🔴 CVE-2026-93958 - Critical (9.1)

A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93958/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-93958 - Critical (9.1)

A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93958/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-94084 - Critical (9.4)

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL use-after-free (CVE-2026-94084) in Suricata <8.0.7 🛡️. Exploitable via HTTP/2 rules with http.response_header. Risk: code execution, memory corruption. Patch by upgrading to 8.0.7+. https://radar.offseq.com/threat/cve-2026-94084-cwe-416-use-after-free-in-oisf-suricata-f54e858a25f14d6f #OffSeq #Suricata #Vuln #Infosec

🔴 CVE-2026-94084 - Critical (9.4)

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL use-after-free (CVE-2026-94084) in Suricata <8.0.7 🛡️. Exploitable via HTTP/2 rules with http.response_header. Risk: code execution, memory corruption. Patch by upgrading to 8.0.7+. https://radar.offseq.com/threat/cve-2026-94084-cwe-416-use-after-free-in-oisf-suricata-f54e858a25f14d6f #OffSeq #Suricata #Vuln #Infosec

Suricata 8.0.0 – 8.0.6 affected by CRITICAL CVE-2026-94083: Type confusion in DoH2 (CWE-843) can trigger DoS via invalid free. Patch to 8.0.7+. No known exploits yet. https://radar.offseq.com/threat/cve-2026-94083-cwe-843-access-of-resource-using-incompatible-type-type-confusion-in-oisf-suricata-a9f0752b258da862 #OffSeq #Suricata #Vuln #BlueTeam

🔴 CVE-2026-94083 - Critical (9.4)

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94083/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Suricata 8.0.0 – 8.0.6 affected by CRITICAL CVE-2026-94083: Type confusion in DoH2 (CWE-843) can trigger DoS via invalid free. Patch to 8.0.7+. No known exploits yet. https://radar.offseq.com/threat/cve-2026-94083-cwe-843-access-of-resource-using-incompatible-type-type-confusion-in-oisf-suricata-a9f0752b258da862 #OffSeq #Suricata #Vuln #BlueTeam

🔴 CVE-2026-94083 - Critical (9.4)

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94083/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93993 - High (8.8)

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93993/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93993 - High (8.8)

Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before trust validation. Attackers can supply a repository with a crafted post-checkout hook that executes arbitrary...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93993/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93992 - High (8.1)

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory tra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93992/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93992 - High (8.1)

Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files outside the extraction directory. Attackers can craft malicious archives with entries containing directory tra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93992/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93990 - High (7.5)

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93990/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93990 - High (7.5)

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93990/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94056 - High (7.5)

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94056 - High (7.5)

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93991 - High (7.7)

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93991/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93991 - High (7.7)

Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93991/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86814 - High (8.1)

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, includin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86814/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

UsersWP <1.5.10 is affected by CRITICAL privilege management flaw (CVE-2026-86814). Attackers can hijack any account — including admins — by abusing social login email validation. Update to 1.5.10+ ASAP. https://radar.offseq.com/threat/cve-2026-86814-cwe-269-improper-privilege-management-in-userswp-e3906890fe20564a #OffSeq #WordPress #CVE202686814 #infosec

🟠 CVE-2026-86814 - High (8.1)

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, includin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86814/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

UsersWP <1.5.10 is affected by CRITICAL privilege management flaw (CVE-2026-86814). Attackers can hijack any account — including admins — by abusing social login email validation. Update to 1.5.10+ ASAP. https://radar.offseq.com/threat/cve-2026-86814-cwe-269-improper-privilege-management-in-userswp-e3906890fe20564a #OffSeq #WordPress #CVE202686814 #infosec

🟠 CVE-2026-88926 - High (8.6)

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88926/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88926 - High (8.6)

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88926/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85680 - High (8.8)

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unaut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85680 - High (8.8)

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unaut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Ultra Addons for Contact Form 7 (<3.5.51) is vulnerable (CVE-2026-84750, CRITICAL). Unrestricted file upload enables unauthenticated RCE on Debian/Ubuntu Apache (.phar) or stored XSS. Upgrade to 3.5.51+ ASAP. https://radar.offseq.com/threat/cve-2026-84750-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-ultra-addons-for-contact-cea8950917a550ac #OffSeq #WordPress #Infosec #RCE

