Critical Vulnerabilities Discovered in InSAT MasterSCADA BUK-TS

InSAT MasterSCADA BUK-TS is affected by two critical vulnerabilities, CVE-2026-21410 and CVE-2026-22553, which allow unauthenticated remote code execution via SQL and OS command injection.

**Since the vendor has not released a patch, you must assume these systems will be attacked if they are reachable online. Make sure your MasterSCADA BUK-TS is isolated from the internet and accessible only from trusted networks. Then reach out to the vendor for patches. If they don't respond, start planning a replacement.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-vulnerabilities-discovered-in-insat-masterscada-buk-ts-d-8-6-3-o/gD2P6Ple2L

🚨 CRITICAL SQL Injection (CVE-2026-21410) affects all InSAT MasterSCADA BUK-TS versions. Unauthenticated RCE possible — industrial ops at risk. Restrict access & monitor until patched. Details: https://radar.offseq.com/threat/cve-2026-21410-cwe-89-in-insat-masterscada-buk-ts-10cd43d6 #OffSeq #ICS #SCADA #Vulnerability

🔴 CVE-2026-21410 - Critical (9.8)

InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21410/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3105 - High (7.6)

SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-24663 (CRITICAL, CVSS 9.0): Copeland XWEB 300D PRO (≤1.12.1) has an unauthenticated command injection flaw. RCE possible over network, no exploit public yet. Segment networks & restrict access! https://radar.offseq.com/threat/cve-2026-24663-cwe-78-in-copeland-copeland-xweb-30-1c773deb #OffSeq #ICS #OTSecurity #Vuln

🚨 CVE-2026-24663 (CRITICAL, CVSS 9.0): Copeland XWEB 300D PRO (≤1.12.1) has an unauthenticated command injection flaw. RCE possible over network, no exploit public yet. Segment networks & restrict access! https://radar.offseq.com/threat/cve-2026-24663-cwe-78-in-copeland-copeland-xweb-30-1c773deb #OffSeq #ICS #OTSecurity #Vuln

🚨 CVE-2026-21718: CRITICAL auth bypass in Copeland XWEB 300D PRO (≤1.12.1). Remote code exec possible — no user interaction. No patch yet. Segment & monitor ICS networks! https://radar.offseq.com/threat/cve-2026-21718-cwe-327-in-copeland-copeland-xweb-3-124474ba #OffSeq #ICS #Vulnerability #Cybersecurity

🚨 CVE-2026-21718: CRITICAL auth bypass in Copeland XWEB 300D PRO (≤1.12.1). Remote code exec possible — no user interaction. No patch yet. Segment & monitor ICS networks! https://radar.offseq.com/threat/cve-2026-21718-cwe-327-in-copeland-copeland-xweb-3-124474ba #OffSeq #ICS #Vulnerability #Cybersecurity

🚨 CRITICAL: CVE-2026-24731 in EV2GO ev2go.io — all versions. WebSocket endpoints have no auth, letting attackers impersonate stations, escalate privileges, and manipulate backend data. Monitor OCPP traffic now. https://radar.offseq.com/threat/cve-2026-24731-cwe-306-in-ev2go-ev2goio-e42cb5b8 #OffSeq #CVE202624731 #infosec #EVsecurity

🚨 CRITICAL: CVE-2026-24731 in EV2GO ev2go.io — all versions. WebSocket endpoints have no auth, letting attackers impersonate stations, escalate privileges, and manipulate backend data. Monitor OCPP traffic now. https://radar.offseq.com/threat/cve-2026-24731-cwe-306-in-ev2go-ev2goio-e42cb5b8 #OffSeq #CVE202624731 #infosec #EVsecurity

Multiple Vulnerabilities in CloudCharge EV Platform, Including One Critical

CloudCharge's EV charging platform contains four vulnerabilities, including a critical authentication bypass (CVE-2026-20781), that allow attackers to impersonate charging stations and hijack sessions.

**Treat your EV charging stations as high-risk entry points and disconnect them from the public internet immediately. Since the vendor hasn't provided a fix, your only real defense is to isolate these systems behind a VPN and very strict firewall rules**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/multiple-vulnerabilities-in-cloudcharge-ev-platform-including-one-critical-f-b-y-d-0/gD2P6Ple2L

Multiple Vulnerabilities in CloudCharge EV Platform, Including One Critical

CloudCharge's EV charging platform contains four vulnerabilities, including a critical authentication bypass (CVE-2026-20781), that allow attackers to impersonate charging stations and hijack sessions.

