Keycloak unauthenticated account takeover via reset-credentials flow bypass

Keycloak의 reset-credentials 플로우에서 이메일 검증 링크 클릭을 우회해, 인증되지 않은 공격자가 임의 사용자 계정의 비밀번호를 재설정하고 탈취할 수 있는 치명적 취약점(CVE-2026-18963)이 공개됐다. 취약점은 keycloak-services의 상태 처리와 액션 토큰 검증 부재가 결합된 문제이며, 커뮤니티 Keycloak에도 영향을 준다. 영향 범위는 26.0.0 이후 일부 릴리스이며, 공개 컨테이너 사용자는 우선 26.7.2로 업그레이드해야 하고, Red Hat Build 사용자는 26.4.15 또는 26.6.6 패치를 적용해...

https://github.com/keycloak/keycloak/issues/51833

Guten Morgen an @univention Kund*innen, die unsere #Keycloak App einsetzen! Wir werden demnächst Version 26.7.2 herausbringen. Von dem Account-Takeover-CVE ist unsere App nicht betroffen.

Details findet Ihr hier: https://help.univention.com/t/keycloak-26-7-2-and-cve-2026-18963-potential-account-takeover-nubus-not-affected/25494

PSA: Critical unauthenticated account takeover vulnerability in #Keycloak - allows resetting arbitrary users‘ passwords. Update to 26.7.2 immediately or disable password reset. Tracked as CVE-2026-18963. https://github.com/keycloak/keycloak/issues/51833

#infosec

PSA: Critical unauthenticated account takeover vulnerability in #Keycloak - allows resetting arbitrary users‘ passwords. Update to 26.7.2 immediately or disable password reset. Tracked as CVE-2026-18963. https://github.com/keycloak/keycloak/issues/51833

#infosec

CVE-2026-75860: CRITICAL privilege escalation in JSON Options ≤0.0.4. Unauthenticated attackers can update WordPress options & gain admin access. Remove or disable plugin until fix is available. Full site takeover risk. https://radar.offseq.com/threat/cve-2026-75860-cwe-269-improper-privilege-management-in-json-options-5e170a19118b89b1 #OffSeq #WordPress #CVE202675860

CVE-2026-75860: CRITICAL privilege escalation in JSON Options ≤0.0.4. Unauthenticated attackers can update WordPress options & gain admin access. Remove or disable plugin until fix is available. Full site takeover risk. https://radar.offseq.com/threat/cve-2026-75860-cwe-269-improper-privilege-management-in-json-options-5e170a19118b89b1 #OffSeq #WordPress #CVE202675860

🔴 CVE-2026-72530 - Critical (9)

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72530/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-72530 - Critical (9)

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72530/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Microsoft working on Defender patch for ShieldBreak zero-day

Microsoft는 Microsoft Defender의 Malware Protection Engine에서 발생하는 로컬 권한 상승 제로데이 ‘ShieldBreak’(CVE-2026-69414)을 추적하고 패치를 개발 중이다. 공개된 PoC는 제한된 권한의 로컬 공격자가 Defender가 활성화된 최신 패치 상태의 Windows 11 및 Windows Server 환경에서 SYSTEM 권한을 얻을 수 있음을 보이며, 분석가가 동작을 확인했다. 이 취약점은 앞서 공개된 RoguePl...

https://www.bleepingcomputer.com/news/security/microsoft-working-on-defender-patch-for-shieldbreak-zero-day/

ShieldBreak : cette faille zero-day menace Windows, Microsoft prépare un patch https://www.it-connect.fr/shieldbreak-zero-day-defender-cve-2026-69414/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft #Windows

ShieldBreak : cette faille zero-day menace Windows, Microsoft prépare un patch https://www.it-connect.fr/shieldbreak-zero-day-defender-cve-2026-69414/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft #Windows

🔴 New security advisory:

CVE-2026-64849 affects Lfprojects Mlflow.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-64849-mlflow-ssrf-leaks-cloud-metadata

by Yazoul AI

#CVE #VulnerabilityManagement #CyberSec

🚨 [CISA-2026:0819] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0819)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-64849 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-64849)
- Name: MLflow Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: MLflow
- Product: MLflow
- Notes: https://github.com/mlflow/mlflow/pull/24258 ; https://github.com/mlflow/mlflow/issues/24179 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-64849

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260819 #cisa20260819 #cve_2026_64849 #cve202664849

CVE ID: CVE-2026-64849
Vendor: MLflow
Product: MLflow
Date Added: 2026-08-19
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64849

Attackers Exploit a Critical MLflow Vulnerability

Attackers are actively exploiting a critical flaw in MLflow (CVE-2026-64849) to steal cloud credentials and gain remote code execution.

**If you run MLflow, update it to version 3.15.0 or later ASAP, and make sure the server is not reachable from the internet. Then check your audit logs for any odd requests to cloud metadata services. If you see any (or aren't sure), rotate your cloud credentials and keys as a precaution.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-a-critical-mlflow-vulnerability-3-u-3-k-6/gD2P6Ple2L

Active exploitation of CVE-2026-64849 in MLflow enables unauthenticated SSRF to internal endpoints including cloud metadata services. FUXA, a SCADA/HMI platform for industrial automation, faces parallel exposure. Both flaws were confirmed independently by watchTowr and VulnCheck.

#MLflowVulnerability #FUXACVE #IndustrialOT #AISecurity

https://cyberworldops.eu/en/mlflow-and-fuxa-under-attack-critical-ai-and-industrial-automation

Attackers Exploit MLflow Flaw to Steal Cloud Credentials

A newly discovered vulnerability in MLflow, CVE-2026-64849, with a near-perfect CVSS score of 9.3 is being exploited by attackers to infiltrate cloud metadata services and steal sensitive credentials. This critical flaw allows hackers to issue unauthorized requests and extract confidential data, putting your cloud security at risk.

https://osintsights.com/attackers-exploit-mlflow-flaw-to-steal-cloud-credentials?utm_source=mastodon&utm_medium=social

#Mlflow #CloudCredentialsTheft #Cve202664849 #ServersideRequestForgery #Ssrf

A public PoC for CVE-2026-64849, an unauthenticated MLflow SSRF (CVSS 9.3), is now live. watchTowr reports exploitation attempts. Patch to 3.15.0.