Ultra Addons for Contact Form 7 (<3.5.51) is vulnerable (CVE-2026-84750, CRITICAL). Unrestricted file upload enables unauthenticated RCE on Debian/Ubuntu Apache (.phar) or stored XSS. Upgrade to 3.5.51+ ASAP. https://radar.offseq.com/threat/cve-2026-84750-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-ultra-addons-for-contact-cea8950917a550ac #OffSeq #WordPress #Infosec #RCE

🔴 CVE-2026-86591 - Critical (9.8)

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86591/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-86591 | CRITICAL | Botiga Pro <1.6.5 allows unauthenticated attackers to modify WP options, inject persistent XSS, and trash posts due to missing REST API authorization. Immediate upgrade to 1.6.5+ is essential. https://radar.offseq.com/threat/cve-2026-86591-cwe-862-missing-authorization-in-botiga-pro-dcf5d6244d090e38 #OffSeq #WordPress #CVE202686591

🔴 CVE-2026-86591 - Critical (9.8)

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86591/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-86591 | CRITICAL | Botiga Pro <1.6.5 allows unauthenticated attackers to modify WP options, inject persistent XSS, and trash posts due to missing REST API authorization. Immediate upgrade to 1.6.5+ is essential. https://radar.offseq.com/threat/cve-2026-86591-cwe-862-missing-authorization-in-botiga-pro-dcf5d6244d090e38 #OffSeq #WordPress #CVE202686591

🟠 CVE-2026-93761 - High (7.5)

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93761/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93761 - High (7.5)

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93761/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84398 - High (7.5)

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84398 - High (7.5)

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network access to the affected device could access privileged management functions and obtain device, user, media-pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84083 - High (7.8)

IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmap_wrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84083/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84083 - High (7.8)

IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmap_wrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84083/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/3]

High‑impact security incidents ( CVSS ≥ 7 ) reported between 2026‑09‑18 and today

CVE‑2026‑84241
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker can bypass security restrictions because the product performs improper authorization checks.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84241/

CVE‑2026‑84078
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• Missing authentication in the LoadBalanc… component allows unauthenticated remote code execution.
• https://stemshop.top/cve/CVE-2026-84078

CVE‑2026‑84075
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• The ChangeTrackerServlet lacks authentication, enabling a remote attacker to bypass all security controls.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84075/

CVE‑2026‑84070
• 8.9 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code via improper input neutralisation during page generation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84070/

CVE‑2026‑84031
• 9.0 (Critical)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code because of improper input sanitisation in web pages.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84031/

CVE‑2026‑84089
• 7.8 (High)
• IBM Guardium Data Protection 12.2
• Local attacker can obtain elevated privileges due to flawed privilege‑management logic.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84089/

CVE‑2026‑84081
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker bypasses security restrictions because of improper certificate validation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84081/

CVE‑2026‑84239
• 7.6 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can harvest sensitive data; the flaw stems from improper neutralisation of special SQL elements.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84239/

CVE‑2026‑82967
• 9.8 (Critical)
• IBM Guardium Data Protection 12.2
• Authentication bypass permits unauthenticated remote attackers to gain full access.
• https://www.thehackerwire.com/vulnerability/CVE-2026-82967/

#infosecnews

🟠 CVE-2026-84081 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84081/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84081 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper certificate validation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84081/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/3]

High‑impact security incidents ( CVSS ≥ 7 ) reported between 2026‑09‑18 and today

CVE‑2026‑84241
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker can bypass security restrictions because the product performs improper authorization checks.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84241/

CVE‑2026‑84078
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• Missing authentication in the LoadBalanc… component allows unauthenticated remote code execution.
• https://stemshop.top/cve/CVE-2026-84078

CVE‑2026‑84075
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• The ChangeTrackerServlet lacks authentication, enabling a remote attacker to bypass all security controls.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84075/

CVE‑2026‑84070
• 8.9 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code via improper input neutralisation during page generation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84070/

CVE‑2026‑84031
• 9.0 (Critical)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code because of improper input sanitisation in web pages.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84031/

CVE‑2026‑84089
• 7.8 (High)
• IBM Guardium Data Protection 12.2
• Local attacker can obtain elevated privileges due to flawed privilege‑management logic.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84089/

CVE‑2026‑84081
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker bypasses security restrictions because of improper certificate validation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84081/