**Treat your EV charging stations as high-risk entry points and disconnect them from the public internet immediately. Since the vendor hasn't provided a fix, your only real defense is to isolate these systems behind a VPN and very strict firewall rules**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/multiple-vulnerabilities-in-cloudcharge-ev-platform-including-one-critical-f-b-y-d-0/gD2P6Ple2L

🟠 CVE-2026-27959 - High (7.5)

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27959/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2799 - Critical (9.8)

Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2799/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2799 - Critical (9.8)

Use-after-free in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2799/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ HIGH severity: CVE-2026-27449 impacts Umbraco Engage.Forms (<16.2.1, 17.0.0 – 17.1.0). Improper access control lets unauthenticated attackers extract sensitive analytics & customer data. Patch to 16.2.1/17.1.1 now! https://radar.offseq.com/threat/cve-2026-27449-cwe-284-improper-access-control-in--fadf6848 #OffSeq #Umbraco #Infosec

🛡️ HIGH severity: CVE-2026-27449 impacts Umbraco Engage.Forms (<16.2.1, 17.0.0 – 17.1.0). Improper access control lets unauthenticated attackers extract sensitive analytics & customer data. Patch to 16.2.1/17.1.1 now! https://radar.offseq.com/threat/cve-2026-27449-cwe-284-improper-access-control-in--fadf6848 #OffSeq #Umbraco #Infosec

🟠 CVE-2026-27903 - High (7.5)

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27903/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27903 - High (7.5)

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27903/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27904 - High (7.5)

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quant...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27904/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27904 - High (7.5)

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quant...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27904/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2803 - High (7.5)

Information disclosure, mitigation bypass in the Settings UI component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2803/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2803 - High (7.5)

Information disclosure, mitigation bypass in the Settings UI component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2803/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2800 - Critical (9.8)

Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2800/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2800 - Critical (9.8)

Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2800/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510) https://boschko.ca/unitree-go2-rce/

From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510) https://boschko.ca/unitree-go2-rce/

Two advisories from AMD, one new, one updated:

-  CVE-2025-0037: Versal Adaptive SoC –Overwriting Protected Memory Regions through PLM Firmware https://www.amd.com/en/resources/product-security/bulletin/amd-sb-8010.html

- CVE-2023-31364: Guest Initiated Machine Check Errors https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7059.html

Two new ones from NVIDIA:

- CVE-2025-33179, CVE-2025-33180, and CVE-2025-33181: NVIDIA Cumulus Linux and NVOS - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5722

- CVE-2026-24241: NVIDIA License System - February 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5789 #Nvidia #infosec #AMD #vulnerability #Linux

🟠 CVE-2026-27745 - High (8.8)

The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface workflow. The plugin incorporates untrusted request data into a hidden form field that i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27745/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27745 - High (8.8)

The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated remote code execution vulnerability in the translation interface workflow. The plugin incorporates untrusted request data into a hidden form field that i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27745/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27743 - Critical (9.8)

The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer action handlers. The handlers read the url parameter from a GET request and interpo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27743/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-27743: CRITICAL SQL injection in SPIP referer_spam <1.3.0 allows unauthenticated SQL execution via GET. No exploit seen yet — patch to 1.3.0+ ASAP! Monitor logs & restrict DB perms. https://radar.offseq.com/threat/cve-2026-27743-cwe-89-improper-neutralization-of-s-0723b396 #OffSeq #SQLInjection #SPIP #VulnAlert

🔴 CVE-2026-27744 - Critical (9.8)

The SPIP tickets plugin versions prior to 4.3.3 contain an unauthenticated remote code execution vulnerability in the forum preview handling for public ticket pages. The plugin appends untrusted request parameters into HTML that is later rendered...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510) https://boschko.ca/unitree-go2-rce/

From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510) https://boschko.ca/unitree-go2-rce/

🔴 CVE-2025-69985 - Critical (9.8)

FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate interna...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69985/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-69985 - Critical (9.8)

FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate interna...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69985/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 EUVD-2026-8877

📊 Score: 6.1/10 (CVSS v3.1)
📦 Product: Workstation, Workstation
🏢 Vendor: VMware
📅 Updated: 2026-02-26

📝 A malicious actor with authenticated user privileges on a Windows based Workstation host may be able to cause a null pointer dereference error. To Remediate CVE-2026-22722, apply the patches listed in the "Fixed version" column of the 'Response...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-8877

#cybersecurity #infosec #euvd #cve #vulnerability

🟠 CVE-2026-22719 - High (8.1)

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted prod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22719/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22719 - High (8.1)

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted prod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22719/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-26341 in Tattile Smart+, Vega & Basic (fw ≤1.181.5) — default creds allow admin access if device is reachable. Change passwords, restrict interface access ASAP. Details: https://radar.offseq.com/threat/cve-2026-26341-cwe-1392-use-of-default-credentials-b1797eea #OffSeq #IoTSecurity #DefaultCreds #Vuln

🟠 CVE-2026-3179 - High (8.1)

The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacker can craft filenames containing path traversal sequences, causing the client to write f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3179 - High (8.1)

The FTP Backup on the ADM does not properly sanitize filenames received from the FTP server when parsing directory listings. A malicious server or MITM attacker can craft filenames containing path traversal sequences, causing the client to write f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-3179 (CVSS 9.2): CRITICAL path traversal in ASUSTOR ADM (4.1.0 – 5.1.2.RE51). Unauthenticated attackers can overwrite arbitrary files via FTP Backup. Disable/limit FTP Backup & monitor for patches. https://radar.offseq.com/threat/cve-2026-3179-cwe-22-improper-limitation-of-a-path-180a5bd6 #OffSeq #Vuln #NAS #InfoSec

