🚨 CRITICAL: CVE-2026-2835 in Cloudflare Pingora enables HTTP request smuggling via improper HTTP/1.0 and Transfer-Encoding handling. Impacts standalone Pingora. Upgrade to v0.8.0+ ASAP! https://radar.offseq.com/threat/cve-2026-2835-cwe-444-inconsistent-interpretation--a3f6db67 #OffSeq #Cloudflare #HTTPsmuggling #infosec

🚨 CRITICAL: CVE-2026-2835 in Cloudflare Pingora enables HTTP request smuggling via improper HTTP/1.0 and Transfer-Encoding handling. Impacts standalone Pingora. Upgrade to v0.8.0+ ASAP! https://radar.offseq.com/threat/cve-2026-2835-cwe-444-inconsistent-interpretation--a3f6db67 #OffSeq #Cloudflare #HTTPsmuggling #infosec

⚠️ CRITICAL: CVE-2026-2833 in Cloudflare Pingora enables HTTP request smuggling — attackers can bypass proxy ACLs/WAFs, poison caches, and hijack sessions. Upgrade to v0.8.0+ or filter Upgrade headers. More info: https://radar.offseq.com/threat/cve-2026-2833-cwe-444-inconsistent-interpretation--c3ebdcf0 #OffSeq #Pingora #Vuln

⚠️ CRITICAL: CVE-2026-2833 in Cloudflare Pingora enables HTTP request smuggling — attackers can bypass proxy ACLs/WAFs, poison caches, and hijack sessions. Upgrade to v0.8.0+ or filter Upgrade headers. More info: https://radar.offseq.com/threat/cve-2026-2833-cwe-444-inconsistent-interpretation--c3ebdcf0 #OffSeq #Pingora #Vuln

🚨 CRITICAL: pac4j-jwt (pre-4.5.9/5.7.9/6.3.3) vulnerable to auth bypass (CVE-2026-29000). Attackers w/ RSA public key can forge JWTs, impersonate any user. Patch now & audit JWT usage! https://radar.offseq.com/threat/cve-2026-29000-cwe-347-improper-verification-of-cr-c33a53b1 #OffSeq #CVE202629000 #JWT #Security

🚨 CRITICAL: pac4j-jwt (pre-4.5.9/5.7.9/6.3.3) vulnerable to auth bypass (CVE-2026-29000). Attackers w/ RSA public key can forge JWTs, impersonate any user. Patch now & audit JWT usage! https://radar.offseq.com/threat/cve-2026-29000-cwe-347-improper-verification-of-cr-c33a53b1 #OffSeq #CVE202629000 #JWT #Security

🔴 CVE-2025-70240 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard51.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70240/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70240 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard51.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70240/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24848 - Critical (9.9)

OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument() method in EtherFaxActions.php allows authenticated users to write arbitrary content to arbitrary l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24848/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24848 - Critical (9.9)

OpenEMR is a free and open source electronic health records and medical practice management application. In 7.0.4 and earlier, the disposeDocument() method in EtherFaxActions.php allows authenticated users to write arbitrary content to arbitrary l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24848/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24898 - Critical (10)

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0, an unauthenticated token disclosure vulnerability in the MedEx callback endpoint allows any unauthenticated visitor to obtain ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24898/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70236 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDomainFilter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70236/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70236 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetDomainFilter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70236/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0847 - High (8.6)

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to prop...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0847/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0847 - High (8.6)

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to prop...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0847/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70223 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70223/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70223 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70223/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70220 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN_wizard4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70220/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70220 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN_wizard4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70220/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Security-focused update: changedetection.io v0.54.4 is here! 🛡️

This release is a must-have, patching critical vulnerabilities like Reflected XSS, Arbitrary File Read via XPath, and backup security flaws like 'zip slip' (CVE-2026-29038, CVE-2026-29065).

It also adds support for Python 3.14. 🐍

Release details: https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4
Run it on PikaPods: https://pikapods.com/pods?run=changedetection

#opensource #infosec #selfhosted

🔴 CVE-2025-70239 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard55.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70239/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70239 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWAN_Wizard55.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70239/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical MS-Agent Vulnerability Allows Full System Takeover via AI Prompt Injection

ModelScope's MS-Agent framework contains a critical command injection vulnerability (CVE-2026-2256) that allows attackers to execute arbitrary system commands via malicious AI prompts.

**If you are using ModelScope's MS-Agent, this is important and urgent. There's a critical command injection flaw, a public PoC and no patch. Isolate the system as much as possible and until a patch is released, disable the Shell tool or implement strict command allowlists to prevent remote code execution. Treat AI agents with shell access as high-risk assets and isolate them in sandboxed environments.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-ms-agent-vulnerability-allows-full-system-takeover-via-ai-prompt-injection-r-f-r-o-w/gD2P6Ple2L

Security-focused update: changedetection.io v0.54.4 is here! 🛡️

This release is a must-have, patching critical vulnerabilities like Reflected XSS, Arbitrary File Read via XPath, and backup security flaws like 'zip slip' (CVE-2026-29038, CVE-2026-29065).

It also adds support for Python 3.14. 🐍

Release details: https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4
Run it on PikaPods: https://pikapods.com/pods?run=changedetection

#opensource #infosec #selfhosted

🟠 CVE-2026-28518 - High (7.8)

OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP arch...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28518/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25673 - High (7.5)

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.
`URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unico...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3539 - High (8.8)

Object lifecycle issue in DevTools in Google Chrome prior to 145.0.7632.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3539 - High (8.8)

Object lifecycle issue in DevTools in Google Chrome prior to 145.0.7632.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28435 - High (7.5)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (stre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28435/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28435 - High (7.5)

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not enforce Server::set_payload_max_length() on the decompressed request body when using HandlerWithContentReader (stre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28435/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2025 - High (7.5)

The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2025/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2025 - High (7.5)

The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2025/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70341 - High (7.8)

Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70341/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70341 - High (7.8)

Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70341/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70341 - High (7.8)

Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70341/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70341 - High (7.8)

Insecure permissions in App-Auto-Patch v3.4.2 create a race condition which allows attackers to write arbitrary files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70341/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20049 - High (7.7)

A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Softw...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20049 - High (7.7)

A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Softw...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20049 - High (7.7)

A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Softw...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20049 - High (7.7)

A vulnerability in the processing of Galois/Counter Mode (GCM)-encrypted Internet Key Exchange version 2 (IKEv2) IPsec traffic of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Softw...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20103 - High (8.6)

A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20103/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20103 - High (8.6)

A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20103/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20101 - High (8.6)

A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition.

...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20101 - High (8.6)

A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition.

...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20105 - High (7.7)

A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a valid VPN connect...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20105 - High (7.7)

A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a valid VPN connect...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20002 - High (8.1)

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.

This vulnerability is due to inadequate validation of user-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20002/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20002 - High (8.1)

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.

This vulnerability is due to inadequate validation of user-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20002/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20002 - High (8.1)

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.

This vulnerability is due to inadequate validation of user-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20002/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20002 - High (8.1)

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system.

This vulnerability is due to inadequate validation of user-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20002/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20039 - High (8.6)

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20039 - High (8.6)

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20039 - High (8.6)

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20039 - High (8.6)

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20100 - High (7.7)

A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20100 - High (7.7)

A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20100 - High (7.7)

A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20100 - High (7.7)

A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20014 - High (7.7)

A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remote attacker with valid VPN user credentials to cause a DoS condition on an affected device that may also imp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20014 - High (7.7)

A vulnerability in the IKEv2 feature of Cisco Secure Firewall ASA Software and Cisco Secure FTD Software could allow an authenticated, remote attacker with valid VPN user credentials to cause a DoS condition on an affected device that may also imp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20082 - High (8.6)

A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly.

...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20082/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20082 - High (8.6)

A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly.