CVE‑2026‑84239
• 7.6 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can harvest sensitive data; the flaw stems from improper neutralisation of special SQL elements.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84239/

CVE‑2026‑82967
• 9.8 (Critical)
• IBM Guardium Data Protection 12.2
• Authentication bypass permits unauthenticated remote attackers to gain full access.
• https://www.thehackerwire.com/vulnerability/CVE-2026-82967/

#infosecnews

🔴 CVE-2026-84078 - Critical (9.9)

IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vulnerability in the LoadBalancerServlet. An unauthenticated user can access privileged load-balancer operations, potentially resulting in unauthorized actions and impact ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84078/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84078 - Critical (9.9)

IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vulnerability in the LoadBalancerServlet. An unauthenticated user can access privileged load-balancer operations, potentially resulting in unauthorized actions and impact ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84078/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84076 - High (7.6)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84076/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84076 - High (7.6)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84076/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/3]

High‑impact security incidents ( CVSS ≥ 7 ) reported between 2026‑09‑18 and today

CVE‑2026‑84241
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker can bypass security restrictions because the product performs improper authorization checks.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84241/

CVE‑2026‑84078
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• Missing authentication in the LoadBalanc… component allows unauthenticated remote code execution.
• https://stemshop.top/cve/CVE-2026-84078

CVE‑2026‑84075
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• The ChangeTrackerServlet lacks authentication, enabling a remote attacker to bypass all security controls.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84075/

CVE‑2026‑84070
• 8.9 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code via improper input neutralisation during page generation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84070/

CVE‑2026‑84031
• 9.0 (Critical)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code because of improper input sanitisation in web pages.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84031/

CVE‑2026‑84089
• 7.8 (High)
• IBM Guardium Data Protection 12.2
• Local attacker can obtain elevated privileges due to flawed privilege‑management logic.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84089/

CVE‑2026‑84081
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker bypasses security restrictions because of improper certificate validation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84081/

CVE‑2026‑84239
• 7.6 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can harvest sensitive data; the flaw stems from improper neutralisation of special SQL elements.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84239/

CVE‑2026‑82967
• 9.8 (Critical)
• IBM Guardium Data Protection 12.2
• Authentication bypass permits unauthenticated remote attackers to gain full access.
• https://www.thehackerwire.com/vulnerability/CVE-2026-82967/

#infosecnews

🔴 CVE-2026-84075 - Critical (9.9)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to missing authentication for the ChangeTrackerServlet.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84075/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84075 - Critical (9.9)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to missing authentication for the ChangeTrackerServlet.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84075/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/3]

High‑impact security incidents ( CVSS ≥ 7 ) reported between 2026‑09‑18 and today

CVE‑2026‑84241
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker can bypass security restrictions because the product performs improper authorization checks.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84241/

CVE‑2026‑84078
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• Missing authentication in the LoadBalanc… component allows unauthenticated remote code execution.
• https://stemshop.top/cve/CVE-2026-84078

CVE‑2026‑84075
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• The ChangeTrackerServlet lacks authentication, enabling a remote attacker to bypass all security controls.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84075/

CVE‑2026‑84070
• 8.9 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code via improper input neutralisation during page generation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84070/

CVE‑2026‑84031
• 9.0 (Critical)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code because of improper input sanitisation in web pages.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84031/

CVE‑2026‑84089
• 7.8 (High)
• IBM Guardium Data Protection 12.2
• Local attacker can obtain elevated privileges due to flawed privilege‑management logic.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84089/

CVE‑2026‑84081
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker bypasses security restrictions because of improper certificate validation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84081/

CVE‑2026‑84239
• 7.6 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can harvest sensitive data; the flaw stems from improper neutralisation of special SQL elements.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84239/

CVE‑2026‑82967
• 9.8 (Critical)
• IBM Guardium Data Protection 12.2
• Authentication bypass permits unauthenticated remote attackers to gain full access.
• https://www.thehackerwire.com/vulnerability/CVE-2026-82967/

#infosecnews

🟠 CVE-2026-84070 - High (8.9)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84070/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84070 - High (8.9)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84070/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/3]

High‑impact security incidents ( CVSS ≥ 7 ) reported between 2026‑09‑18 and today

CVE‑2026‑84241
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker can bypass security restrictions because the product performs improper authorization checks.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84241/