🔴 CVE-2026-2624 - Critical (9.8)

Missing Authentication for Critical Function vulnerability in ePati Cyber ​​Security Technologies Inc. Antikor Next Generation Firewall (NGFW) allows Authentication Bypass.This issue affects Antikor Next Generation Firewall (NGFW): from v.2.0....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24890 - High (8.1)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorization bypass vulnerability in the patient portal signature endpoint allows authenticated portal users to up...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24890/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco SDWAN Controller vulnerability in the wild and at the network edge. CVE-2026-20127 by UAT-8616. Heads up. https://blog.talosintelligence.com/uat-8616-sd-wan/ #threatintelligence #cybersecurity #cisco

Critical Cisco SD-WAN Vulnerability Exposes Networks to Remote Attacks + Video

The cybersecurity world is on high alert as a severe flaw in Cisco’s SD-WAN infrastructure has been actively exploited for years. Tracked as CVE-2026-20127 and carrying a maximum CVSS score of 10.0, this vulnerability allows remote attackers to bypass authentication and gain full administrative access to affected systems. Organizations relying on Cisco Catalyst SD-WAN Controllers and…

https://undercodenews.com/critical-cisco-sd-wan-vulnerability-exposes-networks-to-remote-attacks-video/

Five Eyes warning: Cisco SD-WAN actively exploited by UAT-8616.
• CVE-2026-20127
• CVE-2022-20775
• Root access & rogue control-plane peering
• Persistence in edge devices
Immediate patching & threat hunting required.

Full details:
https://www.technadu.com/cisco-sd-wan-is-actively-exploited-by-uat-8616-five-eyes-alliance-agencies-issue-warning/621036/

Are you checking for downgrade events?

#InfoSec #Cisco #SDWAN #CISA #ThreatIntel

📢 Exploitation active de CVE-2026-20127 dans Cisco Catalyst SD‑WAN par l’acteur UAT‑8616
📝 Contexte: Cisco Talos signale une exploitation active visant Cisco Catalyst SD‑WAN Controller (ex‑vSmart), détaillant la vulnéra...
📖 cyberveille : https://cyberveille.ch/posts/2026-02-26-exploitation-active-de-cve-2026-20127-dans-cisco-catalyst-sd-wan-par-lacteur-uat-8616/
🌐 source : https://blog.talosintelligence.com/uat-8616-sd-wan/
#CVE_2026_20127 #Cisco_Catalyst_SD_WAN #Cyberveille

Si vous administrez une infrastructure réseau utilisant Cisco Catalyst SD-WAN, une vulnérabilité critique actuellement exploitée sur Internet permet à un attaquant distant sans authentification d’obtenir un accès administrateur au système. Une exploitation réussie peut permettre de modifier la configuration réseau, d’espionner les communications ou de maintenir un accès discret à l’infrastructure.

Les investigations effectuées par Cisco Talos montrent que ces attaques sont menées par un acteur sophistiqué et que des compromissions ont été observées depuis au moins 2023, avec dans certains cas une élévation de privilèges jusqu’au contrôle complet du système après modification de la version logicielle.

Selon Cisco, un système SD-WAN peut être particulièrement exposé si :

• le contrôleur SD-WAN est accessible depuis Internet

• des ports sont ouverts vers l’extérieur

• l’accès n’est pas limité aux adresses IP autorisées

Les éléments suivants peuvent indiquer qu’un système SD-WAN a été compromis :

• une nouvelle connexion SD-WAN inconnue

• un accès administrateur inattendu

• des journaux système effacés ou incomplets

• des mises à jour ou rétrogradations non planifiées

Cisco recommande de vérifier certains journaux système pour détecter une compromission éventuelle.

Par exemple, dans le fichier /var/log/auth.log, une connexion SSH au compte vmanage-admin depuis une adresse IP inconnue peut être suspecte :

Accepted publickey for vmanage-admin from -adresse IP inconnue-

Dans ce cas, il faut vérifier que l’adresse IP correspond bien à un équipement SD-WAN autorisé (visible dans l’interface SD-WAN Manager → Devices → System IP).