#MLflow #CVE202664849 #SSRF #watchTowr #AISecurity #InfoSec

https://securityonline.info/mlflow-ssrf-cve-2026-64849/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0819] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0819)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-64849 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-64849)
- Name: MLflow Server-Side Request Forgery Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: MLflow
- Product: MLflow
- Notes: https://github.com/mlflow/mlflow/pull/24258 ; https://github.com/mlflow/mlflow/issues/24179 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-64849

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260819 #cisa20260819 #cve_2026_64849 #cve202664849

CVE ID: CVE-2026-64849
Vendor: MLflow
Product: MLflow
Date Added: 2026-08-19
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64849

Attackers Exploit a Critical MLflow Vulnerability

Attackers are actively exploiting a critical flaw in MLflow (CVE-2026-64849) to steal cloud credentials and gain remote code execution.

**If you run MLflow, update it to version 3.15.0 or later ASAP, and make sure the server is not reachable from the internet. Then check your audit logs for any odd requests to cloud metadata services. If you see any (or aren't sure), rotate your cloud credentials and keys as a precaution.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-a-critical-mlflow-vulnerability-3-u-3-k-6/gD2P6Ple2L

Active exploitation of CVE-2026-64849 in MLflow enables unauthenticated SSRF to internal endpoints including cloud metadata services. FUXA, a SCADA/HMI platform for industrial automation, faces parallel exposure. Both flaws were confirmed independently by watchTowr and VulnCheck.

#MLflowVulnerability #FUXACVE #IndustrialOT #AISecurity

https://cyberworldops.eu/en/mlflow-and-fuxa-under-attack-critical-ai-and-industrial-automation

A public PoC for CVE-2026-64849, an unauthenticated MLflow SSRF (CVSS 9.3), is now live. watchTowr reports exploitation attempts. Patch to 3.15.0.

#MLflow #CVE202664849 #SSRF #watchTowr #AISecurity #InfoSec

https://securityonline.info/mlflow-ssrf-cve-2026-64849/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-64849 - Critical (9.3)

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/va...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-64849/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco patches Secure Workload flaws CVE-2026-20315 and CVE-2026-20317, an authentication bypass and privilege escalation pair scoring CVSS 10. Upgrade now.

#Cisco #CVE #AuthenticationBypass #PrivilegeEscalation #Vulnerability #InfoSec #PatchNow

https://securityonline.info/cisco-secure-workload-cve-2026-20315/?utm_source=mastodon&utm_medium=jetpack_social

Cisco patches Secure Workload flaws CVE-2026-20315 and CVE-2026-20317, an authentication bypass and privilege escalation pair scoring CVSS 10. Upgrade now.

#Cisco #CVE #AuthenticationBypass #PrivilegeEscalation #Vulnerability #InfoSec #PatchNow

https://securityonline.info/cisco-secure-workload-cve-2026-20315/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-19490 (CVSS 9.3) is a critical NetScaler authentication bypass in NetScaler Gateway and ADC. Patch now to block unauthenticated access.

#NetScaler #Citrix #CVE202619490 #AuthBypass #InfoSec

https://securityonline.info/netscaler-authentication-bypass-cve-2026-19490/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-19490 (CVSS 9.3) is a critical NetScaler authentication bypass in NetScaler Gateway and ADC. Patch now to block unauthenticated access.

#NetScaler #Citrix #CVE202619490 #AuthBypass #InfoSec

https://securityonline.info/netscaler-authentication-bypass-cve-2026-19490/?utm_source=mastodon&utm_medium=jetpack_social

TRENDnet TEW-755AP is affected by CVE-2026-76589 (CRITICAL, CVSS 9.4): stack-based buffer overflow in /sbin/mycli, exploitable remotely. Public exploit; no patch yet. Restrict device access and monitor. https://radar.offseq.com/threat/cve-2026-76589-stack-based-buffer-overflow-in-trendnet-tew-755ap-b22775c9ba4ec937 #OffSeq #CVE202676589 #IoTSecurity

🔴 CVE-2026-76589 - Critical (9.9)

A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument ssid results in stack-based buffer overflow. The attack may be launched remotely. The exp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76589/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

TRENDnet TEW-755AP is affected by CVE-2026-76589 (CRITICAL, CVSS 9.4): stack-based buffer overflow in /sbin/mycli, exploitable remotely. Public exploit; no patch yet. Restrict device access and monitor. https://radar.offseq.com/threat/cve-2026-76589-stack-based-buffer-overflow-in-trendnet-tew-755ap-b22775c9ba4ec937 #OffSeq #CVE202676589 #IoTSecurity

🔴 CVE-2026-76589 - Critical (9.9)

A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument ssid results in stack-based buffer overflow. The attack may be launched remotely. The exp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76589/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76850 (CRITICAL): InternLM lmdeploy <0.16.0 vulnerable to remote code execution via untrusted pickle deserialization on ZeroMQ endpoints. Enable API keys or disable disaggregated serving to mitigate. https://radar.offseq.com/threat/cve-2026-76850-deserialization-of-untrusted-data-in-internlm-lmdeploy-657fdd1d6177df51 #OffSeq #Infosec #Vuln #CVE202676850

🔴 CVE-2026-76850 - Critical (9.8)

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76850 (CRITICAL): InternLM lmdeploy <0.16.0 vulnerable to remote code execution via untrusted pickle deserialization on ZeroMQ endpoints. Enable API keys or disable disaggregated serving to mitigate. https://radar.offseq.com/threat/cve-2026-76850-deserialization-of-untrusted-data-in-internlm-lmdeploy-657fdd1d6177df51 #OffSeq #Infosec #Vuln #CVE202676850

🔴 CVE-2026-76850 - Critical (9.8)