CVE‑2026‑84078
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• Missing authentication in the LoadBalanc… component allows unauthenticated remote code execution.
• https://stemshop.top/cve/CVE-2026-84078

CVE‑2026‑84075
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• The ChangeTrackerServlet lacks authentication, enabling a remote attacker to bypass all security controls.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84075/

CVE‑2026‑84070
• 8.9 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code via improper input neutralisation during page generation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84070/

CVE‑2026‑84031
• 9.0 (Critical)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code because of improper input sanitisation in web pages.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84031/

CVE‑2026‑84089
• 7.8 (High)
• IBM Guardium Data Protection 12.2
• Local attacker can obtain elevated privileges due to flawed privilege‑management logic.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84089/

CVE‑2026‑84081
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker bypasses security restrictions because of improper certificate validation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84081/

CVE‑2026‑84239
• 7.6 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can harvest sensitive data; the flaw stems from improper neutralisation of special SQL elements.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84239/

CVE‑2026‑82967
• 9.8 (Critical)
• IBM Guardium Data Protection 12.2
• Authentication bypass permits unauthenticated remote attackers to gain full access.
• https://www.thehackerwire.com/vulnerability/CVE-2026-82967/

#infosecnews

🔴 CVE-2026-82967 - Critical (9.8)

IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82967/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82967 - Critical (9.8)

IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that allows an unauthenticated remote attacker to bypass IP-based access controls and access the Guardium management interface.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82967/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-80441 - Critical (9.8)

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80441/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-80441 - Critical (9.8)

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80441/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-92807 - High (8.8)

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the `pdf_created_callback` shortcode attribute. The `eval_shortcode()` function copies any non-`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-92807: HIGH severity (CVSS 8.8) code injection in pdfcrowd Save as PDF Plugin for WordPress (<=4.6.1). Contributor+ users can run arbitrary PHP — risking API credential leaks & server compromise. Restrict access, monitor for patch. https://radar.offseq.com/threat/cve-2026-92807-cwe-94-improper-control-of-generation-of-code-code-injection-in-pdfcrowd-save-as-pdf-bd60570e4aef57a5 #OffSeq #WordPress #Infosec

🟠 CVE-2026-92807 - High (8.8)

The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the `pdf_created_callback` shortcode attribute. The `eval_shortcode()` function copies any non-`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-92807: HIGH severity (CVSS 8.8) code injection in pdfcrowd Save as PDF Plugin for WordPress (<=4.6.1). Contributor+ users can run arbitrary PHP — risking API credential leaks & server compromise. Restrict access, monitor for patch. https://radar.offseq.com/threat/cve-2026-92807-cwe-94-improper-control-of-generation-of-code-code-injection-in-pdfcrowd-save-as-pdf-bd60570e4aef57a5 #OffSeq #WordPress #Infosec

🟠 CVE-2026-92404 - High (7.5)

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, fr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-92404 - High (7.5)

The MgoSync WordPress plugin before 2.1.7 does not have authorization controls on one of its REST API endpoints, allowing unauthenticated users to retrieve the stored WooCommerce API credentials, including a read/write consumer key and secret, fr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89274 - Critical (9.1)

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because `WPRM_Metadata::sanitize_metadata()` recursively calls `do_shortcode()` on every...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

WP Recipe Maker <=10.8.1 hit by CVE-2026-89274: CRITICAL code injection via unsanitized shortcodes in comment ratings. Unauthenticated attackers can trigger arbitrary shortcode execution on recipe pages. Upgrade ASAP. https://radar.offseq.com/threat/cve-2026-89274-cwe-94-improper-control-of-generation-of-code-code-injection-in-brechtvds-wp-recipe-77a2426acb987f3a #OffSeq #WordPress #CVE202689274 #Infosec

🔴 CVE-2026-89274 - Critical (9.1)

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because `WPRM_Metadata::sanitize_metadata()` recursively calls `do_shortcode()` on every...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

WP Recipe Maker <=10.8.1 hit by CVE-2026-89274: CRITICAL code injection via unsanitized shortcodes in comment ratings. Unauthenticated attackers can trigger arbitrary shortcode execution on recipe pages. Upgrade ASAP. https://radar.offseq.com/threat/cve-2026-89274-cwe-94-improper-control-of-generation-of-code-code-injection-in-brechtvds-wp-recipe-77a2426acb987f3a #OffSeq #WordPress #CVE202689274 #Infosec