PRODUITS CONCERNÉS

Cette vulnérabilité affecte :

• Cisco Catalyst SD-WAN Controller

• Cisco Catalyst SD-WAN Manager

Quel que soit le mode de déploiement :

• Déploiement sur site (On-Premise)

• Cisco Hosted SD-WAN Cloud

• Cisco Hosted SD-WAN Cloud – Cisco Managed

• Cisco Hosted SD-WAN Cloud – Environnement FedRAMP

ACTIONS RECOMMANDÉES

• Application des mises à jour recommandée dès que possible

• Surveillance des connexions et changements inhabituels recommandée

• Restreindre l’accès réseau aux seuls équipements autorisés

• Conserver les journaux sur un serveur externe si possible

• Placer les contrôleurs derrière un firewall

🩹
👇
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk

analyse Cisco Talos
👇
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk

Détails Vulnérabilité critique CVE-2026-20127
👇
https://cve.circl.lu/vuln/CVE-2026-20127

Investigation conducted by intelligence partners identified that the actor likely escalated to root user via a software version downgrade

👇
https://www.cyber.gov.au/sites/default/files/2026-02/ACSC-led%20Cisco%20SD-WAN%20Hunt%20Guide.pdf

#CyberVeille #cve_2026_20127 #Cisco #vuln

Cisco SDWAN Controller vulnerability in the wild and at the network edge. CVE-2026-20127 by UAT-8616. Heads up. https://blog.talosintelligence.com/uat-8616-sd-wan/ #threatintelligence #cybersecurity #cisco

Five Eyes warning: Cisco SD-WAN actively exploited by UAT-8616.
• CVE-2026-20127
• CVE-2022-20775
• Root access & rogue control-plane peering
• Persistence in edge devices
Immediate patching & threat hunting required.

Full details:
https://www.technadu.com/cisco-sd-wan-is-actively-exploited-by-uat-8616-five-eyes-alliance-agencies-issue-warning/621036/

Are you checking for downgrade events?

#InfoSec #Cisco #SDWAN #CISA #ThreatIntel

Si vous administrez une infrastructure réseau utilisant Cisco Catalyst SD-WAN, une vulnérabilité critique actuellement exploitée sur Internet permet à un attaquant distant sans authentification d’obtenir un accès administrateur au système. Une exploitation réussie peut permettre de modifier la configuration réseau, d’espionner les communications ou de maintenir un accès discret à l’infrastructure.

Les investigations effectuées par Cisco Talos montrent que ces attaques sont menées par un acteur sophistiqué et que des compromissions ont été observées depuis au moins 2023, avec dans certains cas une élévation de privilèges jusqu’au contrôle complet du système après modification de la version logicielle.

Selon Cisco, un système SD-WAN peut être particulièrement exposé si :

• le contrôleur SD-WAN est accessible depuis Internet

• des ports sont ouverts vers l’extérieur

• l’accès n’est pas limité aux adresses IP autorisées

Les éléments suivants peuvent indiquer qu’un système SD-WAN a été compromis :

• une nouvelle connexion SD-WAN inconnue

• un accès administrateur inattendu

• des journaux système effacés ou incomplets

• des mises à jour ou rétrogradations non planifiées

Cisco recommande de vérifier certains journaux système pour détecter une compromission éventuelle.

Par exemple, dans le fichier /var/log/auth.log, une connexion SSH au compte vmanage-admin depuis une adresse IP inconnue peut être suspecte :

Accepted publickey for vmanage-admin from -adresse IP inconnue-

Dans ce cas, il faut vérifier que l’adresse IP correspond bien à un équipement SD-WAN autorisé (visible dans l’interface SD-WAN Manager → Devices → System IP).

PRODUITS CONCERNÉS

Cette vulnérabilité affecte :

• Cisco Catalyst SD-WAN Controller

• Cisco Catalyst SD-WAN Manager

Quel que soit le mode de déploiement :

• Déploiement sur site (On-Premise)

• Cisco Hosted SD-WAN Cloud

• Cisco Hosted SD-WAN Cloud – Cisco Managed

• Cisco Hosted SD-WAN Cloud – Environnement FedRAMP

ACTIONS RECOMMANDÉES

• Application des mises à jour recommandée dès que possible

• Surveillance des connexions et changements inhabituels recommandée

• Restreindre l’accès réseau aux seuls équipements autorisés

• Conserver les journaux sur un serveur externe si possible

• Placer les contrôleurs derrière un firewall

🩹
👇
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk

analyse Cisco Talos
👇
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk

Détails Vulnérabilité critique CVE-2026-20127
👇
https://cve.circl.lu/vuln/CVE-2026-20127

Investigation conducted by intelligence partners identified that the actor likely escalated to root user via a software version downgrade

👇
https://www.cyber.gov.au/sites/default/files/2026-02/ACSC-led%20Cisco%20SD-WAN%20Hunt%20Guide.pdf

#CyberVeille #cve_2026_20127 #Cisco #vuln

“Cisco is warning that a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN, tracked as CVE-2026-20127, was actively exploited in zero-day attacks that allowed remote attackers to compromise controllers and add malicious rogue peers to targeted networks.”

https://www.bleepingcomputer.com/news/security/critical-cisco-sd-wan-bug-exploited-in-zero-day-attacks-since-2023/

🚨 [CISA-2026:0225] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0225)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2022-20775 (https://secdb.nttzen.cloud/cve/detail/CVE-2022-20775)
- Name: Cisco SD-WAN Path Traversal Vulnerability
- Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt &amp; Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: SD-WAN
- Notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html ; https://nvd.nist.gov/vuln/detail/CVE-2022-20775

