🟠 CVE-2026-5278 - High (8.8)

Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5278 - High (8.8)

Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5281 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Google on Tuesday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild.

https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html

CVE-2026-5281 (Use after free in Dawn) included with this is a zero day

Amongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.

Amongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.

Upstream release notes have been published. This release includes fixes for 21 CVES. Google is aware that an exploit for CVE-2026-5281 exists in the wild. chromereleases.googleblog.com/2026/03/stab...

RE: https://bsky.app/profile/did:plc:6ol7vfhxcbk3ylrlbbioxlav/post/3mifg4rzfh22x

Stable Channel Update for Desk...

🟠 CVE-2026-5281 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-5281 (Use after free in Dawn) included with this is a zero day

Amongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.

Amongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.

Upstream release notes have been published. This release includes fixes for 21 CVES. Google is aware that an exploit for CVE-2026-5281 exists in the wild. chromereleases.googleblog.com/2026/03/stab...

RE: https://bsky.app/profile/did:plc:6ol7vfhxcbk3ylrlbbioxlav/post/3mifg4rzfh22x

Stable Channel Update for Desk...

🟠 CVE-2026-5284 - High (7.5)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5284 - High (7.5)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5292 - High (8.8)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5292 - High (8.8)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5288 - Critical (9.6)

Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5288 - Critical (9.6)

Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5289 - Critical (9.6)

Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5289 - Critical (9.6)

Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5290 - Critical (9.6)

Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5290 - Critical (9.6)

Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5277 - High (7.5)

Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5277 - High (7.5)

Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5275 - High (8.8)

Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5275 - High (8.8)

Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5274 - High (8.8)

Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5274 - High (8.8)

Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5272 - High (8.8)

Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5272/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5272 - High (8.8)

Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5272/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5282 - High (8.1)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5282 - High (8.1)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5087 - High (7.5)

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.

PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5087/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5087 - High (7.5)

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.

PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5087/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4748 - High (7.5)

A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4748 - High (7.5)

A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3308 - High (7.8)

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds writ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3308/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3308 - High (7.8)

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds writ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3308/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34430 - High (8.8)

ByteDance Deer-Flow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34430/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34430 - High (8.8)

ByteDance Deer-Flow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34430/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33373 - High (8.8)

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state tr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33373 - High (8.8)

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state tr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-29014 - Critical (9.8)

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-29014 - Critical (9.8)

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15484 - Critical (9.1)

The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15484 - Critical (9.1)

The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-2696: HIGH severity flaw in Export All URLs WP plugin (<5.1) leaks private post URLs via brute-forcible CSV files in uploads/. No auth needed. Upgrade ASAP & restrict dir access! https://radar.offseq.com/threat/cve-2026-2696-cwe-200-information-exposure-in-expo-c6c7420f #OffSeq #WordPress #CVE20262696

🚨 CVE-2026-2696: HIGH severity flaw in Export All URLs WP plugin (<5.1) leaks private post URLs via brute-forcible CSV files in uploads/. No auth needed. Upgrade ASAP & restrict dir access! https://radar.offseq.com/threat/cve-2026-2696-cwe-200-information-exposure-in-expo-c6c7420f #OffSeq #WordPress #CVE20262696

🟠 CVE-2026-5286 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-5286: HIGH severity use-after-free in Chrome’s Dawn component <146.0.7680.178. Remote code execution possible via crafted HTML. Patch now to stay protected! https://radar.offseq.com/threat/cve-2026-5286-use-after-free-in-google-chrome-34aabe80 #OffSeq #Chrome #Vuln #InfoSec

🟠 CVE-2026-5286 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-5286: HIGH severity use-after-free in Chrome’s Dawn component <146.0.7680.178. Remote code execution possible via crafted HTML. Patch now to stay protected! https://radar.offseq.com/threat/cve-2026-5286-use-after-free-in-google-chrome-34aabe80 #OffSeq #Chrome #Vuln #InfoSec

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4851 - Critical (9.8)

GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization.