🟠 CVE-2026-88824 - High (8.8)

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88824/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88824 - High (8.8)

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88824/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85658 - High (8.1)

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is du...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85658/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85658 - High (8.1)

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.17.2 This is du...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85658/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85574 - High (8)

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85574/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85574 - High (8)

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85574/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/3]

High‑impact security incidents ( CVSS ≥ 7 ) reported between 2026‑09‑18 and today

CVE‑2026‑84241
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker can bypass security restrictions because the product performs improper authorization checks.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84241/

CVE‑2026‑84078
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• Missing authentication in the LoadBalanc… component allows unauthenticated remote code execution.
• https://stemshop.top/cve/CVE-2026-84078

CVE‑2026‑84075
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• The ChangeTrackerServlet lacks authentication, enabling a remote attacker to bypass all security controls.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84075/

CVE‑2026‑84070
• 8.9 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code via improper input neutralisation during page generation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84070/

CVE‑2026‑84031
• 9.0 (Critical)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code because of improper input sanitisation in web pages.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84031/

CVE‑2026‑84089
• 7.8 (High)
• IBM Guardium Data Protection 12.2
• Local attacker can obtain elevated privileges due to flawed privilege‑management logic.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84089/

CVE‑2026‑84081
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker bypasses security restrictions because of improper certificate validation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84081/

CVE‑2026‑84239
• 7.6 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can harvest sensitive data; the flaw stems from improper neutralisation of special SQL elements.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84239/

CVE‑2026‑82967
• 9.8 (Critical)
• IBM Guardium Data Protection 12.2
• Authentication bypass permits unauthenticated remote attackers to gain full access.
• https://www.thehackerwire.com/vulnerability/CVE-2026-82967/

#infosecnews

🟠 CVE-2026-84241 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84241/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84241 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84241/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/3]

High‑impact security incidents ( CVSS ≥ 7 ) reported between 2026‑09‑18 and today

CVE‑2026‑84241
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker can bypass security restrictions because the product performs improper authorization checks.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84241/

CVE‑2026‑84078
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• Missing authentication in the LoadBalanc… component allows unauthenticated remote code execution.
• https://stemshop.top/cve/CVE-2026-84078

CVE‑2026‑84075
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• The ChangeTrackerServlet lacks authentication, enabling a remote attacker to bypass all security controls.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84075/

CVE‑2026‑84070
• 8.9 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code via improper input neutralisation during page generation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84070/

CVE‑2026‑84031
• 9.0 (Critical)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code because of improper input sanitisation in web pages.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84031/

CVE‑2026‑84089
• 7.8 (High)
• IBM Guardium Data Protection 12.2
• Local attacker can obtain elevated privileges due to flawed privilege‑management logic.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84089/

CVE‑2026‑84081
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker bypasses security restrictions because of improper certificate validation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84081/

CVE‑2026‑84239
• 7.6 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can harvest sensitive data; the flaw stems from improper neutralisation of special SQL elements.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84239/

CVE‑2026‑82967
• 9.8 (Critical)
• IBM Guardium Data Protection 12.2
• Authentication bypass permits unauthenticated remote attackers to gain full access.
• https://www.thehackerwire.com/vulnerability/CVE-2026-82967/

#infosecnews

🟠 CVE-2026-84239 - High (7.6)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84239/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84239 - High (7.6)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84239/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84105 - High (7.7)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84105 - High (7.7)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/3]

High‑impact security incidents ( CVSS ≥ 7 ) reported between 2026‑09‑18 and today

CVE‑2026‑84241
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker can bypass security restrictions because the product performs improper authorization checks.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84241/

CVE‑2026‑84078
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• Missing authentication in the LoadBalanc… component allows unauthenticated remote code execution.
• https://stemshop.top/cve/CVE-2026-84078

CVE‑2026‑84075
• 9.9 (Critical)
• IBM Guardium Data Protection 12.2
• The ChangeTrackerServlet lacks authentication, enabling a remote attacker to bypass all security controls.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84075/

CVE‑2026‑84070
• 8.9 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code via improper input neutralisation during page generation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84070/