⚠️ CVE-2026-20127 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20127)
- Name: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
- Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt &amp; Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Catalyst SD-WAN Controller and Manager
- Notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20127

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260225 #cisa20260225 #cve_2022_20775 #cve_2026_20127 #cve202220775 #cve202620127

Cisco Catalyst SD-WAN Zero-Day Exploited by Sophisticated Threat Actor UAT-8616

Cisco reports a critical authentication bypass (CVE-2026-20127) in Catalyst SD-WAN being exploited by threat actor UAT-8616 to gain root access and manipulate network fabrics. The actor uses a complex chain involving software downgrades and path traversal to maintain long-term persistence in high-value targets.

**If you are using Cisco Catalyst SD-WAN Controller or Cisco Catalyst SD-WAN Manager this is urgent. The flaw is already exploited so your SD-WAN might already be compromised without showing obvious signs. Immediately audit your logs for unauthorized SSH keys and peering events, then apply the latest Cisco security updates. Until you patch, restrict access to ports 22 and 830 to trusted controller IPs.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/cisco-catalyst-sd-wan-zero-day-exploited-by-sophisticated-threat-actor-uat-8616-h-6-g-0-b/gD2P6Ple2L

A single overlooked flaw in Cisco SD-WAN let hackers quietly control networks for months, hitting governments and critical infrastructure. How did it go undetected for so long?

https://thedefendopsdiaries.com/cisco-sd-wan-zero-day-anatomy-and-impact-of-the-cve-2026-20127-exploitation-campaign/

Critical Cisco SD-WAN bug exploited in zero-day attacks since 2023

Cisco is warning that a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN, tracked as CVE-2026-20127, was actively exploited in...

🔗️ [Bleepingcomputer] https://link.is.it/7jxB6p

CISA has now added two Cisco vulnerabilities to the KEV catalogue.

- CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-20127

- CVE-2022-20775: Cisco SD-WAN Path Traversal Vulnerability https://www.cve.org/CVERecord?id=CVE-2022-20775

- CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems #CISA #Cisco #infosec #vulnerability

🔴 CVE-2026-20127 - Critical (10)

A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to bypass authentication and obt...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20127/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE ID: CVE-2026-20127
Vendor: Cisco
Product: Catalyst SD-WAN Controller and Manager
Date Added: 2026-02-25
Notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20127
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-20127

⚠️ Alerte CERT-FR ⚠️

La vulnérabilité CVE-2026-20127 affecte Cisco Catalyst SD-WAN et permet à un attaquant non-authentifié de se connecter à un compte avec des privilèges élevés. Elle est activement exploitée.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-002/

Looks like Cisco hit the jackpot. This relates to CVE-2026-20127 and CVE-2022-20775.

New.

CISA PR: Immediate Action Required: CISA Issues Emergency Directive to Secure Cisco SD-WAN Systems https://www.cisa.gov/news-events/news/immediate-action-required-cisa-issues-emergency-directive-secure-cisco-sd-wan-systems

Mitigate Vulnerabilities in Cisco SD-WAN Systems https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems #CISA #infosec #Cisco

@cR0w

Active exploitation of Cisco Catalyst SD-WAN by UAT-8616

Cisco Talos is tracking the active exploitation of CVE-2026-20127, a vulnerability in Cisco Catalyst SD-WAN Controller, formerly vSmart, that...

🔗️ [Talosintelligence] https://link.is.it/fcOyoL

🟠 CVE-2026-3071 - High (8.4)

Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a malicious model.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3071 - High (8.4)

Deserialization of untrusted data in the LanguageModel class of Flair from versions 0.4.1 to latest are vulnerable to arbitrary code execution when loading a malicious model.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-14343 - High (7.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology Ltd. E-Commerce Product allows Reflected XSS.This issue affects E-Commerce Product: through 10122025.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14343/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-14343 - High (7.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology Ltd. E-Commerce Product allows Reflected XSS.This issue affects E-Commerce Product: through 10122025.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14343/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23703 - High (7.8)

The installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability. A non-administrative user may execute arbitrary code with SYSTEM privilege.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23703/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23703 - High (7.8)

The installer of FinalCode Client provided by Digital Arts Inc. contains an incorrect default permissions vulnerability. A non-administrative user may execute arbitrary code with SYSTEM privilege.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23703/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25191 - High (7.8)

The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is directed to place a malicious DLL file and the installer to the same directory and execute the installer, arbitrary code may b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25191/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25191 - High (7.8)

The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is directed to place a malicious DLL file and the installer to the same directory and execute the installer, arbitrary code may b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25191/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1311 - High (8.8)

The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup upload functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1311/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1311 - High (8.8)

The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup upload functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1311/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1557 - High (7.5)

The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1557/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1557 - High (7.5)

The WP Responsive Images plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0 via the 'src' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1557/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24443 - High (8.8)

EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password bef...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24443/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24443 - High (8.8)

EventSentry versions prior to 6.0.1.20 contain an unverified password change vulnerability in the account management functionality of the Web Reports interface. The password change mechanism does not require validation of the current password bef...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24443/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1779 - High (8.1)

The User Registration & Membership plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.2. This is due to incorrect authentication in the 'register_member' function. This makes it possible for unauthent...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1779/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27952 - High (8.8)

Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sandboxing mechanism for user-supplied evaluator co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27952/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27952 - High (8.8)

Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sandboxing mechanism for user-supplied evaluator co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27952/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27938 - High (7.7)

WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the `wp-graphql/wp-graphql` repository contains a GitHub Actions workflow (`release.yml`) vulnerable to OS command injection through direct use of `${{ github.event.pull...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27938 - High (7.7)

WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the `wp-graphql/wp-graphql` repository contains a GitHub Actions workflow (`release.yml`) vulnerable to OS command injection through direct use of `${{ github.event.pull...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27899 - High (8.8)

WireGuard Portal (or wg-portal) is a web-based configuration portal for WireGuard server management. Prior to version 2.1.3, any authenticated non-admin user can become a full administrator by sending a single PUT request to their own user profile...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27899/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27899 - High (8.8)

WireGuard Portal (or wg-portal) is a web-based configuration portal for WireGuard server management. Prior to version 2.1.3, any authenticated non-admin user can become a full administrator by sending a single PUT request to their own user profile...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27899/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Broadcom has an updated advisory. You'll need to log in for details.

IDMS Server - OpenSSL Vulnerability CVE-2025-15467, low severity https://support.broadcom.com/web/ecx/security-advisory #Broadcom

Cisco, oh, my!

Two critical and four high-severity vulnerabilities. This is a very long list: https://sec.cloudapps.cisco.com/security/center/publicationListing.x

More on this:

Active exploitation of Cisco Catalyst SD-WAN by UAT-8616 https://blog.talosintelligence.com/uat-8616-sd-wan/ @TalosSecurity #infosec #vulnerability #Cisco

🔴 CVE-2026-2806 - Critical (9.1)

Uninitialized memory in the Graphics: Text component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2806/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2806 - Critical (9.1)

Uninitialized memory in the Graphics: Text component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2806/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2805 - Critical (9.8)

Invalid pointer in the DOM: Core & HTML component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2805/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2805 - Critical (9.8)

Invalid pointer in the DOM: Core & HTML component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2805/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27976 - High (8.8)

Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`async_tar::Archive::unpack`) creates symlinks from the archive without validation, and the path guard (`writeable_path_from_ext...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27976 - High (8.8)

Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`async_tar::Archive::unpack`) creates symlinks from the archive without validation, and the path guard (`writeable_path_from_ext...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27804 in parse-server allows attackers to forge Google auth tokens (alg: none accepted)! Versions <8.6.3 & <9.1.1-alpha.4 at risk. Upgrade or disable Google auth now. https://radar.offseq.com/threat/cve-2026-27804-cwe-327-use-of-a-broken-or-risky-cr-9a87af7c #OffSeq #ParseServer #JWT #CVE202627804

🔴 CVE-2026-27822 - Critical (9)

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the manageme...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27822/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27606 - Critical (9.8)

Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27606/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27699 - Critical (9.1)

The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27699/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26985 - High (8.1)

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26985/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26985 - High (8.1)

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26985/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-27577 in n8n allows authenticated users to inject code & run system commands (CVSS 9.4). Affected: <2.10.1, <2.9.3, <1.123.22. Upgrade ASAP & restrict workflow perms! https://radar.offseq.com/threat/cve-2026-27577-cwe-94-improper-control-of-generati-fe1b37b0 #OffSeq #n8n #vuln #infosec

⚠️ CRITICAL: CVE-2026-27577 in n8n allows authenticated users to inject code & run system commands (CVSS 9.4). Affected: <2.10.1, <2.9.3, <1.123.22. Upgrade ASAP & restrict workflow perms! https://radar.offseq.com/threat/cve-2026-27577-cwe-94-improper-control-of-generati-fe1b37b0 #OffSeq #n8n #vuln #infosec

🔴 CVE-2026-27575 - Critical (9.1)

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27575 - Critical (9.1)

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-27498: CRITICAL code injection in n8n-io n8n (<1.123.8, 2.0.0 – 2.2.0). Auth users can exploit workflow/gIT nodes for RCE. Patch to 2.2.0+ or 1.123.8+, restrict permissions, & disable risky nodes now. https://radar.offseq.com/threat/cve-2026-27498-cwe-94-improper-control-of-generati-673d3ea0 #OffSeq #n8n #Vuln #Security

🚨 CVE-2026-27498: CRITICAL code injection in n8n-io n8n (<1.123.8, 2.0.0 – 2.2.0). Auth users can exploit workflow/gIT nodes for RCE. Patch to 2.2.0+ or 1.123.8+, restrict permissions, & disable risky nodes now. https://radar.offseq.com/threat/cve-2026-27498-cwe-94-improper-control-of-generati-673d3ea0 #OffSeq #n8n #Vuln #Security

🔴 CVE-2026-2797 - Critical (9.8)

Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2797/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2797 - Critical (9.8)

Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2797/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2796 - Critical (9.8)

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2796/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2796 - Critical (9.8)

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2796/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2795 - Critical (9.8)

Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2795/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2795 - Critical (9.8)

Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2795/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27850 - High (7.5)

Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all services which are normally only accessible through the local network.
This issue affects MR9600: 1.0.4.20...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27850 - High (7.5)

Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all services which are normally only accessible through the local network.
This issue affects MR9600: 1.0.4.20...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2801 - High (7.5)

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2801/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2801 - High (7.5)

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2801/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Five Eyes warning: Cisco SD-WAN actively exploited by UAT-8616.
• CVE-2026-20127
• CVE-2022-20775
• Root access & rogue control-plane peering
• Persistence in edge devices
Immediate patching & threat hunting required.

Full details:
https://www.technadu.com/cisco-sd-wan-is-actively-exploited-by-uat-8616-five-eyes-alliance-agencies-issue-warning/621036/

Are you checking for downgrade events?

#InfoSec #Cisco #SDWAN #CISA #ThreatIntel

Five Eyes warning: Cisco SD-WAN actively exploited by UAT-8616.
• CVE-2026-20127
• CVE-2022-20775
• Root access & rogue control-plane peering
• Persistence in edge devices
Immediate patching & threat hunting required.

Full details:
https://www.technadu.com/cisco-sd-wan-is-actively-exploited-by-uat-8616-five-eyes-alliance-agencies-issue-warning/621036/

Are you checking for downgrade events?

#InfoSec #Cisco #SDWAN #CISA #ThreatIntel

@leb Yep. And they finally updated the one in my original post:

In February 2026, the Cisco PSIRT became aware of attempted exploitation of the vulnerability described in CVE-2022-20775.

🚨 [CISA-2026:0225] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0225)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2022-20775 (https://secdb.nttzen.cloud/cve/detail/CVE-2022-20775)
- Name: Cisco SD-WAN Path Traversal Vulnerability
- Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt &amp; Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: SD-WAN
- Notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html ; https://nvd.nist.gov/vuln/detail/CVE-2022-20775

⚠️ CVE-2026-20127 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20127)
- Name: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
- Action: Please adhere to CISA’s guidelines to assess exposure and mitigate risks associated with Cisco SD-WAN devices as outlines in CISA’s Emergency Directive 26-03 (URL listed below in Notes) and CISA’s “Hunt &amp; Hardening Guidance for Cisco SD-WAN Devices (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Catalyst SD-WAN Controller and Manager
- Notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20127

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260225 #cisa20260225 #cve_2022_20775 #cve_2026_20127 #cve202220775 #cve202620127

CISA has now added two Cisco vulnerabilities to the KEV catalogue.

- CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-20127

- CVE-2022-20775: Cisco SD-WAN Path Traversal Vulnerability https://www.cve.org/CVERecord?id=CVE-2022-20775

- CISA and Partners Release Guidance for Ongoing Global Exploitation of Cisco SD-WAN Systems https://www.cisa.gov/news-events/alerts/2026/02/25/cisa-and-partners-release-guidance-ongoing-global-exploitation-cisco-sd-wan-systems #CISA #Cisco #infosec #vulnerability

CVE ID: CVE-2022-20775
Vendor: Cisco
Product: SD-WAN
Date Added: 2026-02-25
Notes: CISA Mitigation Instructions: https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems ; https://www.cisa.gov/news-events/directives/supplemental-direction-ed-26-03-hunt-and-hardening-guidance-cisco-sd-wan-systems ; https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sd-wan-priv-E6e8tEdF.html ; https://nvd.nist.gov/vuln/detail/CVE-2022-20775
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2022-20775

Looks like Cisco hit the jackpot. This relates to CVE-2026-20127 and CVE-2022-20775.

New.

CISA PR: Immediate Action Required: CISA Issues Emergency Directive to Secure Cisco SD-WAN Systems https://www.cisa.gov/news-events/news/immediate-action-required-cisa-issues-emergency-directive-secure-cisco-sd-wan-systems

Mitigate Vulnerabilities in Cisco SD-WAN Systems https://www.cisa.gov/news-events/directives/ed-26-03-mitigate-vulnerabilities-cisco-sd-wan-systems #CISA #infosec #Cisco

@cR0w

CVE-2026-2636: Windows CLFS Kernel Flaw Allows Low-Privilege Users to Force BSoD Crashes

Introduction: A Silent Kernel Weakness With Loud Consequences A newly detailed Windows kernel vulnerability has drawn attention not because it enables stealthy espionage or privilege escalation, but because of how brutally effective it is. Security researchers have published a working Proof of Concept exploit that allows any low-privileged user to reliably crash a Windows system…

https://undercodenews.com/cve-2026-2636-windows-clfs-kernel-flaw-allows-low-privilege-users-to-force-bsod-crashes/

🟠 CVE-2025-14511 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted files...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14511/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-14511 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted files...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14511/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1388 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending speci...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1388/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1388 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending speci...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1388/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3172 - High (8.1)

Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the database server.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3172/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3172 - High (8.1)

Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the database server.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3172/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22720 - High (8)

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. 

To remediate CV...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-27497 (CRITICAL, CVSS 9.4): n8n-io n8n code injection via Merge node's SQL query mode. Authenticated users can achieve RCE and write files. Upgrade to v2.10.1/2.9.3/1.123.22 now! https://radar.offseq.com/threat/cve-2026-27497-cwe-94-improper-control-of-generati-7583bd72 #OffSeq #n8n #CodeInjection #Infosec

🚨 CVE-2026-27497 (CRITICAL, CVSS 9.4): n8n-io n8n code injection via Merge node's SQL query mode. Authenticated users can achieve RCE and write files. Upgrade to v2.10.1/2.9.3/1.123.22 now! https://radar.offseq.com/threat/cve-2026-27497-cwe-94-improper-control-of-generati-7583bd72 #OffSeq #n8n #CodeInjection #Infosec

🟠 CVE-2026-1662 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted reque...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1662/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1662 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted reque...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1662/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0752 - High (8)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0752/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0752 - High (8)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that under certain circumstances, could have allowed an unauthenticated user to inject arbitrary scripts into...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0752/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25899 - High (7.5)

Fiber is an Express inspired web framework written in Go. In versions on the v3 branch prior to 3.1.0, the use of the `fiber_flash` cookie can force an unbounded allocation on any server. A crafted 10-character cookie value triggers an attempt to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25899/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2807 - Critical (9.8)

Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2807 - Critical (9.8)

Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27696 - High (8.6)

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27696/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27641 impacts flask-reuploaded < 1.5.0. SSTI lets remote attackers write files & execute code (CVSS 9.8) without auth. Upgrade to 1.5.0+ & validate all input. Details: https://radar.offseq.com/threat/cve-2026-27641-cwe-1336-improper-neutralization-of-693604e2 #OffSeq #CVE202627641 #SSTI #Python

🔴 CVE-2026-27641 - Critical (9.8)

Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Templat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27641/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27641 - Critical (9.8)

Flask-Reuploaded provides file uploads for Flask. A critical path traversal and extension bypass vulnerability in versions prior to 1.5.0 allows remote attackers to achieve arbitrary file write and remote code execution through Server-Side Templat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27641/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27702 - Critical (9.9)

Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier acco...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27702/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27732 - High (8.1)

WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27732/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27732 - High (8.1)

WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27732/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25136 - High (8.1)

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25136/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25136 - High (8.1)

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25136/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2786 - Critical (9.8)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox &lt; 148, Firefox ESR &lt; 140.8, Thunderbird &lt; 148, and Thunderbird &lt; 140.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2786 - Critical (9.8)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox &lt; 148, Firefox ESR &lt; 140.8, Thunderbird &lt; 148, and Thunderbird &lt; 140.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

A single mistake in Juniper PTX routers now lets anyone on the network take full control—no password needed. How safe is the backbone of the internet really?

https://thedefendopsdiaries.com/cve-2026-21902-critical-juniper-ptx-router-flaw-exposes-global-networks/

A single mistake in Juniper PTX routers now lets anyone on the network take full control—no password needed. How safe is the backbone of the internet really?

https://thedefendopsdiaries.com/cve-2026-21902-critical-juniper-ptx-router-flaw-exposes-global-networks/

🔴 CVE-2026-21902 - Critical (9.8)

An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root.

The On-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21902/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20128 - High (7.5)

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker to gain DCA user privileges on an affected system. To exploit this vulnerability, the attacker must have valid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20128 - High (7.5)

A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker to gain DCA user privileges on an affected system. To exploit this vulnerability, the attacker must have valid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-20129 - Critical (9.8)

A vulnerability in the API user authentication of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain access to an affected system as a user who has the&nbsp;netadmin role.

The vulnerability is due to improper ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20129/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-1242 - Critical (9.1)

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the G...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-1242/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-1242 - Critical (9.1)

The administrative credentials can be extracted through application API responses, mobile application reverse engineering, and device firmware reverse engineering. The exposure may result in an attacker gaining full administrative access to the G...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-1242/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-63409 - High (8.8)

Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to modify administrator only settings and extract administrator credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-63409/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-63409 - High (8.8)

Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to modify administrator only settings and extract administrator credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-63409/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27728 - Critical (9.9)

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allows any authenticated project user to execute arbitrary operating sy...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27728/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27728 - Critical (9.9)

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.7, an OS command injection vulnerability in `NetworkPathMonitor.performTraceroute()` allows any authenticated project user to execute arbitrary operating sy...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27728/