...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20082/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26478 - Critical (9.8)

A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a specially crafted UDP datagram and execute arbitrary shell code as the root account.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26478/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26478 - Critical (9.8)

A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a specially crafted UDP datagram and execute arbitrary shell code as the root account.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26478/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70237 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetPortTr.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70237/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70237 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetPortTr.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70237/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70234 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetQoS.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70234/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70234 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetQoS.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70234/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70241 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWANType_Wizard5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70241/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70241 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWANType_Wizard5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70241/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26673 - High (7.5)

An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission subsystem

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26673 - High (7.5)

An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission subsystem

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26673 - High (7.5)

An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission subsystem

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26673 - High (7.5)

An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission subsystem

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

💥 Cisco warns of max severity Secure FMC flaws giving root access

｢ Both vulnerabilities can be exploited remotely by unauthenticated attackers: the authentication bypass flaw (CVE-2026-20079) allows attackers to gain root access to the underlying operating system, while the remote code execution (RCE) vulnerability (CVE-2026-20131) lets them execute arbitrary Java code as root on unpatched devices ｣

#cisco #rce #cybersecurity
https://www.bleepingcomputer.com/news/security/cisco-warns-of-max-severity-secure-fmc-flaws-giving-root-access/

yikes.. 50 CVEs for Cisco today incl. two max severity CVE-2026-20131 & CVE-2026-20079 with auth bypass 🫡

https://hecate.pw/vulnerabilities?search=vendors%3A%22Cisco%22%20AND%20published%3A%3E%3D2026-03-04&mode=dql

🚬

#vulnerability #cve #cisco

🔴 CVE-2026-20131 - Critical (10)

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.

This vulnerability is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20131/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Second is CVE-2026-20131: remote code execution in the same product by way of, aww yiss, Java deserialization.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh

Oops.

A long list of Cisco vulnerabilities, two critical, several high-severity.

- Critical: CVE-2026-20079-CWE-288: Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2

- Critical: CVE-2026-20131-CWE-502: Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh

More. Grab a coffee https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #vulnerability #Cisco

@cR0w

💥 Cisco warns of max severity Secure FMC flaws giving root access

｢ Both vulnerabilities can be exploited remotely by unauthenticated attackers: the authentication bypass flaw (CVE-2026-20079) allows attackers to gain root access to the underlying operating system, while the remote code execution (RCE) vulnerability (CVE-2026-20131) lets them execute arbitrary Java code as root on unpatched devices ｣

#cisco #rce #cybersecurity
https://www.bleepingcomputer.com/news/security/cisco-warns-of-max-severity-secure-fmc-flaws-giving-root-access/

yikes.. 50 CVEs for Cisco today incl. two max severity CVE-2026-20131 & CVE-2026-20079 with auth bypass 🫡

https://hecate.pw/vulnerabilities?search=vendors%3A%22Cisco%22%20AND%20published%3A%3E%3D2026-03-04&mode=dql

🚬

#vulnerability #cve #cisco

🔴 CVE-2026-20131 - Critical (10)

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.

This vulnerability is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20131/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Second is CVE-2026-20131: remote code execution in the same product by way of, aww yiss, Java deserialization.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh

Oops.

A long list of Cisco vulnerabilities, two critical, several high-severity.

- Critical: CVE-2026-20079-CWE-288: Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2

- Critical: CVE-2026-20131-CWE-502: Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh

More. Grab a coffee https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #vulnerability #Cisco

@cR0w

💥 Cisco warns of max severity Secure FMC flaws giving root access

｢ Both vulnerabilities can be exploited remotely by unauthenticated attackers: the authentication bypass flaw (CVE-2026-20079) allows attackers to gain root access to the underlying operating system, while the remote code execution (RCE) vulnerability (CVE-2026-20131) lets them execute arbitrary Java code as root on unpatched devices ｣

#cisco #rce #cybersecurity
https://www.bleepingcomputer.com/news/security/cisco-warns-of-max-severity-secure-fmc-flaws-giving-root-access/

yikes.. 50 CVEs for Cisco today incl. two max severity CVE-2026-20131 & CVE-2026-20079 with auth bypass 🫡

https://hecate.pw/vulnerabilities?search=vendors%3A%22Cisco%22%20AND%20published%3A%3E%3D2026-03-04&mode=dql

🚬

#vulnerability #cve #cisco

🔴 CVE-2026-20079 - Critical (10)

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the und...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20079/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

2 perfect 10s from Cisco today! First up, CVE-2026-20079, auth bypass in Cisco Secure Firewall Management, by way of a...rogue process launched at boot?

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2

Oops.

A long list of Cisco vulnerabilities, two critical, several high-severity.

- Critical: CVE-2026-20079-CWE-288: Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2

- Critical: CVE-2026-20131-CWE-502: Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh

More. Grab a coffee https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #vulnerability #Cisco

@cR0w

💥 Cisco warns of max severity Secure FMC flaws giving root access

｢ Both vulnerabilities can be exploited remotely by unauthenticated attackers: the authentication bypass flaw (CVE-2026-20079) allows attackers to gain root access to the underlying operating system, while the remote code execution (RCE) vulnerability (CVE-2026-20131) lets them execute arbitrary Java code as root on unpatched devices ｣

#cisco #rce #cybersecurity
https://www.bleepingcomputer.com/news/security/cisco-warns-of-max-severity-secure-fmc-flaws-giving-root-access/

yikes.. 50 CVEs for Cisco today incl. two max severity CVE-2026-20131 & CVE-2026-20079 with auth bypass 🫡

https://hecate.pw/vulnerabilities?search=vendors%3A%22Cisco%22%20AND%20published%3A%3E%3D2026-03-04&mode=dql

🚬

#vulnerability #cve #cisco

🔴 CVE-2026-20079 - Critical (10)

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the und...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20079/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

2 perfect 10s from Cisco today! First up, CVE-2026-20079, auth bypass in Cisco Secure Firewall Management, by way of a...rogue process launched at boot?

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2

Oops.

A long list of Cisco vulnerabilities, two critical, several high-severity.

- Critical: CVE-2026-20079-CWE-288: Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2

- Critical: CVE-2026-20131-CWE-502: Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh

More. Grab a coffee https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #vulnerability #Cisco

@cR0w

🖲️ #Cybersecurity #Ciberseguridad #Ciberseguranca #Security #Seguridad #Seguranca #News #Noticia #Noticias #Tecnologia #Technology
⚫ Qualcomm Zero-Day Exploited in Targeted Android Attacks
🔗 https://www.darkreading.com/threat-intelligence/qualcomm-zero-day-exploited-targeted-android-attacks

The exploitation activity against CVE-2026-21385, a high-severity memory corruption flaw, could be tied to commercial spyware or nation-state threat groups.

Google notifying Android user of high-severity vuln CVE-2026-21385 and March 2026 security update might work better if that link the "AI Mode" #slopgenerator did not link to December 2025 bulletin.

The exploitation activity against CVE-2026-21385, a high-severity memory corruption flaw, could be tied to commercial spyware or nation-state threat groups. https://www.darkreading.com/threat-intelligence/qualcomm-zero-day-exploited-targeted-android-attacks

Google notifying Android user of high-severity vuln CVE-2026-21385 and March 2026 security update might work better if that link the "AI Mode" #slopgenerator did not link to December 2025 bulletin.

The exploitation activity against CVE-2026-21385, a high-severity memory corruption flaw, could be tied to commercial spyware or nation-state threat groups. https://www.darkreading.com/threat-intelligence/qualcomm-zero-day-exploited-targeted-android-attacks

🚨 [CISA-2026:0303] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0303)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-21385 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21385)
- Name: Qualcomm Multiple Chipsets Memory Corruption Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Qualcomm
- Product: Multiple Chipsets
- Notes: https://source.android.com/docs/security/bulletin/2026/2026-03-01 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21385

⚠️ CVE-2026-22719 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22719)
- Name: Broadcom VMware Aria Operations Command Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Broadcom
- Product: VMware Aria Operations
- Notes: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ; https://knowledge.broadcom.com/external/article/430349 ; https://nvd.nist.gov/vuln/detail/CVE-2026-22719

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260303 #cisa20260303 #cve_2026_21385 #cve_2026_22719 #cve202621385 #cve202622719

CVE ID: CVE-2026-21385
Vendor: Qualcomm
Product: Multiple Chipsets
Date Added: 2026-03-03
Notes: https://source.android.com/docs/security/bulletin/2026/2026-03-01 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21385
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21385

Aggiornamenti Android marzo 2026, corretta una zero-day già sfruttata: cosa fare subito

Google ha rilasciato l’Android Security Bulletin di marzo 2026, il più corposo dell’anno: 129 vulnerabilità corrette di cui una, la CVE-2026-21385...

🔗️ [Cybersecurity360] https://link.is.it/AC1JZ9

Google confirms that the Qualcomm Android vulnerability CVE-2026-21385 was exploited in real-world attacks.
#CVE_2026_21385
https://securityaffairs.com/188823/security/android-devices-hit-by-exploited-qualcomm-flaw-cve-2026-21385.html

Google Android March 2026 Security Bulletin Patches 129 Vulnerabilities, One Actively Exploited Qualcomm Flaw

Google's March 2026 Android Security Bulletin patches 129 vulnerabilities, including a critical RCE flaw (CVE-2026-0006) requiring no user interaction and multiple CVSS 9.0 privilege escalation bugs in the kernel virtualization layer. A Qualcomm Display component vulnerability (CVE-2026-21385) is already being actively exploited in targeted attacks in the wild.

**An critical update for Android, with actively exploited flaw patched. Most users can't rush the patch because their vendors may not have released an updated version of Android for their devices. Do not delay the update to your Android when the you see the alert that an update is available. Your device may be targeted via the Qualcomm flaw.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/march-2026-android-security-bulletin-patches-129-vulnerabilities-one-actively-exploited-qualcomm-flaw-s-u-0-2-i/gD2P6Ple2L

The exploited flaw, tracked as CVE-2026-21385 (CVSS score of 7.8) and impacting the graphics component of over 200 Qualcomm chipsets, is described as an integer overflow or wraparound issue leading to memory corruption while using alignments for memory allocation. https://www.securityweek.com/android-update-patches-exploited-qualcomm-zero-day/

🟠 CVE-2026-21385 - High (7.8)

Memory corruption while using alignments for memory allocation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21385/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3224 - Critical (9.8)

Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3224/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3224 - Critical (9.8)

Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3224/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3224 - Critical (9.8)

Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3224/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3224 - Critical (9.8)

Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3224/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-3224: CRITICAL auth bypass in Devolutions Server <=2025.3.15.0 using Microsoft Entra ID. Attackers can forge JWTs for full access. No known exploits, but patch ASAP & tighten token validation. https://radar.offseq.com/threat/cve-2026-3224-cwe-287-improper-authentication-cwe--6697497e #OffSeq #Vuln #CyberSecurity #JWT

🟠 CVE-2026-26514 - High (7.5)

An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags (e.g., -w, -q) via the q parameter. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26514/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26514 - High (7.5)

An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags (e.g., -w, -q) via the q parameter. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26514/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26514 - High (7.5)

An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags (e.g., -w, -q) via the q parameter. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26514/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26514 - High (7.5)

An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags (e.g., -w, -q) via the q parameter. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26514/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 New security advisory:

CVE-2026-26279 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://yazoul.net/advisory/cve/cve-2026-26279

#Cybersecurity #SecurityPatching #HackerNews

🔴 CVE-2026-26279 - Critical (9.1)

Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3094 - High (7.8)

Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3094/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27012 - Critical (9.8)

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a privilege escalation and authentication bypass vulnerability in OpenSTAManager allows any attacker to arbitrarily change a user's ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27012/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: OpenSTAManager <=2.9.8 hit by CVE-2026-27012 (CVSS 9.8). Unauthenticated users can escalate privileges by altering user group IDs via modules/utenti/actions.php. Restrict access & monitor logs! Details: https://radar.offseq.com/threat/cve-2026-27012-cwe-306-missing-authentication-for--435d22b5 #OffSeq #infosec #CVE202627012

🟠 CVE-2026-27932 - High (7.5)

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27932/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47375 - High (7.8)

Memory corruption while handling different IOCTL calls from the user-space simultaneously.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47375/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47381 - High (7.8)

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47381/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-66945 - Critical (9.1)

A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66945/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-66945 - Critical (9.1)

A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66945/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3485 - Critical (9.8)

A flaw has been found in D-Link DIR-868L 110b03. This affects the function sub_1BF84 of the component SSDP Service. This manipulation of the argument ST causes os command injection. It is possible to initiate the attack remotely. The exploit has b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3485/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-3485 enables remote OS command injection in D-Link DIR-868L (110b03) via SSDP (UPnP). Exploit is public, no patch. Replace or isolate device ASAP — block SSDP, monitor traffic. https://radar.offseq.com/threat/cve-2026-3485-os-command-injection-in-d-link-dir-8-905d15ee #OffSeq #CVE20263485 #RouterSecurity #Vuln

🟠 CVE-2025-66363 - High (7.5)

An issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. There was no check for memory initialization within DL NAS Transport messages.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66363/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-66363 - High (7.5)

An issue was discovered in LBS in Samsung Mobile Processor Exynos 2200. There was no check for memory initialization within DL NAS Transport messages.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66363/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3130 - Critical (9.8)

Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3130/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3130 - Critical (9.8)

Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3130/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2590 - Critical (9.8)

Improper
enforcement of the Disable password saving in vaults setting in the
connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries,
potentiall...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2590 - Critical (9.8)

Improper
enforcement of the Disable password saving in vaults setting in the
connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries,
potentiall...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2590 - Critical (9.8)

Improper
enforcement of the Disable password saving in vaults setting in the
connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries,
potentiall...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2590 - Critical (9.8)

Improper
enforcement of the Disable password saving in vaults setting in the
connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries,
potentiall...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3204 - Critical (9.8)

Improper
input validation in the error message page in Devolutions Server 2025.3.15 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3204 - Critical (9.8)

Improper
input validation in the error message page in Devolutions Server 2025.3.15 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-62814 - High (7.5)

An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, and 2400. A NULL pointer dereference of ft_handle in load_fw_utc_vector() causes a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-62814/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-62814 - High (7.5)

An issue was discovered in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, and 2400. A NULL pointer dereference of ft_handle in load_fw_utc_vector() causes a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-62814/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The recently patched CVE-2026-22719 can be exploited by an unauthenticated attacker for remote code execution. https://www.securityweek.com/vmware-aria-operations-vulnerability-exploited-in-the-wild/

Critical VMware Aria Operations Vulnerability Added to CISA’s Exploited Catalog

A newly identified, actively exploited vulnerability in Broadcom’s VMware Aria Operations (formerly vRealize Operations, vROps) has been flagged as critical by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Tracked as CVE-2026-22719, this flaw allows attackers to execute remote commands on enterprise IT infrastructure, making swift patching a top priority for…

https://undercodenews.com/critical-vmware-aria-operations-vulnerability-added-to-cisas-exploited-catalog/

The recently patched CVE-2026-22719 can be exploited by an unauthenticated attacker for remote code execution. https://www.securityweek.com/vmware-aria-operations-vulnerability-exploited-in-the-wild/

🚨 [CISA-2026:0303] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0303)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-21385 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21385)
- Name: Qualcomm Multiple Chipsets Memory Corruption Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Qualcomm
- Product: Multiple Chipsets
- Notes: https://source.android.com/docs/security/bulletin/2026/2026-03-01 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21385

⚠️ CVE-2026-22719 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-22719)
- Name: Broadcom VMware Aria Operations Command Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Broadcom
- Product: VMware Aria Operations
- Notes: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ; https://knowledge.broadcom.com/external/article/430349 ; https://nvd.nist.gov/vuln/detail/CVE-2026-22719

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260303 #cisa20260303 #cve_2026_21385 #cve_2026_22719 #cve202621385 #cve202622719

CISA flags VMware Aria Operations RCE flaw as exploited in attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a VMware Aria Operations vulnerability tracked as CVE-2026-22719 to its...

🔗️ [Bleepingcomputer] https://link.is.it/bR3nUY

CVE ID: CVE-2026-22719
Vendor: Broadcom
Product: VMware Aria Operations
Date Added: 2026-03-03
Notes: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947 ; https://knowledge.broadcom.com/external/article/430349 ; https://nvd.nist.gov/vuln/detail/CVE-2026-22719
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-22719

🟠 CVE-2025-69765 - High (7.5)

Tenda AX3 firmware v16.03.12.11 contains a stack overflow in formGetIptv function and the list parameter, which can cause memory corruption and enable remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛰️ CRITICAL: CVE-2026-29120 in IDC SFX2100 Satellite Receiver — hardcoded root hash in /root/anaconda-ks.cfg. Local attackers can escalate to root via offline cracking. Restrict access & monitor for abuse. Details: https://radar.offseq.com/threat/cve-2026-29120-cwe-798-use-of-hard-coded-credentia-587f7886 #OffSeq #CVE202629120 #IoTSecurity

⚠️ CVE-2026-1874 (HIGH): Mitsubishi MELSEC iQ-F FX5-ENET/IP modules ≤1.106 vulnerable to unauthenticated UDP-based DoS. No patch yet. Segment networks & monitor UDP traffic. Reset needed to recover. https://radar.offseq.com/threat/cve-2026-1874-cwe-670-always-incorrect-control-flo-ab07aefb #OffSeq #ICS #Infosec #Vulnerability

🔎 CVE-2026-1875 (HIGH, CVSS 8.7) hits all Mitsubishi MELSEC iQ-F FX5-EIP modules. Remote UDP floods cause DoS — no auth needed. Segment networks & monitor UDP traffic. No known exploits, patch when available. https://radar.offseq.com/threat/cve-2026-1875-cwe-404-improper-resource-shutdown-o-290a0193 #OffSeq #ICS #CVE20261875 #OTSecurity

⚠️ CVE-2026-27971: QwikDev qwik <1.19.1 has a CRITICAL RCE flaw via unsafe deserialization in server-side RPC. No auth needed — patch to 1.19.1+ now! Exploits are trivial if require() is exposed. https://radar.offseq.com/threat/cve-2026-27971-cwe-502-deserialization-of-untruste-b59de789 #OffSeq #CVE202627971 #RCE #JavaScript #InfoSec

🔴 CVE-2025-59059 - Critical (9.8)

Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions &lt;= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-59059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-59059 - Critical (9.8)

Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions &lt;= 2.7.0.
Users are recommended to upgrade to version 2.8.0, which fixes this issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-59059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22891 - Critical (9.8)

A heap-based buffer overflow vulnerability exists in the Intan CLP parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted Intan CLP file can lead to arbitrary code execution. An attacker can p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20777 - High (8.1)

A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can prov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20777/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-12345 - High (8.8)

A security vulnerability has been detected in LLM-Claw 0.1.0/0.1.1/0.1.1a/0.1.1a-p1. The affected element is the function agent_deploy_init of the file /agents/deploy/initiate.c of the component Agent Deployment. Such manipulation leads to buffer ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12345/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Issue with AWS-LC: an open-source, general-purpose cryptographic library (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338)

Bulletin ID: 2026-005-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/03/02 14:30 PM PST
Description:
AWS-LC is an open-source, general-purpose cryptographic library. We identified three distin...

https://aws.amazon.com/security/security-bulletins/rss/2026-005-aws/

#aws #security

🟠 CVE-2026-0032 - High (7.8)

In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0032/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0032 - High (7.8)

In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0032/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70252 - High (7.5)

An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf, they will be spliced into tmp. It is worth noting that there is no size check,which lea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70252/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24502 - High (8.8)

Dell Command | Intel vPro Out of Band, versions prior to 4.7.0, contain an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24502/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28399 - High (8.8)

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24112 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is passed into the `addWewifiWhiteUser` function and processed by `sscanf` without size validat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24112/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-0029 - Critical (9.8)

In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0029/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0034 - High (8.4)

In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0034/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48602 - High (8.4)

In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges nee...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48602/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48645 - High (7.8)

In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed fo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-50187 - Critical (9.8)

Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-50187/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-50199 - Critical (9.1)

Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This issue has been patched in version 1.11.30.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-50199/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-50199 - Critical (9.1)

Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This issue has been patched in version 1.11.30.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-50199/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0023 - High (8.4)

In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0023/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0017 - High (7.7)

In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0017/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48605 - High (8.4)

In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48605/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-52365 - High (7.8)

A command injection vulnerability in the szc script of the ccurtsinger/stabilizer repository allows remote attackers to execute arbitrary system commands via unsanitized user input passed to os.system(). The vulnerability arises from improper inpu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-52365/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48654 - High (7.8)

In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48654/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48635 - High (7.7)

In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interact...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48635/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-3437 (CRITICAL, CVSS 9.3): Portwell Engineering Toolkits 4.8.2 lets local users escalate privileges or trigger DoS via memory access in driver. No patch yet — restrict local access, audit users, monitor! https://radar.offseq.com/threat/cve-2026-3437-cwe-119-improper-restriction-of-oper-291f400a #OffSeq #Vulnerability #ICS #InfoSec

🟠 CVE-2025-48613 - High (7.8)

In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the same key. This could lead to local escalation of privilege with no additional execution privileges needed. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48613/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-48609 - Critical (9.1)

In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This could lead to local denial of service with no additional execut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48609/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0011 - High (8.4)

In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User int...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0011/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48653 - High (7.8)

In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48653/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24115 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate the sizes of `gstup` and `gstdwn` before concatenating them into `gstruleQos` may lead to buffer overflow.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24115/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24114 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Failure to validate `pPortMapIndex` may lead to buffer overflows when using `strcpy`.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24114/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24111 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value of `userInfo`. When `userInfo` is passed into the `addAuthUser` function and processed by `sscanf` without size validation, it...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24111/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24109 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `picName`. When this value is used in `sprintf` without validating variable sizes, it could lead to a buffer overflow vuln...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24109/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48574 - High (8.4)

In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges neede...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48574/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48619 - High (8.4)

In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges ne...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48619/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-48579 - High (8.4)

In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-48579/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24108 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and concatenated using `sprintf` without proper size va...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24108/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24113 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and concatenated using `sprintf` without proper size va...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24113/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0007 - High (8.6)

In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User inter...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0007/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0025 - High (7.8)

In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0025/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0025 - High (7.8)

In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0025/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0010 - High (8.4)

In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0010/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0037 - High (8.4)

In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0037/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Sometimes, You Can Just Feel The Security In The Design (Juniper Junos Evolved CVE-2026-21902 Pre-Auth RCE)

https://labs.watchtowr.com/sometimes-you-can-just-feel-the-security-in-the-design-junos-os-evolved-cve-2026-21902-rce/

#cybersecurity #vulnerability

Sometimes, You Can Just Feel The Security In The Design (Juniper Junos Evolved CVE-2026-21902 Pre-Auth RCE)

https://labs.watchtowr.com/sometimes-you-can-just-feel-the-security-in-the-design-junos-os-evolved-cve-2026-21902-rce/

#cybersecurity #vulnerability

New.

WatchTower: Sometimes, You Can Just Feel The Security In The Design (Juniper Junos Evolved CVE-2026-21902 Pre-Auth RCE) https://labs.watchtowr.com/sometimes-you-can-just-feel-the-security-in-the-design-junos-os-evolved-cve-2026-21902-rce/ #infosec #threatresearch

Sometimes, You Can Just Feel The Security In The Design (Junos OS Evolved CVE-2026-21902 RCE)
#CVE_2026_21902
https://labs.watchtowr.com/sometimes-you-can-just-feel-the-security-in-the-design-junos-os-evolved-cve-2026-21902-rce/

Sometimes, You Can Just Feel The Security In The Design (Junos OS Evolved CVE-2026-21902 RCE) - watchTowr Labs https://labs.watchtowr.com/sometimes-you-can-just-feel-the-security-in-the-design-junos-os-evolved-cve-2026-21902-rce/

🔴 CVE-2026-24105 - Critical (9.8)

An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20423 - High (7.8)

In wlan STA driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR0046...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20423/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0038 - High (8.4)

In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0038/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0026 - High (7.8)

In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0026/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0013 - High (8.4)

In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0013/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22886 - Critical (9.8)

OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires
authentication. However, the product ships with a default administrative account (admin/
admin) and does not enforce a mandatory password change on first use. Afte...