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76880 - High (7.5)

RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76880/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76880 - High (7.5)

RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76880/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76879 - High (7.5)

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76879/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76879 - High (7.5)

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76879/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76590: CRITICAL stack buffer overflow in TRENDnet TEW-755AP (/cgi-bin/wan.cgi, CVSS 9.4). Remote code execution possible. No patch — restrict access, monitor endpoints. Exploit code public, no active attacks yet. https://radar.offseq.com/threat/cve-2026-76590-stack-based-buffer-overflow-in-trendnet-tew-755ap-37978d53e46251c0 #OffSeq #Vuln #IoTSec #CVE2026

🔴 CVE-2026-76590 - Critical (9.9)

A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the component ssi. Such manipulation of the argument cameo.wan.wan_pppoe_password_00 leads to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76590: CRITICAL stack buffer overflow in TRENDnet TEW-755AP (/cgi-bin/wan.cgi, CVSS 9.4). Remote code execution possible. No patch — restrict access, monitor endpoints. Exploit code public, no active attacks yet. https://radar.offseq.com/threat/cve-2026-76590-stack-based-buffer-overflow-in-trendnet-tew-755ap-37978d53e46251c0 #OffSeq #Vuln #IoTSec #CVE2026

🔴 CVE-2026-76590 - Critical (9.9)

A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the component ssi. Such manipulation of the argument cameo.wan.wan_pppoe_password_00 leads to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76832 - High (8.8)

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument passed to rea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76832 - High (8.8)

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument passed to rea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76399 - High (8.1)

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language (SPL) using the permissions of the search owner, which could allow access ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76399 - High (8.1)

In Splunk AI Toolkit versions below 6.0.1, a user who holds the "power" Splunk role could modify app-provided scheduled searches to run arbitrary Search Processing Language (SPL) using the permissions of the search owner, which could allow access ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76397 - High (8.1)

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolki...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76397/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76397 - High (8.1)

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolki...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76397/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76396 - High (7.5)

In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedule_search capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76396/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76396 - High (7.5)

In Splunk AI Toolkit versions below 6.0.0, a user that holds a role with the schedule_search capability could cause a scheduled search to load and deserialize a model file through the apply search command. The improper access control is possible b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76396/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76395 - High (8.8)

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76395/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76395 - High (8.8)

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76395/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Splunk patches CVE-2026-76404, a critical remote code execution flaw in the MCP Server app, plus 16 more bugs across its apps and add-ons.

#Splunk #CVE #RemoteCodeExecution #RCE #MCPServer #Deserialization #InfoSec #PatchNow

https://securityonline.info/splunk-apps-cve-2026-76404/?utm_source=mastodon&utm_medium=jetpack_social

Splunk MCP Server app v1.2 is impacted by CVE-2026-76404 (CRITICAL, CVSS 9.1) — insecure deserialization lets admin users run arbitrary OS commands. Limit admin access & monitor for misuse until a patch is released. https://radar.offseq.com/threat/cve-2026-76404-the-application-deserializes-untrusted-data-without-sufficiently-verifying-that-the-a0d42d963a9e6a80 #OffSeq #Splunk #Infosec #CVE202676404

🔴 CVE-2026-76404 - Critical (9.1)

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Splunk patches CVE-2026-76404, a critical remote code execution flaw in the MCP Server app, plus 16 more bugs across its apps and add-ons.

#Splunk #CVE #RemoteCodeExecution #RCE #MCPServer #Deserialization #InfoSec #PatchNow

https://securityonline.info/splunk-apps-cve-2026-76404/?utm_source=mastodon&utm_medium=jetpack_social

Splunk MCP Server app v1.2 is impacted by CVE-2026-76404 (CRITICAL, CVSS 9.1) — insecure deserialization lets admin users run arbitrary OS commands. Limit admin access & monitor for misuse until a patch is released. https://radar.offseq.com/threat/cve-2026-76404-the-application-deserializes-untrusted-data-without-sufficiently-verifying-that-the-a0d42d963a9e6a80 #OffSeq #Splunk #Infosec #CVE202676404

🔴 CVE-2026-76404 - Critical (9.1)

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Splunk patches three critical embedded report flaws (CVE-2026-76310, CVSS 9.4) that let unauthenticated users affect system integrity.

#Splunk #CVE #AccessControl #SplunkEnterprise #Vulnerability #InfoSec #PatchNow

https://securityonline.info/splunk-enterprise-cve-2026-76310/?utm_source=mastodon&utm_medium=jetpack_social

Splunk patches three critical embedded report flaws (CVE-2026-76310, CVSS 9.4) that let unauthenticated users affect system integrity.

#Splunk #CVE #AccessControl #SplunkEnterprise #Vulnerability #InfoSec #PatchNow

https://securityonline.info/splunk-enterprise-cve-2026-76310/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-76928 - High (7.5)

X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76928 - High (7.5)

X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76886 - High (8.1)

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76886 - High (8.1)

C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco patches a Crosswork SQL injection flaw, CVE-2026-20030, rated CVSS 10.0. A BroadWorks XXE bug (CVE-2026-20320) also gets a fix.

#Cisco #CVE #SQLInjection #Crosswork #BroadWorks #XXE #Vulnerability #InfoSec

https://securityonline.info/cisco-crosswork-cve-2026-20030/?utm_source=mastodon&utm_medium=jetpack_social

Cisco patches a Crosswork SQL injection flaw, CVE-2026-20030, rated CVSS 10.0. A BroadWorks XXE bug (CVE-2026-20320) also gets a fix.

#Cisco #CVE #SQLInjection #Crosswork #BroadWorks #XXE #Vulnerability #InfoSec

https://securityonline.info/cisco-crosswork-cve-2026-20030/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-75569 - High (7.7)

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75569/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75569 - High (7.7)

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75569/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76584 - Critical (9.9)

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76584/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76584 - Critical (9.9)

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in st...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76584/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Red Hat ACM privilege escalation flaws (CVE-2026-70496, CVSS 9.9) let attackers seize full cluster control. See the three Kubernetes bugs.