GRID::Machine provides Remote Procedure Calls (RPC) over SSH for Perl. The client connects to remote hosts to execute code on them. A compro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4851/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747) - https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#hackernews

Wow, #Claude, you wrote a remote kernel #RCE with a root shell for FreeBSD? 🙄 I’m sure this groundbreaking achievement will be a thrilling bedtime story for security experts everywhere. 🤦‍♂️ Meanwhile, GitHub is still doing cartwheels about #AI writing better code so we can break it even faster. 💥
https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md #FreeBSD #cybersecurity #coding #HackerNews #ngated

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#HackerNews #FreeBSD #RCE #Security #CVE-2026-4747 #RootShell #CyberSecurity

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#freebsd #github

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

Wow, #Claude, you wrote a remote kernel #RCE with a root shell for FreeBSD? 🙄 I’m sure this groundbreaking achievement will be a thrilling bedtime story for security experts everywhere. 🤦‍♂️ Meanwhile, GitHub is still doing cartwheels about #AI writing better code so we can break it even faster. 💥
https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md #FreeBSD #cybersecurity #coding #HackerNews #ngated

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#HackerNews #FreeBSD #RCE #Security #CVE-2026-4747 #RootShell #CyberSecurity

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#freebsd #github

@AmenZwa
MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)
https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747) https://lobste.rs/s/hsykbh #freebsd #security #vibecoding
https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747) https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

Claude Wrote a Full #FreeBSD Remote Kernel #RCE with Root Shell (CVE-2026-4747): https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

🔴 CVE-2026-2275 - Critical (9.6)

The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function calling.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29924 - High (7.6)

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29953 - High (7.5)

SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert function in file plugins/postgres/lib/column.go.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29953/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29954 - High (7.6)

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More cr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29954/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34714 - Critical (9.2)

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34714/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34714 - Critical (9.2)

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34714/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3502 - High (7.8)

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3502/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3502 - High (7.8)

TrueConf Client downloads application update code and applies it without performing verification. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3502/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3991 - High (7.8)

Symantec Data Loss Prevention Windows Endpoint, prior to 25.1 MP1, 16.1 MP2, 16.0 RU2 HF9, 16.0 RU1 MP1 HF12, and 16.0 MP2 HF15, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3991/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4046 - High (7.5)

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4046/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33030 - High (8.8)

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33030/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 New security advisory:

CVE-2026-34361 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-34361-hapi-fhir-auth-token-theft

#Cybersecurity #VulnerabilityManagement #CyberSec

🔴 CVE-2026-34361 - Critical (9.3)

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34361/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 New security advisory:

CVE-2026-34156 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-34156-nocobase-rce

#Cybersecurity #VulnerabilityManagement #CyberSec

🔴 CVE-2026-34156 - Critical (9.9)

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34156/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30282 - Critical (9)

An arbitrary file overwrite vulnerability in UXGROUP LLC Cast to TV Screen Mirroring v2.2.77 allows attackers to overwrite critical internal files via the file import process, leading to arbtrary code execution or information exposure.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24154 - High (7.6)

NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24154/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24154 - High (7.6)

NVIDIA Jetson Linux has vulnerability in initrd, where an unprivileged attacker with physical access coul inject incorrect command line arguments. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24154/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24164 - High (8.8)

NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24164/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34243 - Critical (9.8)

wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34243/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34243 - Critical (9.8)

wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34243/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30309 - High (7.8)

InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism completely ineffective. The predefined blocklist fails to cover native high-risk commands in Windows PowerSh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30309/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29870 - High (7.6)

A directory traversal vulnerability in the agentic-context-engine project versions up to 0.7.1 allows arbitrary file writes via the checkpoint_dir parameter in OfflineACE.run. The save_to_file method in ace/skillbook.py fails to normalize or valid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29870/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33578 - Critical (9.8)

OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33578/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33578 - Critical (9.8)

OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33578/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34240 - High (7.5)

JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34240/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33577 - Critical (9.8)

OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validation in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33577/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33580 - Critical (9.8)

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33580/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34209 - High (7.5)

mppx is a TypeScript interface for machine payments protocol. Prior to version 0.4.11, the tempo/session cooperative close handler validated the close voucher amount using "&lt;&quot; instead of &quot;&lt;=&quot; against the on-chain settled amoun...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34209/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34503 - High (7.5)

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34503/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32917 - Critical (9.8)

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32917/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34505 - Critical (9.8)

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34505/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34505 - Critical (9.8)

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34505/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32982 - High (7.5)

OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are em...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5201 - High (7.5)

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5201/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5201 - High (7.5)

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5201/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-10553 - High (8.7)

A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-10553/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-34558 in ci4ms (<0.31.0.0) — Stored DOM XSS in Methods Management lets attackers inject persistent JS into admin panels. Patch to 0.31.0.0+ ASAP! Details: https://radar.offseq.com/threat/cve-2026-34558-cwe-79-improper-neutralization-of-i-198231a4 #OffSeq #XSS #Vuln #AppSec