CVE‑2026‑84031
• 9.0 (Critical)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can execute arbitrary code because of improper input sanitisation in web pages.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84031/

CVE‑2026‑84089
• 7.8 (High)
• IBM Guardium Data Protection 12.2
• Local attacker can obtain elevated privileges due to flawed privilege‑management logic.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84089/

CVE‑2026‑84081
• 8.1 (High)
• IBM Guardium Data Protection 12.2
• Remote attacker bypasses security restrictions because of improper certificate validation.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84081/

CVE‑2026‑84239
• 7.6 (High)
• IBM Guardium Data Protection 12.2
• Authenticated remote attacker can harvest sensitive data; the flaw stems from improper neutralisation of special SQL elements.
• https://www.thehackerwire.com/vulnerability/CVE-2026-84239/

CVE‑2026‑82967
• 9.8 (Critical)
• IBM Guardium Data Protection 12.2
• Authentication bypass permits unauthenticated remote attackers to gain full access.
• https://www.thehackerwire.com/vulnerability/CVE-2026-82967/

#infosecnews

🟠 CVE-2026-84089 - High (7.8)

IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84089/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84089 - High (7.8)

IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84089/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84085 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84085/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84085 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84085/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-93985 - Critical (9.9)

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93985/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-93985 (CVSS 9.4) in Openpanel-dev openpanel v0: Critical code injection via JS webhook template validator. Attackers with project write access can run arbitrary code in the worker process. Limit permissions & monitor. https://radar.offseq.com/threat/cve-2026-93985-improper-control-of-generation-of-code-code-injection-in-openpanel-dev-openpanel-f8ef9daa74899f8b #OffSeq #Vuln #AppSec

🔴 CVE-2026-93985 - Critical (9.9)

OpenPanel js-runtime through commit bad75bdd contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93985/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-93985 (CVSS 9.4) in Openpanel-dev openpanel v0: Critical code injection via JS webhook template validator. Attackers with project write access can run arbitrary code in the worker process. Limit permissions & monitor. https://radar.offseq.com/threat/cve-2026-93985-improper-control-of-generation-of-code-code-injection-in-openpanel-dev-openpanel-f8ef9daa74899f8b #OffSeq #Vuln #AppSec

🔴 CVE-2026-93742 - Critical (9.9)

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93742/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-93742 - Unpatched Command Injection in Totolink A3002MU routers enables remote RCE. Public exploit released. CVSS 9.9. Isolate devices now. #CVE #Totolink #infosec

https://www.valtersit.com/cve/CVE-2026-93742/

Totolink A3002MU routers suffer a CRITICAL (CVSS 9.4) command injection vuln (CVE-2026-93742) in formWsc (/boafrm/formWsc). Public exploit available — remote compromise risk. Restrict access, monitor devices, patch ASAP. https://radar.offseq.com/threat/cve-2026-93742-command-injection-in-totolink-a3002mu-0eaffbb279ea62b7 #OffSeq #CVE #IoTSecurity

🔴 CVE-2026-93742 - Critical (9.9)

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93742/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Totolink A3002MU routers suffer a CRITICAL (CVSS 9.4) command injection vuln (CVE-2026-93742) in formWsc (/boafrm/formWsc). Public exploit available — remote compromise risk. Restrict access, monitor devices, patch ASAP. https://radar.offseq.com/threat/cve-2026-93742-command-injection-in-totolink-a3002mu-0eaffbb279ea62b7 #OffSeq #CVE #IoTSecurity

🟠 CVE-2026-4327 - High (8.8)

The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4327/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4327 - High (8.8)

The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4327/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1255 - High (7.5)

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1255/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1255 - High (7.5)

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1255/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-93741: Totolink A3002MU (Hh-B20211125.1046) hit by CRITICAL buffer overflow in formWlWds (CVSS 10). Exploit is public; remote code exec risk. Isolate affected routers or block attacks at the network. https://radar.offseq.com/threat/cve-2026-93741-buffer-overflow-in-totolink-a3002mu-bc2e06f7d2d53482 #OffSeq #CVE202693741 #IoT #Exploit

CVE-2026-93741 - Critical CVSS 10 Buffer Overflow in Totolink A3002MU routers. Public exploit available for remote attacks. Isolate affected devices now. #CVE #Totolink #infosec

https://www.valtersit.com/cve/CVE-2026-93741/

🔴 CVE-2026-93741 - Critical (10)

