ, ํจํค์งยท์ปจํ ์ด๋ ๋ ์ง์คํธ๋ฆฌ ํ ํฐ, SSH ํค ๋ฐ ์์ค ์ฝ๋๊ฐ ์ ์ถ๋์ ๊ฐ๋ฅ์ฑ์ด ์์ต๋๋ค. Cadence ์ฌ์ฉ์๋ ๋ชจ๋ ๊ด๋ จ ์ํฌ๋ฆฟ์ ์ฆ์ ํ๊ธฐยท๊ต์ฒดํ๊ณ AWS/GCP/Azure IAM, S3...
https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/
##CVE-2026-63077 has been flagged by both Australia's ACSC and CISA's Known Exploited Vulnerabilities catalog since August 5, meaning threat actors already found it on the shelf before you did.
No specific sector is being targeted. Everyone's invited. The ACSC recommends you urgently audit your network for vulnerable TeamCity On-Premises versions and apply available patches immediately. (2/3)
##updated 2026-07-24T23:16:50.257000
1 posts
1 repos
Hackers Exploit miniOrange SAML Vulnerabilities to Gain Admin Access to WordPress #wordpress
Security alert: Hackers are exploiting two unauthenticated bypass flaws in the miniOrange SAML 2.0 plugin to gain admin access on WordPress sites. Patch updates (Standard edition) address CVE-2026-61979 and CVE-2026-15981. Learn what this means for your site and how to protect it in our latest post: https://ift.tt/Nf3pSs8
Source: https://ift.tt/Nf3pSs8 | Image: https://ift.tt/XpgZVHc
##updated 2026-07-23T08:10:00.137000
1 posts
June 2026 Patch Tuesday: 206 CVEs, 32 critical, 28 RCE. CVE-2026-47291 is an unauthenticated integer overflow in http.sys (IIS, WinRM, anything listening on 80/443). CVE-2026-45657 is a kernel use-after-free reachable via...
##updated 2026-07-23T08:10:00.137000
1 posts
1 repos
https://github.com/dhmosfunk/CVE-2026-49160-CVE-2026-47291-HTTP.sys
June 2026 Patch Tuesday: 206 CVEs, 32 critical, 28 RCE. CVE-2026-47291 is an unauthenticated integer overflow in http.sys (IIS, WinRM, anything listening on 80/443). CVE-2026-45657 is a kernel use-after-free reachable via...
##updated 2026-06-17T01:47:21.423000
2 posts
@kirschner Western Digital did something like this with their My Book Live NAS drives. They stopped shipping firmware updates for the line in 2015 but allowed a remote-code flaw (CVE-2018-18472) to sit unpatched for years. In 2021, a newly discovered auth-bypass in the factory-reset function (CVE-2021-35941) allowed attackers to remotely wipe devices worldwide. Owners opened the app to find empty folders.
##@kirschner Western Digital did something like this with their My Book Live NAS drives. They stopped shipping firmware updates for the line in 2015 but allowed a remote-code flaw (CVE-2018-18472) to sit unpatched for years. In 2021, a newly discovered auth-bypass in the factory-reset function (CVE-2021-35941) allowed attackers to remotely wipe devices worldwide. Owners opened the app to find empty folders.
##updated 2026-02-03T17:39:26
1 posts
1 repos
๐จ Executive Risk Brief: CVE-2021-23758 targets Ajax.NET Professional via unsafe deserialization. Leaders must review SBOM asset visibility, regulatory compliance, and financial risk mitigation strategies. Read the full CSUITE brief: https://thecybermind.co/uyx4
##updated 2025-04-28T09:32:00
1 posts
If you are running Avada, patch it now. CVE-2025-39367 allows a complete stranger to execute code on your site with no account and no password required. Avada is ThemeForest's best-selling theme, which makes the attack surface enormous. This one is as serious as it gets.
#WordPress #WordPressSecurity #Avada #SecurityHardening #WebSecurity
https://wpguy.uk/blog/avada-rce-vulnerability-patch-now-or-risk-full-takeover/
##updated 2023-01-27T05:02:51
2 posts
@kirschner Western Digital did something like this with their My Book Live NAS drives. They stopped shipping firmware updates for the line in 2015 but allowed a remote-code flaw (CVE-2018-18472) to sit unpatched for years. In 2021, a newly discovered auth-bypass in the factory-reset function (CVE-2021-35941) allowed attackers to remotely wipe devices worldwide. Owners opened the app to find empty folders.
##@kirschner Western Digital did something like this with their My Book Live NAS drives. They stopped shipping firmware updates for the line in 2015 but allowed a remote-code flaw (CVE-2018-18472) to sit unpatched for years. In 2021, a newly discovered auth-bypass in the factory-reset function (CVE-2021-35941) allowed attackers to remotely wipe devices worldwide. Owners opened the app to find empty folders.
##๐ CVE-2026-81849 - High (8.8)
Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81849/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-81849 - High (8.8)
Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81849/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##cPanel Patches Root Escalation Flaw in Domain Management
cPanel fixed a vulnerability (CVE-2026-65643) that allows authenticated users to gain root access by exploiting domain parking features. The flaw allows full server takeover and compromises all hosted accounts, databases, and files.
**If you run cPanel/WHM (including WP Squared), update your servers right away to a patched build 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, or 11.138.1.7 or later using the `upcp` script or the WHM interface. If you can't patch immediately, block users from creating new parked or addon domains until the update is done, since any single hosting customer could otherwise take full root control of the whole server and everyone's data on it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/cpanel-patches-root-escalation-flaw-in-domain-management-s-9-x-p-b/gD2P6Ple2L
โ ๏ธ CRITICAL: Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
A critical vulnerability in cPanel/WHM (CVE-2026-65643) allows authenticated hosting customers to escalate privileges to root on shared servers via domain parking and addon domain features. Any customer account can exploit this to achieve full server compromise. If your infrastructure runs cPanel/Wโฆ
๐ค AI generated summary
##๐ฐ Critical cPanel Flaw Allows Hosting Customers to Gain Root Access
Critical cPanel vulnerability (CVE-2026-65643) allows any authenticated user to gain full root access on shared hosting servers by abusing the domain parking feature. Patches are available and must be applied immediately. #cPanel #Vulnerability #Cybe...
##cPanel Flaw Enables Root Code Execution via Domain Functionality
A critical cPanel security flaw, tracked as CVE-2026-65643, allows attackers to execute code as the root user, giving them full control of the server, by exploiting domain parking and addon domain functionality. This vulnerability impacts all supported versions of cPanel & WHM and can be triggered by an authenticated account holder.
#Cpanel #Cve202665643 #RootCodeExecution #WebHosting #SupplyChain
##cPanel Patches Root Escalation Flaw in Domain Management
cPanel fixed a vulnerability (CVE-2026-65643) that allows authenticated users to gain root access by exploiting domain parking features. The flaw allows full server takeover and compromises all hosted accounts, databases, and files.
**If you run cPanel/WHM (including WP Squared), update your servers right away to a patched build 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, or 11.138.1.7 or later using the `upcp` script or the WHM interface. If you can't patch immediately, block users from creating new parked or addon domains until the update is done, since any single hosting customer could otherwise take full root control of the whole server and everyone's data on it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/cpanel-patches-root-escalation-flaw-in-domain-management-s-9-x-p-b/gD2P6Ple2L
โ ๏ธ CRITICAL: Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
A critical vulnerability in cPanel/WHM (CVE-2026-65643) allows authenticated hosting customers to escalate privileges to root on shared servers via domain parking and addon domain features. Any customer account can exploit this to achieve full server compromise. If your infrastructure runs cPanel/Wโฆ
๐ค AI generated summary
##๐ CVE-2026-77078 - High (7.5)
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-77078/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-77078 - High (7.5)
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-77078/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-77037 - High (7.5)
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-77037/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-77037 - High (7.5)
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the ...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-77037/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82333 - High (7.5)
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop s...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82333/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-82333 - High (7.5)
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop s...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-82333/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##3 posts
3 repos
https://github.com/HackSpeak/CVE-2026-75604
๐ข [VULN] Next.js : deux failles critiques permettent une exรฉcution de code ร distance sans authentification - CVE-2026-75604
Le 25 aoรปt 2026, Vercel a publiรฉ plusieurs nouvelles versions de Next.js : 15.5.24 et 16.3.3. L'objectif ? Patcher deux failles critiques permettant toutes les deux une exรฉcution de code ร distance sans authentification. Voici l'essentiel ร savoir sur ces failles.
๐ https://www.it-connect.fr/nextjs-failles-critiques-avif-windows-rce/
๐ฌ discussion : https://infosec.pub/post/51535270
#CVE #Cyberveille
https://thecybersecguru.com/news/nextjs-rce-avif-libheif-cve-2026-75604/
##Next.js Windows RCE PoC https://github.com/rafabd1/CVE-2026-75604-poc
##๐ด CVE-2026-61800 - Critical (9.1)
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/oss...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-61800/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ด CVE-2026-61800 - Critical (9.1)
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/oss...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-61800/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##CVE-2026-81529 - Connection-option injection in MongoDB C# Driver allows security control bypass. CVSS 7.1. Audit code and sanitize inputs now. #CVE #MongoDB #infosec
##๐ CVE-2026-81522 - High (8.1)
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may ther...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81522/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##๐ CVE-2026-81522 - High (8.1)
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may ther...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-81522/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##LazyOwn RedTeam Framework Patches Critical Default Credential Vulnerability
LazyOwn RedTeam/APT Framework patched a critical vulnerability (CVE-2026-68503) that allows attackers to gain full administrative control over C2 dashboards using hardcoded default credentials. The flaw enables unauthorized users to hijack red-team campaigns, issue commands to beacons, and access exfiltrated data.
**If you run the LazyOwn RedTeam/APT framework, update it to version 0.2.154 or later ASAP. Older versions ship with default usernames and passwords that let anyone take over your C2 dashboard. If you can't update yet, change the `c2_user` and `c2_pass` values in your `payload.json` to unique strong passwords and put the dashboard behind a firewall so only trusted networks can reach it.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/lazyown-redteam-framework-patches-critical-default-credential-vulnerability-k-h-i-x-v/gD2P6Ple2L
๐ CVE-2026-47665 - High (8.7)
Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerH...
๐ https://www.thehackerwire.com/vulnerability/CVE-2026-47665/
#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
##