#RedHat #Kubernetes #PrivilegeEscalation #CVE #ACM #CloudSecurity #InfoSec

https://securityonline.info/red-hat-acm-cve-2026-70496/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-70496 - Critical (9.9)

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-70496/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Red Hat ACM privilege escalation flaws (CVE-2026-70496, CVSS 9.9) let attackers seize full cluster control. See the three Kubernetes bugs.

#RedHat #Kubernetes #PrivilegeEscalation #CVE #ACM #CloudSecurity #InfoSec

https://securityonline.info/red-hat-acm-cve-2026-70496/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-70496 - Critical (9.9)

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-70496/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Stack-based buffer overflow (CVE-2026-16885) in IBM AIX 7.2, 7.3 & PowerVM VIOS 4.1 (CRITICAL, CVSS 9.8). Remote, unauthenticated code execution possible. No patch yet — monitor IBM advisories. https://radar.offseq.com/threat/cve-2026-16885-cwe-121-stack-based-buffer-overflow-in-ibm-aix-4d84d05fa38f4cbc #OffSeq #IBM #AIX #Vuln

Stack-based buffer overflow (CVE-2026-16885) in IBM AIX 7.2, 7.3 & PowerVM VIOS 4.1 (CRITICAL, CVSS 9.8). Remote, unauthenticated code execution possible. No patch yet — monitor IBM advisories. https://radar.offseq.com/threat/cve-2026-16885-cwe-121-stack-based-buffer-overflow-in-ibm-aix-4d84d05fa38f4cbc #OffSeq #IBM #AIX #Vuln

🟠 CVE-2026-18848 - High (8.3)

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18848/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18848 - High (8.3)

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18848/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco patches Secure Workload flaws CVE-2026-20315 and CVE-2026-20317, an authentication bypass and privilege escalation pair scoring CVSS 10. Upgrade now.

#Cisco #CVE #AuthenticationBypass #PrivilegeEscalation #Vulnerability #InfoSec #PatchNow

https://securityonline.info/cisco-secure-workload-cve-2026-20315/?utm_source=mastodon&utm_medium=jetpack_social

Cisco patches Secure Workload flaws CVE-2026-20315 and CVE-2026-20317, an authentication bypass and privilege escalation pair scoring CVSS 10. Upgrade now.

#Cisco #CVE #AuthenticationBypass #PrivilegeEscalation #Vulnerability #InfoSec #PatchNow

https://securityonline.info/cisco-secure-workload-cve-2026-20315/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-76583 - Command injection in TRENDnet TV-IP751WIC via set_time.cgi. CVSS 7.4. Exploit public, no patch. Disable remote access now. #CVE #TRENDnet #infosec

https://www.valtersit.com/cve/CVE-2026-76583/

🟠 CVE-2026-76139 - High (8)

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub acces...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76139/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76139 - High (8)

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub acces...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76139/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-68561 - High (8.8)

Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow({ update }) rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68561/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-68561 - High (8.8)

Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow({ update }) rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68561/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-52876 - High (8.8)

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52876/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-52876 - High (8.8)

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52876/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61518 - High (8.8)

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query bind...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61518/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61518 - High (8.8)

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query bind...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61518/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-66794 - Critical (9.3)

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manip...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66794/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-66794 - Critical (9.3)

A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manip...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66794/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

WordPress admins running Elementor Pro:

CVSS 9.8 - CVE-2026-32475

WordPress Elementor Pro Plugin <= 4.2.1 is vulnerable to a high priority Arbitrary File Upload

https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/

#wordpresss

WordPress admins running Elementor Pro:

CVSS 9.8 - CVE-2026-32475

WordPress Elementor Pro Plugin <= 4.2.1 is vulnerable to a high priority Arbitrary File Upload

https://patchstack.com/articles/critical-unauthenticated-file-upload-to-rce-in-elementor-pro-plugin/

#wordpresss

🟠 CVE-2026-75144 - High (7.8)

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75144/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75144 - High (7.8)

FFmpeg before commit 1cdeb3c contains a heap buffer overflow vulnerability in the VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) that allows attackers to trigger memory corruption by supplying a crafted Dirac data unit. The packetizer copi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75144/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75143 - Critical (9.8)

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, ove...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75143/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75143 - Critical (9.8)

FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c). librist_read() ignored its size argument and copied the full received payload length into the caller-provided destination buffer, ove...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75143/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75142 - High (7.8)

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75142/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75142 - High (7.8)

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75142/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75146 - High (8.1)

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negativ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75146/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75146 - High (8.1)

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer (libavformat/dashdec.c). When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negativ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75146/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco patches a Crosswork SQL injection flaw, CVE-2026-20030, rated CVSS 10.0. A BroadWorks XXE bug (CVE-2026-20320) also gets a fix.

#Cisco #CVE #SQLInjection #Crosswork #BroadWorks #XXE #Vulnerability #InfoSec

https://securityonline.info/cisco-crosswork-cve-2026-20030/?utm_source=mastodon&utm_medium=jetpack_social

Cisco patches a Crosswork SQL injection flaw, CVE-2026-20030, rated CVSS 10.0. A BroadWorks XXE bug (CVE-2026-20320) also gets a fix.

#Cisco #CVE #SQLInjection #Crosswork #BroadWorks #XXE #Vulnerability #InfoSec

https://securityonline.info/cisco-crosswork-cve-2026-20030/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-18051 (CVSS 10) is an unauthenticated arbitrary file write in W3 Total Cache, exposing 900k+ WordPress sites. Update to 2.10.5 now.

#W3TotalCache #WordPress #CVE202618051 #PathTraversal #InfoSec

https://securityonline.info/w3-total-cache-file-write-cve-2026-18051/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-18051 (CVSS 10) is an unauthenticated arbitrary file write in W3 Total Cache, exposing 900k+ WordPress sites. Update to 2.10.5 now.

#W3TotalCache #WordPress #CVE202618051 #PathTraversal #InfoSec

https://securityonline.info/w3-total-cache-file-write-cve-2026-18051/?utm_source=mastodon&utm_medium=jetpack_social

[1/9]

Most Impactful Security Incidents ( 2026‑08‑18 → 2026‑08‑19 )

---

PRIORITY 1 – Critical / High‑Severity Flaws (CVSS 7‑10):

CVE‑2026‑60392
• 7.8 (HIGH)
• Oracle Outside In Technology – PDF Export SDK (Fusion Middleware)
• Local‑privilege escalation; requires attacker to have a logon on the host where the SDK runs. Successful exploitation can lead to full takeover of the component.
• 8.5.8
• Easily exploitable (local) – requires user interaction.
• https://cveawg.mitre.org/api/cve/CVE-2026-60392

CVE‑2026‑60782
• 9.8 (CRITICAL)
• Oracle Payments (E‑Business Suite) – File Transmission
• Remote unauthenticated attacker can compromise the Payments module via HTTP. Leads to full takeover of the Payments service.
• 12.2.3‑12.2.15
• Network‑accessible, no authentication required.
• https://cveawg.mitre.org/api/cve/CVE-2026-60782

CVE‑2026‑60730
• 9.9 (CRITICAL)
• Oracle WebCenter Portal – Composer component
• Remote unauthenticated attacker can compromise the portal via HTTP. Full takeover of the portal.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60730

CVE‑2026‑60728
• 9.1 (CRITICAL)
• Oracle WebCenter Portal – Portlet Services
• Remote unauthenticated attacker can cause denial‑of‑service and full compromise of portal data.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60728

CVE‑2026‑60727
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can take over the IAM system via HTTP.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60727

CVE‑2026‑60721
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Same vector as above; full takeover possible.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60721

CVE‑2026‑60720
• 9.9 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can compromise the IAM system.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60720

#infosecnews

[1/9]

Most Impactful Security Incidents ( 2026‑08‑18 → 2026‑08‑19 )

---

PRIORITY 1 – Critical / High‑Severity Flaws (CVSS 7‑10):

CVE‑2026‑60392
• 7.8 (HIGH)
• Oracle Outside In Technology – PDF Export SDK (Fusion Middleware)
• Local‑privilege escalation; requires attacker to have a logon on the host where the SDK runs. Successful exploitation can lead to full takeover of the component.
• 8.5.8
• Easily exploitable (local) – requires user interaction.
• https://cveawg.mitre.org/api/cve/CVE-2026-60392

CVE‑2026‑60782
• 9.8 (CRITICAL)
• Oracle Payments (E‑Business Suite) – File Transmission
• Remote unauthenticated attacker can compromise the Payments module via HTTP. Leads to full takeover of the Payments service.
• 12.2.3‑12.2.15
• Network‑accessible, no authentication required.
• https://cveawg.mitre.org/api/cve/CVE-2026-60782

CVE‑2026‑60730
• 9.9 (CRITICAL)
• Oracle WebCenter Portal – Composer component
• Remote unauthenticated attacker can compromise the portal via HTTP. Full takeover of the portal.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60730

CVE‑2026‑60728
• 9.1 (CRITICAL)
• Oracle WebCenter Portal – Portlet Services
• Remote unauthenticated attacker can cause denial‑of‑service and full compromise of portal data.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60728

CVE‑2026‑60727
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can take over the IAM system via HTTP.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60727

CVE‑2026‑60721
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Same vector as above; full takeover possible.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60721

CVE‑2026‑60720
• 9.9 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can compromise the IAM system.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60720

#infosecnews

An Oracle WebLogic vulnerability, CVE-2026-60702 (CVSS 9.9), allows full server takeover. Oracle patched nine flaws, five rated critical. Update now.

#OracleWebLogic #CVE202660702 #RCE #FusionMiddleware #ServerTakeover #InfoSec

https://securityonline.info/oracle-weblogic-vulnerability-cve-2026-60702/?utm_source=mastodon&utm_medium=jetpack_social

An Oracle WebLogic vulnerability, CVE-2026-60702 (CVSS 9.9), allows full server takeover. Oracle patched nine flaws, five rated critical. Update now.

#OracleWebLogic #CVE202660702 #RCE #FusionMiddleware #ServerTakeover #InfoSec

https://securityonline.info/oracle-weblogic-vulnerability-cve-2026-60702/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-75149 - High (8.8)

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75149 - High (8.8)

marimo before 0.23.15 contains a code injection vulnerability in the notebook configuration handler that allows attackers to execute arbitrary commands by supplying a crafted MCP server entry with an attacker-controlled command value embedded in a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/9]

Most Impactful Security Incidents ( 2026‑08‑18 → 2026‑08‑19 )

---

PRIORITY 1 – Critical / High‑Severity Flaws (CVSS 7‑10):

CVE‑2026‑60392
• 7.8 (HIGH)
• Oracle Outside In Technology – PDF Export SDK (Fusion Middleware)
• Local‑privilege escalation; requires attacker to have a logon on the host where the SDK runs. Successful exploitation can lead to full takeover of the component.
• 8.5.8
• Easily exploitable (local) – requires user interaction.
• https://cveawg.mitre.org/api/cve/CVE-2026-60392

CVE‑2026‑60782
• 9.8 (CRITICAL)
• Oracle Payments (E‑Business Suite) – File Transmission
• Remote unauthenticated attacker can compromise the Payments module via HTTP. Leads to full takeover of the Payments service.
• 12.2.3‑12.2.15
• Network‑accessible, no authentication required.
• https://cveawg.mitre.org/api/cve/CVE-2026-60782

CVE‑2026‑60730
• 9.9 (CRITICAL)
• Oracle WebCenter Portal – Composer component
• Remote unauthenticated attacker can compromise the portal via HTTP. Full takeover of the portal.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60730

CVE‑2026‑60728
• 9.1 (CRITICAL)
• Oracle WebCenter Portal – Portlet Services
• Remote unauthenticated attacker can cause denial‑of‑service and full compromise of portal data.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60728

CVE‑2026‑60727
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can take over the IAM system via HTTP.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60727

CVE‑2026‑60721
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Same vector as above; full takeover possible.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60721

CVE‑2026‑60720
• 9.9 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can compromise the IAM system.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60720

#infosecnews

🟠 CVE-2026-75141 - High (7.8)

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap bu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75141 - High (7.8)

FFmpeg before commit acf5d7c contains a heap buffer overflow in the hvcC box writer. When writing an HEVC configuration record with more NAL units of a single type than the count field can represent, the NAL unit count overflows, causing a heap bu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-52872 - High (8.8)

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52872/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-52872 - High (8.8)

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52872/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75130 - Critical (9)

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75130/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75130 - Critical (9)

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75130/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73925 - High (8.2)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73925 - High (8.2)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73924 - Critical (9.1)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73924 - Critical (9.1)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73921 - Critical (9.8)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73921/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73921 - Critical (9.8)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73921/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73938 - High (7.5)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73938 - High (7.5)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71176 - High (8.8)

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulner...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71176/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71176 - High (8.8)

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulner...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71176/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71961 - High (8.8)

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command inte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71961 - High (8.8)

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command inte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-58562 - Dell Command Update <5.7.1 missing authorization. Local attacker can gain unauthorized access. CVSS 7.3. No patch yet - restrict local access and monitor. #CVE #Dell #infosec

https://www.valtersit.com/cve/CVE-2026-58562/

CVE-2026-76219 - Arbitrary file overwrite in GitPython before 3.1.58 via IndexFile methods. Inject --index-output to clobber files. CVSS 8.1. Unpatched - update or mitigate now. #CVE #GitPython #infosec

https://www.valtersit.com/cve/CVE-2026-76219/

🟠 CVE-2026-76234 - High (7.5)

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for im...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76234/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76234 - High (7.5)

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for im...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76234/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-73390 - Unauthenticated Privilege Escalation in Total Donations <=2.0.5. CVSS 9.8. Unpatched. Disable now. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-73390/

CVE-2026-67364 (CVSS 10): CRITICAL pre-auth PHP code injection in Balbooa Forms for Joomla (v1.0.0 – 2.4.3.1). Exploitable via unescaped query param in custom-PHP handler. Update to 2.4.3.2+ now. https://radar.offseq.com/threat/cve-2026-67364-cwe-94-improper-control-of-generation-of-code-code-injection-in-balbooacom-balbooa-36f88c0efc17ca75 #OffSeq #Joomla #CVE202667364 #WebSecurity

CVE-2026-67364 (CVSS 10): CRITICAL pre-auth PHP code injection in Balbooa Forms for Joomla (v1.0.0 – 2.4.3.1). Exploitable via unescaped query param in custom-PHP handler. Update to 2.4.3.2+ now. https://radar.offseq.com/threat/cve-2026-67364-cwe-94-improper-control-of-generation-of-code-code-injection-in-balbooacom-balbooa-36f88c0efc17ca75 #OffSeq #Joomla #CVE202667364 #WebSecurity

🟠 CVE-2026-73937 - High (8.2)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73937/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73937 - High (8.2)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73937/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73935 - High (7.5)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73935/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73935 - High (7.5)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73935/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73939 - High (8.6)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73939 - High (8.6)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73922 - Critical (9.1)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73922 - Critical (9.1)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73936 - High (7.5)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73936/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73936 - High (7.5)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73936/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73930 - Critical (9.9)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73930/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-73930 - Critical (9.9)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73930/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/9]

Most Impactful Security Incidents ( 2026‑08‑18 → 2026‑08‑19 )

---

PRIORITY 1 – Critical / High‑Severity Flaws (CVSS 7‑10):

CVE‑2026‑60392
• 7.8 (HIGH)
• Oracle Outside In Technology – PDF Export SDK (Fusion Middleware)
• Local‑privilege escalation; requires attacker to have a logon on the host where the SDK runs. Successful exploitation can lead to full takeover of the component.
• 8.5.8
• Easily exploitable (local) – requires user interaction.
• https://cveawg.mitre.org/api/cve/CVE-2026-60392

CVE‑2026‑60782
• 9.8 (CRITICAL)
• Oracle Payments (E‑Business Suite) – File Transmission
• Remote unauthenticated attacker can compromise the Payments module via HTTP. Leads to full takeover of the Payments service.
• 12.2.3‑12.2.15
• Network‑accessible, no authentication required.
• https://cveawg.mitre.org/api/cve/CVE-2026-60782

CVE‑2026‑60730
• 9.9 (CRITICAL)
• Oracle WebCenter Portal – Composer component
• Remote unauthenticated attacker can compromise the portal via HTTP. Full takeover of the portal.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60730

CVE‑2026‑60728
• 9.1 (CRITICAL)
• Oracle WebCenter Portal – Portlet Services
• Remote unauthenticated attacker can cause denial‑of‑service and full compromise of portal data.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60728

CVE‑2026‑60727
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can take over the IAM system via HTTP.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60727

CVE‑2026‑60721
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Same vector as above; full takeover possible.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60721

CVE‑2026‑60720
• 9.9 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can compromise the IAM system.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60720

#infosecnews

🟠 CVE-2026-73934 - High (7.5)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73934/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73934 - High (7.5)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73934/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-15780 - Stored XSS in WP Statistics plugin ≤14.16.8 via utm_campaign param. Unauthenticated payload injection. CVSS 7.2. Unpatched - update/disable now. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-15780/

UTT HiPER 1250GW v3.2.7-210907-180535 hit by CRITICAL stack-based buffer overflow (CVE-2026-76004) in HTTP handler. Exploitable via 'pvid' arg. No patch yet — restrict remote access & monitor traffic. https://radar.offseq.com/threat/cve-2026-76004-stack-based-buffer-overflow-in-utt-hiper-1250gw-976b1783bc5dbe2e #OffSeq #CVE202676004 #Vuln #Infosec

🔴 CVE-2026-76004 - Critical (9.9)

A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argumen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76004/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

UTT HiPER 1250GW v3.2.7-210907-180535 hit by CRITICAL stack-based buffer overflow (CVE-2026-76004) in HTTP handler. Exploitable via 'pvid' arg. No patch yet — restrict remote access & monitor traffic. https://radar.offseq.com/threat/cve-2026-76004-stack-based-buffer-overflow-in-utt-hiper-1250gw-976b1783bc5dbe2e #OffSeq #CVE202676004 #Vuln #Infosec

🔴 CVE-2026-76004 - Critical (9.9)

A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argumen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76004/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75936 - High (7.5)

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75936/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75936 - High (7.5)

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75936/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73931 - High (8.3)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73931 - High (8.3)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76050 – SQLi in SourceCodester Simple Online Food Ordering System 1.0 via /admin/ajax.php?action=delete_menu. CVSS 7.3. Unpatched. Patch/update immediately. #CVE #infosec #cybersecurity

https://www.valtersit.com/cve/CVE-2026-76050/

CVE-2026-76049 - SQLi in SourceCodester Simple Online Food Ordering System 1.0 via /admin/ajax.php. Remote exploit public, unpatched. CVSS 7.3. Update or isolate now. #CVE #infosec #SQLi

https://www.valtersit.com/cve/CVE-2026-76049/

🟠 CVE-2026-19942 - High (8.1)

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (repla...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19942 - High (8.1)

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (repla...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-70408 - High (8.8)

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-70408/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-70408 - High (8.8)

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-70408/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76008 - Critical (10)

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76008/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Comfast CF-N1-S v2.6.0.1 hit by CRITICAL CVE-2026-76008: stack-based buffer overflow in /cgi-bin/mbox-config (get_para_from_uri). Remote exploitation risk; mitigation unavailable. Monitor for patches. #OffSeq #CVE202676008 #IoTSecurity https://radar.offseq.com/threat/cve-2026-76008-stack-based-buffer-overflow-in-comfast-cf-n1-s-3ceda49f6d8d37d6

🔴 CVE-2026-76008 - Critical (10)

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76008/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Comfast CF-N1-S v2.6.0.1 hit by CRITICAL CVE-2026-76008: stack-based buffer overflow in /cgi-bin/mbox-config (get_para_from_uri). Remote exploitation risk; mitigation unavailable. Monitor for patches. #OffSeq #CVE202676008 #IoTSecurity https://radar.offseq.com/threat/cve-2026-76008-stack-based-buffer-overflow-in-comfast-cf-n1-s-3ceda49f6d8d37d6

CVE-2026-76003 (CRITICAL): Stack-based buffer overflow in UTT HiPER 1200GW (2.5.3-170306). Remote code execution possible via timestart argument; public exploit exists. No patch yet. Restrict access & monitor. https://radar.offseq.com/threat/cve-2026-76003-stack-based-buffer-overflow-in-utt-hiper-1200gw-f42b168f89ef1ec7 #OffSeq #CVE202676003 #infosec #vuln

🔴 CVE-2026-76003 - Critical (9.9)

A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76003/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-76003 (CRITICAL): Stack-based buffer overflow in UTT HiPER 1200GW (2.5.3-170306). Remote code execution possible via timestart argument; public exploit exists. No patch yet. Restrict access & monitor. https://radar.offseq.com/threat/cve-2026-76003-stack-based-buffer-overflow-in-utt-hiper-1200gw-f42b168f89ef1ec7 #OffSeq #CVE202676003 #infosec #vuln

🔴 CVE-2026-76003 - Critical (9.9)

A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76003/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

A Confluence vulnerability, CVE-2026-21580, is a stored XSS flaw (CVSS 8.6) allowing unauthenticated attacks. A Jira flaw also patched. Update now.

#Atlassian #Confluence #CVE202621580 #StoredXSS #Jira #InfoSec

https://securityonline.info/confluence-vulnerability-cve-2026-21580/?utm_source=mastodon&utm_medium=jetpack_social

A Confluence vulnerability, CVE-2026-21580, is a stored XSS flaw (CVSS 8.6) allowing unauthenticated attacks. A Jira flaw also patched. Update now.

#Atlassian #Confluence #CVE202621580 #StoredXSS #Jira #InfoSec

https://securityonline.info/confluence-vulnerability-cve-2026-21580/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-66602 - High (8.8)

Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery.

This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66602/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66602 - High (8.8)

Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery.

This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66602/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75976 - Critical (9.9)

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan_l2tp_password causes stack-based buffer overflow. The attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Stack-based buffer overflow (CVE-2026-75976, CVSS 9.4) in TRENDnet TEW-823DRU 1.1.02b01: remote exploitation possible via /cgi-bin/wan.cgi. Public exploit exists. Assess exposure & monitor for patches: https://radar.offseq.com/threat/cve-2026-75976-stack-based-buffer-overflow-in-trendnet-tew-823dru-3e76dd1e5f15fcab #OffSeq #Vulnerability #Infosec #IoTSecurity

🔴 CVE-2026-75976 - Critical (9.9)

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan_l2tp_password causes stack-based buffer overflow. The attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Stack-based buffer overflow (CVE-2026-75976, CVSS 9.4) in TRENDnet TEW-823DRU 1.1.02b01: remote exploitation possible via /cgi-bin/wan.cgi. Public exploit exists. Assess exposure & monitor for patches: https://radar.offseq.com/threat/cve-2026-75976-stack-based-buffer-overflow-in-trendnet-tew-823dru-3e76dd1e5f15fcab #OffSeq #Vulnerability #Infosec #IoTSecurity

[1/9]

Most Impactful Security Incidents ( 2026‑08‑18 → 2026‑08‑19 )

---

PRIORITY 1 – Critical / High‑Severity Flaws (CVSS 7‑10):

CVE‑2026‑60392
• 7.8 (HIGH)
• Oracle Outside In Technology – PDF Export SDK (Fusion Middleware)
• Local‑privilege escalation; requires attacker to have a logon on the host where the SDK runs. Successful exploitation can lead to full takeover of the component.
• 8.5.8
• Easily exploitable (local) – requires user interaction.
• https://cveawg.mitre.org/api/cve/CVE-2026-60392

CVE‑2026‑60782
• 9.8 (CRITICAL)
• Oracle Payments (E‑Business Suite) – File Transmission
• Remote unauthenticated attacker can compromise the Payments module via HTTP. Leads to full takeover of the Payments service.
• 12.2.3‑12.2.15
• Network‑accessible, no authentication required.
• https://cveawg.mitre.org/api/cve/CVE-2026-60782

CVE‑2026‑60730
• 9.9 (CRITICAL)
• Oracle WebCenter Portal – Composer component
• Remote unauthenticated attacker can compromise the portal via HTTP. Full takeover of the portal.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60730

CVE‑2026‑60728
• 9.1 (CRITICAL)
• Oracle WebCenter Portal – Portlet Services
• Remote unauthenticated attacker can cause denial‑of‑service and full compromise of portal data.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60728

CVE‑2026‑60727
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can take over the IAM system via HTTP.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60727

CVE‑2026‑60721
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Same vector as above; full takeover possible.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60721

CVE‑2026‑60720
• 9.9 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can compromise the IAM system.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60720

#infosecnews

[1/9]

Most Impactful Security Incidents ( 2026‑08‑18 → 2026‑08‑19 )

---

PRIORITY 1 – Critical / High‑Severity Flaws (CVSS 7‑10):

CVE‑2026‑60392
• 7.8 (HIGH)
• Oracle Outside In Technology – PDF Export SDK (Fusion Middleware)
• Local‑privilege escalation; requires attacker to have a logon on the host where the SDK runs. Successful exploitation can lead to full takeover of the component.
• 8.5.8
• Easily exploitable (local) – requires user interaction.
• https://cveawg.mitre.org/api/cve/CVE-2026-60392

CVE‑2026‑60782
• 9.8 (CRITICAL)
• Oracle Payments (E‑Business Suite) – File Transmission
• Remote unauthenticated attacker can compromise the Payments module via HTTP. Leads to full takeover of the Payments service.
• 12.2.3‑12.2.15
• Network‑accessible, no authentication required.
• https://cveawg.mitre.org/api/cve/CVE-2026-60782

CVE‑2026‑60730
• 9.9 (CRITICAL)
• Oracle WebCenter Portal – Composer component
• Remote unauthenticated attacker can compromise the portal via HTTP. Full takeover of the portal.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60730

CVE‑2026‑60728
• 9.1 (CRITICAL)
• Oracle WebCenter Portal – Portlet Services
• Remote unauthenticated attacker can cause denial‑of‑service and full compromise of portal data.
• 12.2.1.4.0, 14.1.2.0.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60728

CVE‑2026‑60727
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can take over the IAM system via HTTP.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60727

CVE‑2026‑60721
• 9.8 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Same vector as above; full takeover possible.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60721

CVE‑2026‑60720
• 9.9 (CRITICAL)
• Oracle Identity Manager – OIM Legacy UI
• Remote unauthenticated attacker can compromise the IAM system.
• 12.2.1.4.0, 14.1.2.1.0
• Network‑accessible, no auth.
• https://cveawg.mitre.org/api/cve/CVE-2026-60720

#infosecnews

🔴 CVE-2026-75877 - Critical (9.9)

A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged/websCheckRealm/FUN_00432574/FUN_0043372C of the component alphapd. Executing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75877/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75877 - Critical (9.9)

A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged/websCheckRealm/FUN_00432574/FUN_0043372C of the component alphapd. Executing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75877/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47629 - High (7.5)

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47629/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has new advisories addressing two vulnerabilities:

- NVIDIA Cumulus Linux and NVOS - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5817

- CRITICAL, affecting the following: CVE-2026-47627, CVE-2026-47628, CVE-2026-47629, CVE-2026-47606, CVE-2026-47630

NVIDIA Triton Inference Server - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5865 #Nvidia #infosec #vulnerability #Linux

🟠 CVE-2026-47629 - High (7.5)

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47629/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has new advisories addressing two vulnerabilities:

- NVIDIA Cumulus Linux and NVOS - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5817

- CRITICAL, affecting the following: CVE-2026-47627, CVE-2026-47628, CVE-2026-47629, CVE-2026-47606, CVE-2026-47630

NVIDIA Triton Inference Server - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5865 #Nvidia #infosec #vulnerability #Linux

Nvidia has new advisories addressing two vulnerabilities:

- NVIDIA Cumulus Linux and NVOS - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5817

- CRITICAL, affecting the following: CVE-2026-47627, CVE-2026-47628, CVE-2026-47629, CVE-2026-47606, CVE-2026-47630

NVIDIA Triton Inference Server - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5865 #Nvidia #infosec #vulnerability #Linux

Nvidia has new advisories addressing two vulnerabilities:

- NVIDIA Cumulus Linux and NVOS - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5817

- CRITICAL, affecting the following: CVE-2026-47627, CVE-2026-47628, CVE-2026-47629, CVE-2026-47606, CVE-2026-47630

NVIDIA Triton Inference Server - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5865 #Nvidia #infosec #vulnerability #Linux

NVIDIA Triton vulnerability CVE-2026-47627 scores CVSS 9.8. Learn how the denial of service flaw works and why you must update to version 26.06 now.

#NVIDIA #TritonInferenceServer #CVE202647627 #DenialOfService #AIsecurity #CVSS

https://securityonline.info/nvidia-triton-vulnerability-cve-2026-47627/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-47627 - Critical (9.8)

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47627/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has new advisories addressing two vulnerabilities:

- NVIDIA Cumulus Linux and NVOS - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5817

- CRITICAL, affecting the following: CVE-2026-47627, CVE-2026-47628, CVE-2026-47629, CVE-2026-47606, CVE-2026-47630

NVIDIA Triton Inference Server - August 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5865 #Nvidia #infosec #vulnerability #Linux