🔴 CVE-2026-34558 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Me...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34558 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Me...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-21861: CRITICAL OS command injection in baserCMS < 5.2.3. Admins can execute arbitrary system commands via core update. Patch to 5.2.3+ ASAP to prevent full compromise. https://radar.offseq.com/threat/cve-2026-21861-cwe-78-improper-neutralization-of-s-7b86deef #OffSeq #baserCMS #CVE2026_21861 #infosec #patching

🔴 CVE-2026-21861 - Critical (9.1)

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to im...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

baserCMS < 5.2.3 hit by CRITICAL OS command injection (CVE-2026-30880, CVSS 9.2). Remote unauthenticated RCE possible via installer. Patch to 5.2.3+ now or restrict installer access! https://radar.offseq.com/threat/cve-2026-30880-cwe-78-improper-neutralization-of-s-5ac38c48 #OffSeq #baserCMS #Vuln #infosec

🟠 CVE-2026-34040 - High (8.8)

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34040/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32727 - High (8.1)

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended director...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32727/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32716 - High (8.1)

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /joh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32716/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34054 - High (7.8)

vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patche...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34054/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34042 - High (8.2)

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the inte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-32957 - High (8.7)

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-32957/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-4257 in Contact Form by Supsystic (all versions) enables unauth RCE via SSTI (Twig). No patch yet. Disable plugin or block endpoints ASAP. Details: https://radar.offseq.com/threat/cve-2026-4257-cwe-94-improper-control-of-generatio-c9e2f160 #OffSeq #WordPress #CVE20264257 #SSTI #RCE

🔴 CVE-2026-4257 - Critical (9.8)

The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_St...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4257/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5130 - High (8.8)

The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due to the plugin accepting the wp_debug_troubleshoot_simulate_user cookie value directly as ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5130/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5155 - High (8.8)

A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function fromAdvSetWan of the file /goform/AdvSetWan of the component Parameter Handler. The manipulation of the argument wanmode results in stack-based buffer overflow. The attack ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32877 - High (8.2)

Botan is a C++ cryptography library. From version 2.3.0 to before version 3.11.0, during SM2 decryption, the code that checked the authentication code value (C3) failed to check that the encoded value was of the expected length prior to comparison...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32877/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Authentication Bypass in Anritsu Remote Spectrum Monitors Left Unpatched

CISA and Anritsu report a critical authentication bypass vulnerability (CVE-2026-3356) affecting all versions of its Remote Spectrum Monitors, which the company does not plan to patch. The flaw allows unauthenticated remote attackers to take full control of the devices, potentially disrupting critical communications and defense infrastructure.

**Since Anritsu will not patch this critical flaw, these devices are permanently insecure. Make sure to isolate them from the internet and all untrusted networks. Ideally, consider replacing them with hardware that supports modern authentication standards because no isolation is perfect.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-in-anritsu-remote-spectrum-monitors-left-unpatched-d-4-h-z-o/gD2P6Ple2L

⚡️ CVE-2026-3356 (CVSS 9.3): Anritsu MS27100A lacks authentication for management — remote attackers can access & control all versions. No patch yet. Urgent: segment networks & restrict access! https://radar.offseq.com/threat/cve-2026-3356-cwe-306-missing-authentication-for-c-80869dad #OffSeq #CVE20263356 #IoTSecurity #Infosec

Critical Authentication Bypass in Anritsu Remote Spectrum Monitors Left Unpatched

CISA and Anritsu report a critical authentication bypass vulnerability (CVE-2026-3356) affecting all versions of its Remote Spectrum Monitors, which the company does not plan to patch. The flaw allows unauthenticated remote attackers to take full control of the devices, potentially disrupting critical communications and defense infrastructure.

**Since Anritsu will not patch this critical flaw, these devices are permanently insecure. Make sure to isolate them from the internet and all untrusted networks. Ideally, consider replacing them with hardware that supports modern authentication standards because no isolation is perfect.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-in-anritsu-remote-spectrum-monitors-left-unpatched-d-4-h-z-o/gD2P6Ple2L

⚡️ CVE-2026-3356 (CVSS 9.3): Anritsu MS27100A lacks authentication for management — remote attackers can access & control all versions. No patch yet. Urgent: segment networks & restrict access! https://radar.offseq.com/threat/cve-2026-3356-cwe-306-missing-authentication-for-c-80869dad #OffSeq #CVE20263356 #IoTSecurity #Infosec

Critical Authentication Bypass in PX4 Autopilot Allows Remote Drone Takeover

PX4 Autopilot version v1.16.0 is vulnerable to a critical authentication bypass (CVE-2026-1579) that allows unauthenticated attackers to execute arbitrary shell commands via the MAVLink protocol. This flaw enables full system takeover of drones and autonomous vehicles used in defense and transportation.

**If you use PX4 Autopilot, you must enable MAVLink 2.0 message signing to prevent unauthorized command execution. Without this cryptographic check, anyone who can reach your drone's communication interface can take full control of the aircraft.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-in-px4-autopilot-allows-remote-drone-takeover-h-o-k-m-n/gD2P6Ple2L

🔴 CVE-2026-1579 - Critical (9.8)

The MAVLink communication protocol does not require cryptographic
authentication by default. When MAVLink 2.0 message signing is not
enabled, any message -- including SERIAL_CONTROL, which provides
interactive shell access -- can be sent by an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1579/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-1579 (CRITICAL): PX4 Autopilot v1.16.0 SITL allows unauthenticated MAVLink commands — attackers can gain shell access if message signing is disabled. Enable MAVLink 2.0 signing now! https://radar.offseq.com/threat/cve-2026-1579-cwe-306-in-px4-autopilot-77f763f3 #OffSeq #CVE20261579 #DroneSec #Security

Critical Authentication Bypass in PX4 Autopilot Allows Remote Drone Takeover

PX4 Autopilot version v1.16.0 is vulnerable to a critical authentication bypass (CVE-2026-1579) that allows unauthenticated attackers to execute arbitrary shell commands via the MAVLink protocol. This flaw enables full system takeover of drones and autonomous vehicles used in defense and transportation.

**If you use PX4 Autopilot, you must enable MAVLink 2.0 message signing to prevent unauthorized command execution. Without this cryptographic check, anyone who can reach your drone's communication interface can take full control of the aircraft.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-in-px4-autopilot-allows-remote-drone-takeover-h-o-k-m-n/gD2P6Ple2L

🔴 CVE-2026-1579 - Critical (9.8)

The MAVLink communication protocol does not require cryptographic
authentication by default. When MAVLink 2.0 message signing is not
enabled, any message -- including SERIAL_CONTROL, which provides
interactive shell access -- can be sent by an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1579/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-1579 (CRITICAL): PX4 Autopilot v1.16.0 SITL allows unauthenticated MAVLink commands — attackers can gain shell access if message signing is disabled. Enable MAVLink 2.0 signing now! https://radar.offseq.com/threat/cve-2026-1579-cwe-306-in-px4-autopilot-77f763f3 #OffSeq #CVE20261579 #DroneSec #Security

⚠️ CVE-2026-23898: HIGH-severity flaw in Joomla! CMS (4.0.0-5.4.3, 6.0.0-6.0.3) lets admin-level attackers delete arbitrary files, risking DoS or system compromise. Patch ASAP, restrict high-priv accounts, monitor for deletions. https://radar.offseq.com/threat/cve-2026-23898-cwe-73-destructive-file-deletion-an-4b16a48a #OffSeq #Joomla #Vuln

⚠️ CVE-2026-23898: HIGH-severity flaw in Joomla! CMS (4.0.0-5.4.3, 6.0.0-6.0.3) lets admin-level attackers delete arbitrary files, risking DoS or system compromise. Patch ASAP, restrict high-priv accounts, monitor for deletions. https://radar.offseq.com/threat/cve-2026-23898-cwe-73-destructive-file-deletion-an-4b16a48a #OffSeq #Joomla #Vuln

🟠 CVE-2026-5211 - High (8.8)

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 202602...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5211 - High (8.8)

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 202602...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34367 - High (7.6)

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation mod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34367/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34367 - High (7.6)

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation mod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34367/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34381 - High (7.5)

Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34381/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34381 - High (7.5)

Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34381/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34731 - High (7.5)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo on_publish_done.php endpoint in the Live plugin allows unauthenticated users to terminate any active live stream. The endpoint processes RTMP callback events to m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34731/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34731 - High (7.5)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo on_publish_done.php endpoint in the Live plugin allows unauthenticated users to terminate any active live stream. The endpoint processes RTMP callback events to m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34731/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71281 - High (8.8)

XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, potential...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71281 - High (8.8)

XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, potential...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3775 - High (7.8)

The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3775/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3775 - High (7.8)

The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3775/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71278 - High (8.8)

XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond thei...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71278 - High (8.8)

XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond thei...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34453 - High (7.5)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters boo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34453 - High (7.5)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters boo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34585 - High (8.6)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34585/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34585 - High (8.6)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34585/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5190 - High (7.5)

Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted ev...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5190/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34509 - High (7.5)

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty group...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3779 - High (7.8)

The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a use-after-free when the calculation runs and can potentially lead to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3779/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3779 - High (7.8)

The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a use-after-free when the calculation runs and can potentially lead to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3779/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26060 - High (8.8)

Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic could allow previously issued password reset tokens to remain valid after a user changes their password. As a result, a stale ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26060/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13855 - High (7.6)

IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13855/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13855 - High (7.6)

IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13855/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71282 - High (7.5)

XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71282 - High (7.5)

XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71279 - Critical (9.8)

XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromise the security of Passkey-based authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71279 - Critical (9.8)

XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromise the security of Passkey-based authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35056 - High (8.8)

XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35056 - High (8.8)

XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5214 - High (8.8)

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5214 - High (8.8)

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34557 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within group ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34557/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34557 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within group ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34557/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33576 - Critical (9.8)

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rej...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33576/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34449 - Critical (9.6)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-C...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34449/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-34449: CRITICAL RCE in SiYuan (<3.6.2) via permissive CORS. Visiting a malicious site while SiYuan runs allows OS-level code exec. Patch to 3.6.2+ ASAP! https://radar.offseq.com/threat/cve-2026-34449-cwe-942-permissive-cross-domain-pol-0cb7b35e #OffSeq #SiYuan #CVE202634449 #RCE #InfoSec

🔴 CVE-2026-34449 - Critical (9.6)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-C...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34449/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-34449: CRITICAL RCE in SiYuan (<3.6.2) via permissive CORS. Visiting a malicious site while SiYuan runs allows OS-level code exec. Patch to 3.6.2+ ASAP! https://radar.offseq.com/threat/cve-2026-34449-cwe-942-permissive-cross-domain-pol-0cb7b35e #OffSeq #SiYuan #CVE202634449 #RCE #InfoSec

🔴 CVE-2026-34448 - Critical (9)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -> Asset ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34448/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL alert: CVE-2026-34448 in SiYuan (<3.6.2) enables stored XSS, escalating to OS command execution via unsafe Electron configs. Patch to 3.6.2+ & tighten app security! Details: https://radar.offseq.com/threat/cve-2026-34448-cwe-79-improper-neutralization-of-i-36bc82a3 #OffSeq #SiYuan #CVE202634448 #XSS #infosec

🔴 CVE-2026-34448 - Critical (9)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -> Asset ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34448/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL alert: CVE-2026-34448 in SiYuan (<3.6.2) enables stored XSS, escalating to OS command execution via unsafe Electron configs. Patch to 3.6.2+ & tighten app security! Details: https://radar.offseq.com/threat/cve-2026-34448-cwe-79-improper-neutralization-of-i-36bc82a3 #OffSeq #SiYuan #CVE202634448 #XSS #infosec

🟠 CVE-2026-34394 - High (8.1)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34394/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34394 - High (8.1)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34394/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32714 - Critical (9.8)

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (su...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32714/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 CRITICAL: CVE-2026-30877 in baserCMS (<5.2.3) enables admin users to execute arbitrary OS commands via update functionality (CWE-78). Patch to 5.2.3+ immediately! https://radar.offseq.com/threat/cve-2026-30877-cwe-78-improper-neutralization-of-s-36a348b4 #OffSeq #baserCMS #CVE202630877 #infosec

🔴 CVE-2026-30877 - Critical (9.1)

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30877/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30877 - Critical (9.1)

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30877/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3256 - Critical (9.8)

HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids.

HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3256 - Critical (9.8)

HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids.

HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15618 - Critical (9.1)

Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key.

Business::OnlinePayment::StoredTransaction generates a secret key by using a MD5 hash of a single call to the built-in rand function, which is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15618/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5212 - High (8.8)

A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5212 - High (8.8)

A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5213 - High (8.8)

A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5213 - High (8.8)

A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚪️ TP-Link Routers Patched for Critical Authentication Bypass Vulnerability

🗨️ TP-Link has released firmware updates for its Archer NX series routers, fixing several vulnerabilities at once. The most serious issue allowed attackers to upload arbitrary firmware to the device without any authentication. The critical vulnerability has been assigned the identifier…

🔗 https://hackmag.com/news/cve-2025-15517?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

#news

🟠 CVE-2026-3573 - High (7.5)

Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3573/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34214 - High (7.7)

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack