🟠 CVE-2026-32926 - High (7.8)

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a crafted V7 file may lead to information disclosure from the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32926/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32926 - High (7.8)

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!load_link_inf. Opening a crafted V7 file may lead to information disclosure from the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32926/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32925 - High (7.8)

V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom. Opening a crafted V7 file may lead to arbitrary code execution on the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32925 - High (7.8)

V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom. Opening a crafted V7 file may lead to arbitrary code execution on the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32929 - High (7.8)

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!get_macro_mem_COM. Opening a crafted V7 file may lead to information disclosure from the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32929/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32929 - High (7.8)

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!get_macro_mem_COM. Opening a crafted V7 file may lead to information disclosure from the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32929/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32927 - High (7.8)

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information disclosure from the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32927/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32927 - High (7.8)

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may lead to information disclosure from the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32927/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21765 - High (8.8)

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys.  The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21765 - High (8.8)

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys.  The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4370 - Critical (10)

A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform proper TLS client and server authentication. Specifically, the Juju controller's d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4370/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 CRITICAL: CVE-2026-4370 in Canonical Juju (3.2.0 – 3.6.19, 4.0 – 4.0.4) allows unauthenticated attackers to join Dqlite clusters via improper TLS validation. Patch or restrict port access now! https://radar.offseq.com/threat/cve-2026-4370-cwe-295-improper-certificate-validat-9bb2b3b6 #OffSeq #Juju #Vuln #Infosec

🟠 CVE-2026-32928 - High (7.8)

V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CSaveData::_conv_AnimationItem. Opening a crafted V7 file may lead to arbitrary code execution on the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32928 - High (7.8)

V-SFT versions 6.2.10.0 and prior contain a stack-based buffer overflow in VS6ComFile!CSaveData::_conv_AnimationItem. Opening a crafted V7 file may lead to arbitrary code execution on the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34784 - High (7.5)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file downloads via HTTP Range requests bypass the afterFind(Parse.File) trigger and its validators ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34784/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34784 - High (7.5)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file downloads via HTTP Range requests bypass the afterFind(Parse.File) trigger and its validators ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34784/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34571 - Critical (9.9)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the backend...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34571/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-34571 in ci4ms (<0.31.0.0) enables stored XSS in backend user management. Attackers can hijack admin sessions with persistent JS — upgrade to 0.31.0.0+ ASAP! https://radar.offseq.com/threat/cve-2026-34571-cwe-79-improper-neutralization-of-i-055c896a #OffSeq #XSS #CVE202634571 #WebSecurity

🔴 CVE-2026-34571 - Critical (9.9)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the backend...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34571/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-34571 in ci4ms (<0.31.0.0) enables stored XSS in backend user management. Attackers can hijack admin sessions with persistent JS — upgrade to 0.31.0.0+ ASAP! https://radar.offseq.com/threat/cve-2026-34571-cwe-79-improper-neutralization-of-i-055c896a #OffSeq #XSS #CVE202634571 #WebSecurity

🟠 CVE-2026-34572 - High (8.8)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an accou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34572/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34572 - High (8.8)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an accou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34572/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-34570 (CVSS 10): CRITICAL improper access control in ci4ms < 0.31.0.0 lets deleted accounts retain access via active sessions. Patch to 0.31.0.0+ ASAP! Details: https://radar.offseq.com/threat/cve-2026-34570-cwe-284-improper-access-control-in--917f2c32 #OffSeq #CVE202634570 #AccessControl #Infosec

🚨 CVE-2026-34570 (CVSS 10): CRITICAL improper access control in ci4ms < 0.31.0.0 lets deleted accounts retain access via active sessions. Patch to 0.31.0.0+ ASAP! Details: https://radar.offseq.com/threat/cve-2026-34570-cwe-284-improper-access-control-in--917f2c32 #OffSeq #CVE202634570 #AccessControl #Infosec

⚠️ CRITICAL XSS (CVE-2026-34569) in ci4ms (<0.31.0.0): Low-priv attackers can store JS in blog category titles, impacting public & admin views. Update to 0.31.0.0+ ASAP! Full compromise possible. Details: https://radar.offseq.com/threat/cve-2026-34569-cwe-79-improper-neutralization-of-i-ebe55431 #OffSeq #XSS #Infosec

🔴 CVE-2026-34569 - Critical (9.9)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34569/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL XSS (CVE-2026-34569) in ci4ms (<0.31.0.0): Low-priv attackers can store JS in blog category titles, impacting public & admin views. Update to 0.31.0.0+ ASAP! Full compromise possible. Details: https://radar.offseq.com/threat/cve-2026-34569-cwe-79-improper-neutralization-of-i-ebe55431 #OffSeq #XSS #Infosec

🔴 CVE-2026-34569 - Critical (9.9)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34569/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34568 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34568/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34568 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34568/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34567 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34567/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34567 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34567/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34566 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Pa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34566/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34566 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Pa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34566/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34565 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when adding P...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34565/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34565 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when adding P...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34565/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34564 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when adding P...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34564/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34564 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when adding P...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34564/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34563 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when handling...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34563/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34563 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when handling...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34563/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34560 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs interfa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34560/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34560 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application renders user-controlled input unsafely within the logs interfa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34560/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34559 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34559/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34559 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input when creating...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34559/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30276 - Critical (9.8)

An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30276/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30276 - Critical (9.8)

An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30276/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4101 - High (8.1)

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 under certain load cond...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4101 - High (8.1)

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 under certain load cond...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Chrome Zero-Day CVE-2026-5281 Sparks Urgent Global Security Response + Video

Introduction: A Silent Browser Threat Escalates into a National Security Concern A newly discovered vulnerability inside Google Chrome’s graphics engine has quickly evolved from a technical flaw into a high-priority cybersecurity emergency. With active exploitation already confirmed in the wild, government agencies and security experts are sounding the alarm. The issue, tied to…

https://undercodenews.com/critical-chrome-zero-day-cve-2026-5281-sparks-urgent-global-security-response-video/

🚨 [CISA-2026:0401] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0401)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-5281 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5281)
- Name: Google Dawn Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Google
- Product: Dawn
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-5281

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260401 #cisa20260401 #cve_2026_5281 #cve20265281

Google Chrome Security Release Addresses Critical Zero-Day CVE-2026-5281 and 21 Vulnerabilities + Video

Introduction: Urgent Browser Update After Active Exploitation Detected Google has issued a critical security update for its Chrome browser, responding to an actively exploited zero-day vulnerability that has already been observed in real-world attacks. The flaw, identified as CVE-2026-5281, affects a core graphics component and raises serious concerns about user…

https://undercodenews.com/google-chrome-security-release-addresses-critical-zero-day-cve-2026-5281-and-21-vulnerabilities-video/

CVE ID: CVE-2026-5281
Vendor: Google
Product: Dawn
Date Added: 2026-04-01
Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-5281
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5281

🟠 CVE-2026-5281 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Google on Tuesday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild.

https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html

🚨 [CISA-2026:0401] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0401)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-5281 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5281)
- Name: Google Dawn Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Google
- Product: Dawn
- Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-5281

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260401 #cisa20260401 #cve_2026_5281 #cve20265281

CVE ID: CVE-2026-5281
Vendor: Google
Product: Dawn
Date Added: 2026-04-01
Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-5281
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5281

🟠 CVE-2026-5281 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-5281 (Use after free in Dawn) included with this is a zero day

Amongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.

Amongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.

Upstream release notes have been published. This release includes fixes for 21 CVES. Google is aware that an exploit for CVE-2026-5281 exists in the wild. chromereleases.googleblog.com/2026/03/stab...

RE: https://bsky.app/profile/did:plc:6ol7vfhxcbk3ylrlbbioxlav/post/3mifg4rzfh22x

Stable Channel Update for Desk...

🟠 CVE-2026-34529 - High (7.6)

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the EPUB preview function in File Browser is vulnerable to Stored Cross-Site Scriptin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34529/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34529 - High (7.6)

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the EPUB preview function in File Browser is vulnerable to Stored Cross-Site Scriptin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34529/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34528 - High (8.1)

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the signupHandler in File Browser applies default user permissions via d.settings.Def...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34528/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34528 - High (8.1)

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the signupHandler in File Browser applies default user permissions via d.settings.Def...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34528/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25835 - High (7.7)

Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25835/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25835 - High (7.7)

Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25835/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-21861: CRITICAL OS command injection in baserCMS < 5.2.3. Admins can execute arbitrary system commands via core update. Patch to 5.2.3+ ASAP to prevent full compromise. https://radar.offseq.com/threat/cve-2026-21861-cwe-78-improper-neutralization-of-s-7b86deef #OffSeq #baserCMS #CVE2026_21861 #infosec #patching

🔥 CRITICAL: CVE-2026-30877 in baserCMS (<5.2.3) enables admin users to execute arbitrary OS commands via update functionality (CWE-78). Patch to 5.2.3+ immediately! https://radar.offseq.com/threat/cve-2026-30877-cwe-78-improper-neutralization-of-s-36a348b4 #OffSeq #baserCMS #CVE202630877 #infosec

🔴 CVE-2026-30877 - Critical (9.1)

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30877/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30877 - Critical (9.1)

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30877/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34874 - High (7.5)

An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34874/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34874 - High (7.5)

An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. There is a NULL pointer dereference in distinguished name parsing that allows an attacker to write to address 0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34874/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34872 - Critical (9.1)

An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH due to improper input validation. Using finite-field Diffie-Hellman, the other party can force the shared sec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34872/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34872 - Critical (9.1)

An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0. There is a lack of contributory behavior in FFDH due to improper input validation. Using finite-field Diffie-Hellman, the other party can force the shared sec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34872/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34748 - High (8.7)

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collectio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34748 - High (8.7)

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collectio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34747 - High (8.5)

Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifyi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34747/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34747 - High (8.5)

Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifyi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34747/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34746 - High (7.7)

Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34746/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34746 - High (7.7)

Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34746/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34456 - Critical (9.1)

Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34456/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34456 - Critical (9.1)

Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic linking ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34456/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25833 - High (7.5)

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25833 - High (7.5)

Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33576 - Critical (9.8)

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rej...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33576/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33577 - Critical (9.8)

OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validation in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33577/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30281 - Critical (9.8)

An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30281 - Critical (9.8)

An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71278 - High (8.8)

XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond thei...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34162 - Critical (10)

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-sup...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34162/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34430 - High (8.8)

ByteDance Deer-Flow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34430/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34430 - High (8.8)

ByteDance Deer-Flow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34430/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34731 - High (7.5)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo on_publish_done.php endpoint in the Live plugin allows unauthenticated users to terminate any active live stream. The endpoint processes RTMP callback events to m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34731/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33373 - High (8.8)

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state tr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33373 - High (8.8)

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state tr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

And (drum roll) .... here it is. Grab a coffee, Cisco's having a bad hair day.

New.

Critical: CVE-2026-20160: Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-cli-execution-cHUcWuNr

Also new:

Critical: CVE-2026-20093: Cisco Integrated Management Controller Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn

Three high-severity entries:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-improp-auth-mUwFWUU3

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt

Four medium-severity entries toward the end of today's list: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #Cisco #vulnerability

@cR0w

And (drum roll) .... here it is. Grab a coffee, Cisco's having a bad hair day.

New.

Critical: CVE-2026-20160: Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-cli-execution-cHUcWuNr

Also new:

Critical: CVE-2026-20093: Cisco Integrated Management Controller Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn

Three high-severity entries:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-improp-auth-mUwFWUU3

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt

Four medium-severity entries toward the end of today's list: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #Cisco #vulnerability

@cR0w

And (drum roll) .... here it is. Grab a coffee, Cisco's having a bad hair day.

New.

Critical: CVE-2026-20160: Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-cli-execution-cHUcWuNr

Also new:

Critical: CVE-2026-20093: Cisco Integrated Management Controller Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn

Three high-severity entries:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-improp-auth-mUwFWUU3

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt

Four medium-severity entries toward the end of today's list: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #Cisco #vulnerability

@cR0w

And (drum roll) .... here it is. Grab a coffee, Cisco's having a bad hair day.

New.

Critical: CVE-2026-20160: Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-cli-execution-cHUcWuNr

Also new:

Critical: CVE-2026-20093: Cisco Integrated Management Controller Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn

Three high-severity entries:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-improp-auth-mUwFWUU3

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt

Four medium-severity entries toward the end of today's list: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #Cisco #vulnerability

@cR0w

🔴 CVE-2026-29014 - Critical (9.8)

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-29014 - Critical (9.8)

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5087 - High (7.5)

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.

PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5087/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5087 - High (7.5)

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.

PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5087/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34751 - Critical (9.1)

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34751 - Critical (9.1)

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33949 - High (8.1)

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33949/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33949 - High (8.1)

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33949/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5292 - High (8.8)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5292 - High (8.8)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5282 - High (8.1)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5282 - High (8.1)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4748 - High (7.5)

A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4748 - High (7.5)

A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3308 - High (7.8)

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds writ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3308/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3308 - High (7.8)

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds writ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3308/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5288 - Critical (9.6)

Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5288 - Critical (9.6)

Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-2696: HIGH severity flaw in Export All URLs WP plugin (<5.1) leaks private post URLs via brute-forcible CSV files in uploads/. No auth needed. Upgrade ASAP & restrict dir access! https://radar.offseq.com/threat/cve-2026-2696-cwe-200-information-exposure-in-expo-c6c7420f #OffSeq #WordPress #CVE20262696

🔴 CVE-2026-5290 - Critical (9.6)

Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5290 - Critical (9.6)

Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5289 - Critical (9.6)

Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5289 - Critical (9.6)

Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5286 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5286 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-5286: HIGH severity use-after-free in Chrome’s Dawn component <146.0.7680.178. Remote code execution possible via crafted HTML. Patch now to stay protected! https://radar.offseq.com/threat/cve-2026-5286-use-after-free-in-google-chrome-34aabe80 #OffSeq #Chrome #Vuln #InfoSec

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5284 - High (7.5)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5284 - High (7.5)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5277 - High (7.5)

Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5277 - High (7.5)

Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5275 - High (8.8)

Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5275 - High (8.8)

Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5274 - High (8.8)

Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5274 - High (8.8)

Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5278 - High (8.8)

Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5278 - High (8.8)

Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5272 - High (8.8)

Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5272/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5272 - High (8.8)

Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5272/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Claude wrote a full FreeBSD remote kernel RCE with root shell: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

Discussion: http://news.ycombinator.com/item?id=47597119

Claude wrote a full FreeBSD remote kernel RCE with root shell

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-4747
🧐

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747): https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

Discussion: http://news.ycombinator.com/item?id=47597119

📰 Today's Top 20 Hacker News Stories (Sorted by Score) 📰
----------------------------------------
🔖 Title: Claude Code Unpacked : A visual guide
🔗 URL: https://ccunpacked.dev/
👍 Score: [944]
💬 Discussion: https://news.ycombinator.com/item?id=47597085
----------------------------------------
🔖 Title: CERN levels up with new superconducting karts
🔗 URL: https://home.cern/news/news/engineering/cern-levels-new-superconducting-karts
👍 Score: [343]
💬 Discussion: https://news.ycombinator.com/item?id=47597935
----------------------------------------
🔖 Title: EmDash – a spiritual successor to WordPress that solves plugin security
🔗 URL: https://blog.cloudflare.com/emdash-wordpress/
👍 Score: [245]
💬 Discussion: https://news.ycombinator.com/item?id=47602832
----------------------------------------
🔖 Title: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)
🔗 URL: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
👍 Score: [198]
💬 Discussion: https://news.ycombinator.com/item?id=47597119
----------------------------------------
🔖 Title: Is BGP safe yet?
🔗 URL: https://isbgpsafeyet.com/
👍 Score: [196]
💬 Discussion: https://news.ycombinator.com/item?id=47600382
----------------------------------------
🔖 Title: Show HN: CLI to order groceries via reverse-engineered REWE API (Haskell)
🔗 URL: https://github.com/yannick-cw/korb
👍 Score: [177]
💬 Discussion: https://news.ycombinator.com/item?id=47571183
----------------------------------------
🔖 Title: NASA Artemis II moon mission live launch broadcast
🔗 URL: https://plus.nasa.gov/scheduled-video/nasas-artemis-ii-crew-launches-to-the-moon-official-broadcast/
👍 Score: [139]
💬 Discussion: https://news.ycombinator.com/item?id=47603657
----------------------------------------
🔖 Title: The OpenAI Graveyard: All the Deals and Products That Haven't Happened
🔗 URL: https://www.forbes.com/sites/phoebeliu/2026/03/31/openai-graveyard-deals-and-products-havent-happened-openai/
👍 Score: [132]
💬 Discussion: https://news.ycombinator.com/item?id=47602565
----------------------------------------
🔖 Title: Intuiting Pratt Parsing
🔗 URL: https://louis.co.nz/2026/03/26/pratt-parsing.html
👍 Score: [121]
💬 Discussion: https://news.ycombinator.com/item?id=47573450
----------------------------------------
🔖 Title: StepFun 3.5 Flash is #1 cost-effective model for OpenClaw tasks (300 battles)
🔗 URL: https://app.uniclaw.ai/arena?tab=costEffectiveness&via=hn
👍 Score: [80]
💬 Discussion: https://news.ycombinator.com/item?id=47602879
----------------------------------------
🔖 Title: Random numbers, Persian code: A mysterious signal transfixes radio sleuths
🔗 URL: https://www.rferl.org/a/mystery-numbers-station-persian-signal-iran-war/33700659.html
👍 Score: [74]
💬 Discussion: https://news.ycombinator.com/item?id=47599510
----------------------------------------
🔖 Title: Consider the Greenland Shark (2020)
🔗 URL: https://www.lrb.co.uk/the-paper/v42/n09/katherine-rundell/consider-the-greenland-shark
👍 Score: [68]
💬 Discussion: https://news.ycombinator.com/item?id=47539945
----------------------------------------
🔖 Title: The Document Foundation ejects its core developers
🔗 URL: https://www.collaboraonline.com/blog/tdf-ejects-its-core-developers/
👍 Score: [67]
💬 Discussion: https://news.ycombinator.com/item?id=47599305
----------------------------------------
🔖 Title: What Is Copilot Exactly?
🔗 URL: https://idiallo.com/blog/what-is-copilot-exactly
👍 Score: [62]
💬 Discussion: https://news.ycombinator.com/item?id=47603231
----------------------------------------
🔖 Title: AI for American-Produced Cement and Concrete
🔗 URL: https://engineering.fb.com/2026/03/30/data-center-engineering/ai-for-american-produced-cement-and-concrete/
👍 Score: [57]
💬 Discussion: https://news.ycombinator.com/item?id=47603737
----------------------------------------
🔖 Title: Show HN: Real-time dashboard for Claude Code agent teams
🔗 URL: https://github.com/simple10/agents-observe
👍 Score: [44]
💬 Discussion: https://news.ycombinator.com/item?id=47602986
----------------------------------------
🔖 Title: Show HN: Zerobox – Sandbox any command with file and network restrictions
🔗 URL: https://github.com/afshinm/zerobox
👍 Score: [36]
💬 Discussion: https://news.ycombinator.com/item?id=47574871
----------------------------------------
🔖 Title: Ada and Spark on ARM Cortex-M – A Tutorial with Arduino and Nucleo Examples
🔗 URL: http://inspirel.com/articles/Ada_On_Cortex.html
👍 Score: [36]
💬 Discussion: https://news.ycombinator.com/item?id=47552144
----------------------------------------
🔖 Title: Randomness on Apple Platforms (2024)
🔗 URL: https://blog.xoria.org/randomness-on-apple-platforms/
👍 Score: [34]
💬 Discussion: https://news.ycombinator.com/item?id=47543205
----------------------------------------

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

Claude wrote a full FreeBSD remote kernel RCE with root shell

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-4747
🧐

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

Wow, #Claude, you wrote a remote kernel #RCE with a root shell for FreeBSD? 🙄 I’m sure this groundbreaking achievement will be a thrilling bedtime story for security experts everywhere. 🤦‍♂️ Meanwhile, GitHub is still doing cartwheels about #AI writing better code so we can break it even faster. 💥
https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md #FreeBSD #cybersecurity #coding #HackerNews #ngated

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#HackerNews #FreeBSD #RCE #Security #CVE-2026-4747 #RootShell #CyberSecurity

Claude wrote a full FreeBSD remote kernel RCE with root shell

https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#freebsd #github

@AmenZwa
MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)
https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747) https://lobste.rs/s/hsykbh #freebsd #security #vibecoding
https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747) https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

Claude Wrote a Full #FreeBSD Remote Kernel #RCE with Root Shell (CVE-2026-4747): https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

🟠 CVE-2026-24165 - High (7.8)

NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24165/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24165 - High (7.8)

NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24165/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30309 - High (7.8)

InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism completely ineffective. The predefined blocklist fails to cover native high-risk commands in Windows PowerSh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30309/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5204 - High (8.8)

A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34156 - Critical (9.9)

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34156/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Our colleague @mal had another look at OpenOLAT and found a nice RCE (CVE-2026-28228 and CVE-2026-28228). If you're interested, details can be found on our blog https://secfault-security.com/blog/openolat-ssti.html

🔴 CVE-2026-34505 - Critical (9.8)

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34505/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34505 - Critical (9.8)

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34505/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32982 - High (7.5)

OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are em...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5201 - High (7.5)

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5201/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5201 - High (7.5)

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5201/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34040 - High (8.8)

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34040/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32716 - High (8.1)

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /joh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32716/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34042 - High (8.2)

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the inte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 New security advisory:

CVE-2026-34585 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-34585-siyuan-xss-to-rce

#Cybersecurity #VulnerabilityManagement #CyberSec

🟠 CVE-2026-34585 - High (8.6)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34585/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15484 - Critical (9.1)

The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15484 - Critical (9.1)

The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4800 - High (8.1)

Impact:

The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Functi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4800/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34366 - High (7.6)

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Payment receipt PDF genera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34448 - Critical (9)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -> Asset ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34448/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL alert: CVE-2026-34448 in SiYuan (<3.6.2) enables stored XSS, escalating to OS command execution via unsafe Electron configs. Patch to 3.6.2+ & tighten app security! Details: https://radar.offseq.com/threat/cve-2026-34448-cwe-79-improper-neutralization-of-i-36bc82a3 #OffSeq #SiYuan #CVE202634448 #XSS #infosec

🟠 CVE-2026-3775 - High (7.8)

The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3775/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5214 - High (8.8)

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32726 - High (8.1)

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass in path-based scope validation. The enforcer used a simple string-prefix comparison w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32726/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32726 - High (8.1)

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass in path-based scope validation. The enforcer used a simple string-prefix comparison w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32726/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32725 - High (8.3)

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path fr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32725/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-23898: HIGH-severity flaw in Joomla! CMS (4.0.0-5.4.3, 6.0.0-6.0.3) lets admin-level attackers delete arbitrary files, risking DoS or system compromise. Patch ASAP, restrict high-priv accounts, monitor for deletions. https://radar.offseq.com/threat/cve-2026-23898-cwe-73-destructive-file-deletion-an-4b16a48a #OffSeq #Joomla #Vuln

🟠 CVE-2026-3779 - High (7.8)