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possib...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93741/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-93741: Totolink A3002MU (Hh-B20211125.1046) hit by CRITICAL buffer overflow in formWlWds (CVSS 10). Exploit is public; remote code exec risk. Isolate affected routers or block attacks at the network. https://radar.offseq.com/threat/cve-2026-93741-buffer-overflow-in-totolink-a3002mu-bc2e06f7d2d53482 #OffSeq #CVE202693741 #IoT #Exploit

🔴 CVE-2026-93741 - Critical (10)

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possib...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93741/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Google patched critical Google Chrome vulnerabilities. Update now to address multiple Google Chrome vulnerabilities like CVE-2026-93374 and stay secure.

#GoogleChrome #ChromeSecurity #CVE202693374 #BrowserSecurity #InfoSec

https://securityonline.info/google-chrome-vulnerabilities-fixed/?utm_source=mastodon&utm_medium=jetpack_social

New.

CISA Adds Two Known Exploited Vulnerabilities to Catalog.

CVE-2025-39964 Linux Kernel Race Condition Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-39964

CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-53266 #CISA #Linux #infosec #vulnerability

🚨 [CISA-2026:0918] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0918)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-39964 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-39964)
- Name: Linux Kernel Race Condition Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Linux
- Product: Kernel
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce; https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9; https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8; https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84; https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d; https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042; https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-39964

⚠️ CVE-2026-53266 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-53266)
- Name: Linux Kernel Out-of-Bounds Write Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Linux
- Product: Kernel
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87; https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b; https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0; https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b; https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093; https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d; https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5; https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-53266

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260918 #cisa20260918 #cve_2025_39964 #cve_2026_53266 #cve202539964 #cve202653266

New.

CISA Adds Two Known Exploited Vulnerabilities to Catalog.

CVE-2025-39964 Linux Kernel Race Condition Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-39964

CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-53266 #CISA #Linux #infosec #vulnerability

🚨 [CISA-2026:0918] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0918)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-39964 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-39964)
- Name: Linux Kernel Race Condition Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Linux
- Product: Kernel
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce; https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9; https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8; https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84; https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d; https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042; https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-39964

⚠️ CVE-2026-53266 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-53266)
- Name: Linux Kernel Out-of-Bounds Write Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Linux
- Product: Kernel
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87; https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b; https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0; https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b; https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093; https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d; https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5; https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-53266

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260918 #cisa20260918 #cve_2025_39964 #cve_2026_53266 #cve202539964 #cve202653266

🔵 THREAT INTELLIGENCE

CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

Vulnerability | CRITICAL
CVEs: CVE-2025-39682

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known...

Full analysis:
https://www.yazoul.net/news/article/cisa-flags-three-linux-kernel-vulnerabilities-exploited-in-the-wild

by Yazoul AI

#ThreatIntel #SecurityNews #CyberNews

CVE ID: CVE-2025-39682
Vendor: Linux
Product: Kernel
Date Added: 2026-09-18
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-39682

CVE ID: CVE-2025-39682
Vendor: Linux
Product: Kernel
Date Added: 2026-09-18
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-39682

🔴 CVE-2026-92229 - Critical (9.1)

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92229/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-92229: CRITICAL code injection in wpmudev Forminator Forms plugin (≤1.57.2). Unauthenticated attackers can execute arbitrary shortcodes, risking full WordPress site compromise. Restrict or disable plugin now. https://radar.offseq.com/threat/cve-2026-92229-cwe-94-improper-control-of-generation-of-code-code-injection-in-wpmudev-forminator-8ac627c2b84841fc #OffSeq #WordPress #CVE202692229

🔴 CVE-2026-92229 - Critical (9.1)

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92229/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-92229: CRITICAL code injection in wpmudev Forminator Forms plugin (≤1.57.2). Unauthenticated attackers can execute arbitrary shortcodes, risking full WordPress site compromise. Restrict or disable plugin now. https://radar.offseq.com/threat/cve-2026-92229-cwe-94-improper-control-of-generation-of-code-code-injection-in-wpmudev-forminator-8ac627c2b84841fc #OffSeq #WordPress #CVE202692229

🟠 CVE-2026-87909 - High (7.5)

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87909/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-87909 - High (7.5)

The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87909/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84434 - Critical (9.8)

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84434/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84434 - Critical (9.8)

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84434/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-93739 - Critical (9.9)

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed fro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93739/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-93739 - Critical (9.9)

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed fro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93739/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93923 - High (8.8)

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style va...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93923/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93923 - High (8.8)

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style va...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93923/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93922 - High (8.8)

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaSc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93922 - High (8.8)

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaSc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-93740 - Critical (10)

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93740/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-93740 - Critical (10)

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93740/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-75885: CRITICAL SSRF & DoS in Red Hat OpenShift Container Platform 4. Unauthenticated access to /api/devfile/ endpoints can expose internal services & cause resource exhaustion. No fix yet — restrict access & monitor advisories. https://radar.offseq.com/threat/cve-2026-75885-server-side-request-forgery-ssrf-in-red-hat-red-hat-openshift-container-platform-4-7be62bac64620783 #OffSeq #OpenShift #SSRF

🔴 CVE-2026-75885 - Critical (9.3)

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75885/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-75885: CRITICAL SSRF & DoS in Red Hat OpenShift Container Platform 4. Unauthenticated access to /api/devfile/ endpoints can expose internal services & cause resource exhaustion. No fix yet — restrict access & monitor advisories. https://radar.offseq.com/threat/cve-2026-75885-server-side-request-forgery-ssrf-in-red-hat-red-hat-openshift-container-platform-4-7be62bac64620783 #OffSeq #OpenShift #SSRF

🔴 CVE-2026-75885 - Critical (9.3)

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75885/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88097 - High (8.1)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88097/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88097 - High (8.1)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88097/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93031 - High (8.8)

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93031/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93031 - High (8.8)

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93031/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84077 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84077/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84077 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery vulnerability.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84077/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84082 - Critical (9.8)

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84082/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84082 - Critical (9.8)

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84082/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84074 - High (8.9)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84074/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84074 - High (8.9)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84074/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84064 - Critical (9.9)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84064/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84064 - Critical (9.9)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84064/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84108 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84108/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84108 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84108/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82887 - High (8.8)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82887/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82887 - High (8.8)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82887/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82896 - High (7.6)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82896/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82896 - High (7.6)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82896/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84073 - Critical (9.1)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84073/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84073 - Critical (9.1)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84073/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84034 - High (8.8)

IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardware_assess/obstore binaries. A low-privileged authenticated user can recover hardcoded product master secrets, potentially resulting in unauthoriz...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84034/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84034 - High (8.8)

IBM Guardium Data Protection 12.2 is vulnerable to a hardcoded credentials vulnerability in the hardware_assess/obstore binaries. A low-privileged authenticated user can recover hardcoded product master secrets, potentially resulting in unauthoriz...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84034/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82885 - High (8.8)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82885/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82885 - High (8.8)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82885/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82832 - Critical (9.6)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82832 - Critical (9.6)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82893 - High (7.8)

IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82893/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82893 - High (7.8)

IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated privileges due to improper privilege management.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82893/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82340 - Critical (9.8)

IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener. A network attacker able to reach TCP port 16017 may submit cr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82340/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82340 - Critical (9.8)

IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure deserialization and attacker-controlled reflective method dispatch in the Change Audit System (CAS) listener. A network attacker able to reach TCP port 16017 may submit cr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82340/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81933 - High (8.8)

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, potentially resulting in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81933/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81933 - High (8.8)

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, potentially resulting in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81933/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82892 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82892/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82892 - High (8.1)

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82892/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93868 - High (8.1)

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93868/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93868 - High (8.1)

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93868/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-93738 - Critical (9.9)

A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93738/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-93738 - Critical (9.9)

A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93738/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93572 - High (7.5)

## Summary

`RedisArrayAggregator` recently added `maxElements` and `maxNestedArrayDepth` limits to fix public Redis resource-exhaustion advisories. The limits are independent, but the allocator remains eager: every positive nested RESP array he...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93572/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93572 - High (7.5)

## Summary

`RedisArrayAggregator` recently added `maxElements` and `maxNestedArrayDepth` limits to fix public Redis resource-exhaustion advisories. The limits are independent, but the allocator remains eager: every positive nested RESP array he...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93572/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84106 - High (8.9)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84106 - High (8.9)

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack