🚨 HIGH severity: Tenda F453 v1.0.0.3 has a buffer overflow (CVE-2026-3379) in /goform/SetIpBind. Remotely exploitable with no auth. Restrict access, monitor for exploit attempts, and patch ASAP. https://radar.offseq.com/threat/cve-2026-3379-buffer-overflow-in-tenda-f453-63a79945 #OffSeq #Cybersecurity #Vulnerability #CVE20263379

🚨 HIGH severity: Tenda F453 v1.0.0.3 has a buffer overflow (CVE-2026-3379) in /goform/SetIpBind. Remotely exploitable with no auth. Restrict access, monitor for exploit attempts, and patch ASAP. https://radar.offseq.com/threat/cve-2026-3379-buffer-overflow-in-tenda-f453-63a79945 #OffSeq #Cybersecurity #Vulnerability #CVE20263379

🟠 CVE-2026-28426 - High (8.7)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious Jav...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28426 - High (8.7)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, stored XSS vulnerability in svg and icon related components allow authenticated users with appropriate permissions to inject malicious Jav...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28425 - High (8)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28425/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28425 - High (8)

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, an authenticated control panel user with access to Antlers-enabled inputs may be able to achieve remote code execution in the application ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28425/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28416 - High (8.2)

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a mal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28416/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28416 - High (8.2)

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnerability in Gradio allows an attacker to make arbitrary HTTP requests from a victim's server by hosting a mal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28416/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28406 - High (8.2)

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28406/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28406 - High (8.2)

kaniko is a tool to build container images from a Dockerfile, inside a container or Kubernetes cluster. Starting in version 1.25.4 and prior to version 1.25.10, kaniko unpacks build context archives using `filepath.Join(dest, cleanedName)` without...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28406/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26861 - High (8.3)

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26861 - High (8.3)

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-3010: CRITICAL XSS in Microchip TimePictra v11.0 – 11.3 SP2. Remote, unauthenticated attackers can inject scripts via web UI. Restrict access, enable WAF, monitor logs. Patch awaited. Full info: https://radar.offseq.com/threat/cve-2026-3010-cwe-79-improper-neutralization-of-in-f593f595 #OffSeq #XSS #ICS #Vuln

🚨 CVE-2026-3010: CRITICAL XSS in Microchip TimePictra v11.0 – 11.3 SP2. Remote, unauthenticated attackers can inject scripts via web UI. Restrict access, enable WAF, monitor logs. Patch awaited. Full info: https://radar.offseq.com/threat/cve-2026-3010-cwe-79-improper-neutralization-of-in-f593f595 #OffSeq #XSS #ICS #Vuln

⚠️ CRITICAL vuln in Microchip TimePictra (11.0 – 11.3 SP2): CVE-2026-2844 lets remote, unauthenticated attackers manipulate configs. No patch yet — restrict access & monitor logs! https://radar.offseq.com/threat/cve-2026-2844-cwe-306-missing-authentication-for-c-aa868998 #OffSeq #TimePictra #Vulnerability #OTSecurity

⚠️ CRITICAL vuln in Microchip TimePictra (11.0 – 11.3 SP2): CVE-2026-2844 lets remote, unauthenticated attackers manipulate configs. No patch yet — restrict access & monitor logs! https://radar.offseq.com/threat/cve-2026-2844-cwe-306-missing-authentication-for-c-aa868998 #OffSeq #TimePictra #Vulnerability #OTSecurity

🟠 CVE-2025-13673 - High (7.5)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13673 - High (7.5)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2471 - High (7.5)

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the `BaseModel` class constructor c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2471 - High (7.5)

The WP Mail Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.15.0 via deserialization of untrusted input from the email log message field. This is due to the `BaseModel` class constructor c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2788 - Critical (9.8)

Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2788/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0980 - High (8.3)

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious usern...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0980 - High (8.3)

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious usern...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

another day another critical vulnerability in openclaw 🥲🤡

"In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval."

🔐 CVE-2026-28363

📊 CVSS: 9.9 · Critical
📅 02/27/2026, 04:16 AM
🛡️ CWE: CWE-184
📦 Affected: OpenClaw OpenClaw (< 2026.2.23)

🔗 https://hecate.pw/vulnerability/CVE-2026-28363

#cve #vulnerability #hecate

another day another critical vulnerability in openclaw 🥲🤡

"In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval."

🔐 CVE-2026-28363

📊 CVSS: 9.9 · Critical
📅 02/27/2026, 04:16 AM
🛡️ CWE: CWE-184
📦 Affected: OpenClaw OpenClaw (< 2026.2.23)

🔗 https://hecate.pw/vulnerability/CVE-2026-28363

#cve #vulnerability #hecate

🔴 CVE-2026-28363 - Critical (9.9)

In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free execution paths that were intended to require approval....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28363/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-28268 - Critical (9.8)

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL vuln in go-vikunja vikunja (<2.1.0): Password reset tokens never expire due to logic flaw, enabling persistent account takeover. Patch to v2.1.0+ now! CVE-2026-28268 https://radar.offseq.com/threat/cve-2026-28268-cwe-459-incomplete-cleanup-in-go-vi-0517b158 #OffSeq #Vuln #Security #FOSS

🔴 CVE-2026-28268 - Critical (9.8)

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL vuln in go-vikunja vikunja (<2.1.0): Password reset tokens never expire due to logic flaw, enabling persistent account takeover. Patch to v2.1.0+ now! CVE-2026-28268 https://radar.offseq.com/threat/cve-2026-28268-cwe-459-incomplete-cleanup-in-go-vi-0517b158 #OffSeq #Vuln #Security #FOSS

🔴 CVE-2025-11252 - Critical (9.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm allows SQL Injection.This issue affects windesk.Fm: through 27022026.

NOTE: The vendor ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11252/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-11252 - Critical (9.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm allows SQL Injection.This issue affects windesk.Fm: through 27022026.

NOTE: The vendor ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11252/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27959 - High (7.5)

Koa is middleware for Node.js using ES2017 async functions. Prior to versions 3.1.2 and 2.16.4, Koa's `ctx.hostname` API performs naive parsing of the HTTP Host header, extracting everything before the first colon without validating the input conf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27959/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1662 - High (7.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted reque...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1662/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20742 - High (8)

An OS command injection

vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into requests sent to the templates route.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20742/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-21389 - High (8)

An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into the request body sent to the contacts
import...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21389/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-21718 - Critical (10)

An authentication bypass vulnerability exists in Copeland XWEB Pro
version 1.12.1 and prior, enabling any attackers to bypass the
authentication requirement and achieve pre-authenticated code execution
on the system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-21718: CRITICAL auth bypass in Copeland XWEB 300D PRO (≤1.12.1). Remote code exec possible — no user interaction. No patch yet. Segment & monitor ICS networks! https://radar.offseq.com/threat/cve-2026-21718-cwe-327-in-copeland-copeland-xweb-3-124474ba #OffSeq #ICS #Vulnerability #Cybersecurity

🟠 CVE-2026-20764 - High (8)

An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
providing malicious input via the device hostname configuration which
is la...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20764/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24452 - High (8)

An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
supplying a crafted template file to the devices route.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24452/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25196 - High (8)

An OS command injection
vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an
authenticated attacker to achieve remote code execution on the system by
injecting malicious input into the Wi-Fi SSID and/or password fields
can le...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25196/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28414 - High (7.5)

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28414/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28414 - High (7.5)

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28414/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-28411 - Critical (9.8)

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vuln...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-28411: CRITICAL auth bypass in LabRedesCefetRJ WeGIA (<3.6.5) via unsafe extract() on $_REQUEST. Full admin compromise risk. Upgrade to 3.6.5+ now! More: https://radar.offseq.com/threat/cve-2026-28411-cwe-288-authentication-bypass-using-7167a2c8 #OffSeq #Vuln #WebAppSec #PHP

🔴 CVE-2026-28411 - Critical (9.8)

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vuln...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-28411: CRITICAL auth bypass in LabRedesCefetRJ WeGIA (<3.6.5) via unsafe extract() on $_REQUEST. Full admin compromise risk. Upgrade to 3.6.5+ now! More: https://radar.offseq.com/threat/cve-2026-28411-cwe-288-authentication-bypass-using-7167a2c8 #OffSeq #Vuln #WebAppSec #PHP

🔴 CVE-2026-28408 - Critical (9.8)

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and does not have its own authentication and permission checks. A malic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28408/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-28408 in WeGIA (<3.6.5) lets unauthenticated attackers inject massive unauthorized data via adicionar_tipo_docs_atendido.php. Upgrade to 3.6.5 ASAP. Monitor & restrict access now. https://radar.offseq.com/threat/cve-2026-28408-cwe-862-missing-authorization-in-la-ddacfcff #OffSeq #Vulnerability #WeGIA #CVE202628408

🔴 CVE-2026-28408 - Critical (9.8)

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and does not have its own authentication and permission checks. A malic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28408/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-28408 in WeGIA (<3.6.5) lets unauthenticated attackers inject massive unauthorized data via adicionar_tipo_docs_atendido.php. Upgrade to 3.6.5 ASAP. Monitor & restrict access now. https://radar.offseq.com/threat/cve-2026-28408-cwe-862-missing-authorization-in-la-ddacfcff #OffSeq #Vulnerability #WeGIA #CVE202628408

🟠 CVE-2026-28400 - High (7.5)

Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST `/engines/_configure` endpoint that accepts arbitrary runtime flags without authentication. These flags are pass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28400/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28400 - High (7.5)

Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expose a POST `/engines/_configure` endpoint that accepts arbitrary runtime flags without authentication. These flags are pass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28400/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27804 in parse-server allows attackers to forge Google auth tokens (alg: none accepted)! Versions <8.6.3 & <9.1.1-alpha.4 at risk. Upgrade or disable Google auth now. https://radar.offseq.com/threat/cve-2026-27804-cwe-327-use-of-a-broken-or-risky-cr-9a87af7c #OffSeq #ParseServer #JWT #CVE202627804

🟠 CVE-2026-27939 - High (8.8)

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27939 - High (8.8)

Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated Control Panel users may under certain conditions obtain elevated privileges without completing the intended...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-40932 - High (8.2)

Apache::SessionX versions through 2.01 for Perl create insecure session id.

Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand() ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40932/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-40932 - High (8.2)

Apache::SessionX versions through 2.01 for Perl create insecure session id.

Apache::SessionX generates session ids insecurely. The default session id generator in Apache::SessionX::Generate::MD5 returns a MD5 hash seeded with the built-in rand() ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40932/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2597 - High (7.5)

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes().

The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2597/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2597 - High (7.5)

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes().

The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2597/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24352 - Critical (9.8)

PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID
for a victim and later hijack the authenticated...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24352 - Critical (9.8)

PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID
for a victim and later hijack the authenticated...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69437 - High (8.7)

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69437/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69437 - High (8.7)

PublicCMS v5.202506.d and earlier is vulnerable to stored XSS. Uploaded PDFs can contain JavaScript payloads and bypass PDF security checks in the backend CmsFileUtils.java. If a user uploads a PDF file containing a malicious payload to the system...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69437/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27141 - High (7.5)

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27141 - High (7.5)

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27755 in SODOLA SL902-SWTGW124AS (≤200.1.20) lets attackers forge MD5-based session IDs, bypassing auth remotely. No patch yet — segment, restrict, monitor! https://radar.offseq.com/threat/cve-2026-27755-cwe-330-use-of-insufficiently-rando-27c7bdab #OffSeq #CVE202627755 #IoTSecurity #Infosec

🔴 CVE-2026-27755 - Critical (9.8)

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess val...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27755 in SODOLA SL902-SWTGW124AS (≤200.1.20) lets attackers forge MD5-based session IDs, bypassing auth remotely. No patch yet — segment, restrict, monitor! https://radar.offseq.com/threat/cve-2026-27755-cwe-330-use-of-insufficiently-rando-27c7bdab #OffSeq #CVE202627755 #IoTSecurity #Infosec

🔴 CVE-2026-27755 - Critical (9.8)

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability that allows attackers to forge authenticated sessions by computing predictable MD5-based cookies. Attackers who know or guess val...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27510 - Critical (9.6)

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27510 - Critical (9.6)

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application (com.unitree.doggo2), are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510) https://boschko.ca/unitree-go2-rce/

🟠 CVE-2026-27509 - High (8)

Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, una...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27509 - High (8)

Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, una...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

From DDS Packets to Robot Shells: Two RCEs in Unitree Robots (CVE-2026-27509 & CVE-2026-27510) https://boschko.ca/unitree-go2-rce/

🔴 CVE-2026-22207 - Critical (9.8)

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22207 - Critical (9.8)

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22206 - High (8.8)

SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw comb...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22206 - High (8.8)

SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulating union-based injection techniques. Attackers can exploit this SQL injection flaw comb...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22205 - High (7.5)

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22205/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22205 - High (7.5)

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22205/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2796 - Critical (9.8)

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability affects Firefox &lt; 148 and Thunderbird &lt; 148.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2796/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-27947 (CRITICAL): Intermesh Group-Office RCE via TNEF attachment processing. Authenticated attackers can inject commands through crafted filenames. Patch to v26.0.9/25.0.87/6.8.154 ASAP! https://radar.offseq.com/threat/cve-2026-27947-cwe-88-improper-neutralization-of-a-24402a59 #OffSeq #RCE #Vuln #GroupOffice

🚨 CVE-2026-27947 (CRITICAL): Intermesh Group-Office RCE via TNEF attachment processing. Authenticated attackers can inject commands through crafted filenames. Patch to v26.0.9/25.0.87/6.8.154 ASAP! https://radar.offseq.com/threat/cve-2026-27947-cwe-88-improper-neutralization-of-a-24402a59 #OffSeq #RCE #Vuln #GroupOffice

🟠 CVE-2026-27836 - High (7.5)

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27836 - High (7.5)

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26862 - High (8.3)

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26862/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26862 - High (8.3)

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) uses the includ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26862/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28274 - High (8.7)

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28274 - High (8.7)

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27635 - High (7.5)

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.0, when model render generation is enabled, a logged-in user can achieve RCE by uploading a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27635/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27449 - High (7.5)

Umbraco Engage is a business intelligence platform. A vulnerability has been identified in Umbraco Engage prior to versions 16.2.1 and 17.1.1 where certain API endpoints are exposed without enforcing authentication or authorization checks. The aff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27449/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27449 - High (7.5)

Umbraco Engage is a business intelligence platform. A vulnerability has been identified in Umbraco Engage prior to versions 16.2.1 and 17.1.1 where certain API endpoints are exposed without enforcing authentication or authorization checks. The aff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27449/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ HIGH severity: CVE-2026-27449 impacts Umbraco Engage.Forms (<16.2.1, 17.0.0 – 17.1.0). Improper access control lets unauthenticated attackers extract sensitive analytics & customer data. Patch to 16.2.1/17.1.1 now! https://radar.offseq.com/threat/cve-2026-27449-cwe-284-improper-access-control-in--fadf6848 #OffSeq #Umbraco #Infosec

🟠 CVE-2026-3271 - High (8.8)

A vulnerability was found in Tenda F453 1.0.0.3. This impacts the function fromP2pListFilter of the file /goform/P2pListFilterof of the component httpd. The manipulation of the argument page results in buffer overflow. The attack may be launched r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3271/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-2749 hits Centreon Open Tickets (Linux Central Server). All before v25.10.3/24.10.8/24.04.7 at risk — remote exploit, full compromise possible. Restrict access & monitor systems! https://radar.offseq.com/threat/cve-2026-2749-e23f9297 #OffSeq #Centreon #Vuln

🔴 CVE-2026-2749 - Critical (9.9)

Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10.3, 24.10.8, 24.04.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2749/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-2749 hits Centreon Open Tickets (Linux Central Server). All before v25.10.3/24.10.8/24.04.7 at risk — remote exploit, full compromise possible. Restrict access & monitor systems! https://radar.offseq.com/threat/cve-2026-2749-e23f9297 #OffSeq #Centreon #Vuln

🔴 CVE-2026-2749 - Critical (9.9)

Vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centroen Open Ticket modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10.3, 24.10.8, 24.04.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2749/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔐 CVE-2026-27751 (CRITICAL): SODOLA SL902-SWTGW124AS gateways (≤200.1.20) use default creds, enabling remote admin takeover. Change all passwords or restrict access ASAP! No patch yet. https://radar.offseq.com/threat/cve-2026-27751-cwe-1392-use-of-default-credentials-706a3fb0 #OffSeq #Vuln #IoTSecurity #NetworkSecurity

🔴 CVE-2026-27751 - Critical (9.8)

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management interface. Attackers can authenticate using the hardcoded default...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔐 CVE-2026-27751 (CRITICAL): SODOLA SL902-SWTGW124AS gateways (≤200.1.20) use default creds, enabling remote admin takeover. Change all passwords or restrict access ASAP! No patch yet. https://radar.offseq.com/threat/cve-2026-27751-cwe-1392-use-of-default-credentials-706a3fb0 #OffSeq #Vuln #IoTSecurity #NetworkSecurity

🔴 CVE-2026-27751 - Critical (9.8)

SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a default credentials vulnerability that allows remote attackers to obtain administrative access to the management interface. Attackers can authenticate using the hardcoded default...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27969 - High (8.8)

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27969 - High (8.8)

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 CRITICAL: CVE-2026-27969 in Vitess (<22.0.4, 23.0.0 – 23.0.3) allows path traversal via backup restore. Attackers w/ backup storage access can write files anywhere Vitess can reach. Patch ASAP & secure storage! https://radar.offseq.com/threat/cve-2026-27969-cwe-22-improper-limitation-of-a-pat-4b60f36b #OffSeq #Vitess #CVE202627969

🔴 CVE-2025-11251 - Critical (9.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows SQL Injection.This issue affects E-Commerce Platform: through 27022026.

NOTE...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11251/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-11251 - Critical (9.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows SQL Injection.This issue affects E-Commerce Platform: through 27022026.

NOTE...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11251/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27904 - High (7.5)

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quant...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27904/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27942 - High (7.5)

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27942 - High (7.5)

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-28370 in OpenStack Vitrage (CVSS 9.1) enables authenticated RCE via eval injection in query parser. Upgrade to fixed versions, restrict API access, and monitor logs. Affects 0, 13.0.0, 14.0.0, 15.0.0. Details: https://radar.offseq.com/threat/cve-2026-28370-cwe-95-improper-neutralization-of-d-e403f347 #OffSeq #OpenStack #Vuln

⚠️ CRITICAL: CVE-2026-28370 in OpenStack Vitrage (CVSS 9.1) enables authenticated RCE via eval injection in query parser. Upgrade to fixed versions, restrict API access, and monitor logs. Affects 0, 13.0.0, 14.0.0, 15.0.0. Details: https://radar.offseq.com/threat/cve-2026-28370-cwe-95-improper-neutralization-of-d-e403f347 #OffSeq #OpenStack #Vuln

🔴 CVE-2026-28370 - Critical (9.1)

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unau...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28370/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2750 - Critical (9.1)

Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2750 - Critical (9.1)

Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27831 - High (7.5)

rldns is an open source DNS server. Version 2.3 has a heap-based out-of-bounds read that leads to denial of service. Version 1.4 contains a patch for the issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27831/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28216 - High (8.3)

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal environment by ID. `user-environments.resolver.ts:82-109`, `updateUserEnvironment` mutation us...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28216/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28216 - High (8.3)

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal environment by ID. `user-environments.resolver.ts:82-109`, `updateUserEnvironment` mutation us...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28216/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3272 - High (8.8)

A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromDhcpListClient of the file /goform/DhcpListClient of the component httpd. This manipulation of the argument page causes buffer overflow. Remote exploitation of the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3272/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27966 - Critical (9.8)

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcodes `allow_dangerous_code=True`, which automatically exposes LangChain’s Python REPL tool (`python_repl_a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27966/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-27966 (CRITICAL): langflow-ai langflow (<1.8.0) allows unauthenticated RCE via prompt injection due to hardcoded allow_dangerous_code=True. Patch to 1.8.0+ now! https://radar.offseq.com/threat/cve-2026-27966-cwe-94-improper-control-of-generati-8ac7c0b0 #OffSeq #Vulnerability #Langflow #RCE

🟠 CVE-2026-3274 - High (8.8)

A security flaw has been discovered in Tenda F453 1.0.0.3. Affected by this issue is the function frmL7ProtForm of the file /goform/L7Prot of the component httpd. Performing a manipulation of the argument page results in buffer overflow. The attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3275 - High (8.8)

A weakness has been identified in Tenda F453 1.0.0.3. This affects the function fromAddressNat of the file /goform/addressNat of the component httpd. Executing a manipulation of the argument entrys can lead to buffer overflow. The attack may be pe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25136 - High (8.1)

Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25136/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3301 - Critical (9.8)

A security flaw has been discovered in Totolink N300RH 6.1c.1353_B20190305. Affected by this vulnerability is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3301/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL OS command injection in Totolink N300RH (v6.1c.1353_B20190305) — CVE-2026-3301. Unauthenticated remote exploit possible, with public exploit code out. Restrict access & monitor until patch released. https://radar.offseq.com/threat/cve-2026-3301-os-command-injection-in-totolink-n30-8ab5e0b9 #OffSeq #CVE20263301 #IoTSecurity

🟠 CVE-2026-2751 - High (8.3)

Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2751 - High (8.3)

Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2751/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23750 - High (8.1)

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23750 - High (8.1)

Golioth Pouch version 0.1.0, prior to commit 1b2219a1, contains a heap-based buffer overflow in BLE GATT server certificate handling. server_cert_write() allocates a heap buffer of size CONFIG_POUCH_SERVER_CERT_MAX_LEN when receiving the first fra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26955 - High (8.8)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a malicious RDP server can trigger a heap buffer overflow in FreeRDP clients using the GDI surface pipeline (e.g., `xfreerdp`) by sending an RDPGFX ClearCode...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26955/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-10990 - High (7.5)

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-10990/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-10990 - High (7.5)

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-10990/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-21902 represents a high-impact infrastructure exposure.

Affected platform: Junos OS Evolved on PTX series routers.

Attack vector: Unauthenticated network access.
Privilege level: Root execution.
Service: On-Box Anomaly Detection, enabled by default.

Strategic risk:
• Traffic interception capability
• Policy manipulation
• Controller redirection
• Lateral pivoting
• Long-term foothold persistence
Although no exploitation has been observed, historically, high-performance routing infrastructure is a prime target due to its control-plane visibility and network centrality.

Recommended actions:
– Immediate patch validation
– Control-plane traffic monitoring
– Service exposure review
– Network segmentation validation
– Threat hunting for anomalous routing behavior
Are infrastructure devices integrated into your continuous detection engineering pipeline?

Source: https://www.securityweek.com/juniper-networks-ptx-routers-affected-by-critical-vulnerability/

Engage below.
Follow TechNadu for high-signal vulnerability intelligence.
Repost to strengthen security awareness.

#Infosec #CVE2026 #Juniper #RouterSecurity #CriticalInfrastructure #ThreatModeling #DetectionEngineering #NetworkDefense #ZeroTrustArchitecture #CyberRisk #SecurityOperations #VulnerabilityManagement

Critical Root RCE Vulnerability Patched in Juniper PTX Series Routers

Juniper Networks patched a critical vulnerability (CVE-2026-21902) in Junos OS Evolved on PTX Series routers that allows unauthenticated attackers to gain root access via a framework that should have been internal but is publicly exposed and not authenticated.

**If you are using Junos OS Evolved, this is important. Either immediately patch your PTX Series routers or disable the 'On-Box Anomaly Detection' service. Depending on configuration, review if you can isolate the network devices from the public internet to mitigate the impact.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-root-rce-vulnerability-patched-in-juniper-ptx-series-routers-i-9-2-e-h/gD2P6Ple2L

The security issue is identified as CVE-2026-21902 and is caused by incorrect permission assignment in the ‘On-Box Anomaly Detection’ framework, which should be exposed to internal processes only over the internal routing interface. bleepingcomputer.com/news/security/critical-juniper-networks-ptx-flaw-allows-full-router-takeover/

CVE-2026-21902 represents a high-impact infrastructure exposure.

Affected platform: Junos OS Evolved on PTX series routers.

Attack vector: Unauthenticated network access.
Privilege level: Root execution.
Service: On-Box Anomaly Detection, enabled by default.

Strategic risk:
• Traffic interception capability
• Policy manipulation
• Controller redirection
• Lateral pivoting
• Long-term foothold persistence
Although no exploitation has been observed, historically, high-performance routing infrastructure is a prime target due to its control-plane visibility and network centrality.

Recommended actions:
– Immediate patch validation
– Control-plane traffic monitoring
– Service exposure review
– Network segmentation validation
– Threat hunting for anomalous routing behavior
Are infrastructure devices integrated into your continuous detection engineering pipeline?

Source: https://www.securityweek.com/juniper-networks-ptx-routers-affected-by-critical-vulnerability/

Engage below.
Follow TechNadu for high-signal vulnerability intelligence.
Repost to strengthen security awareness.

#Infosec #CVE2026 #Juniper #RouterSecurity #CriticalInfrastructure #ThreatModeling #DetectionEngineering #NetworkDefense #ZeroTrustArchitecture #CyberRisk #SecurityOperations #VulnerabilityManagement

Critical Root RCE Vulnerability Patched in Juniper PTX Series Routers

Juniper Networks patched a critical vulnerability (CVE-2026-21902) in Junos OS Evolved on PTX Series routers that allows unauthenticated attackers to gain root access via a framework that should have been internal but is publicly exposed and not authenticated.

**If you are using Junos OS Evolved, this is important. Either immediately patch your PTX Series routers or disable the 'On-Box Anomaly Detection' service. Depending on configuration, review if you can isolate the network devices from the public internet to mitigate the impact.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-root-rce-vulnerability-patched-in-juniper-ptx-series-routers-i-9-2-e-h/gD2P6Ple2L

The security issue is identified as CVE-2026-21902 and is caused by incorrect permission assignment in the ‘On-Box Anomaly Detection’ framework, which should be exposed to internal processes only over the internal routing interface. bleepingcomputer.com/news/security/critical-juniper-networks-ptx-flaw-allows-full-router-takeover/

A single mistake in Juniper PTX routers now lets anyone on the network take full control—no password needed. How safe is the backbone of the internet really?

https://thedefendopsdiaries.com/cve-2026-21902-critical-juniper-ptx-router-flaw-exposes-global-networks/

ServiceNow corrige un RCE crítico en #AI Platform (CVE-2026-0542) y detalla los parches afectados

https://unaaldia.hispasec.com/2026/02/servicenow-corrige-un-rce-critico-en-ai-platform-cve-2026-0542-y-detalla-los-parches-afectados.html?utm_source=rss&amp

🚨 CVE-2026-27497 (CRITICAL, CVSS 9.4): n8n-io n8n code injection via Merge node's SQL query mode. Authenticated users can achieve RCE and write files. Upgrade to v2.10.1/2.9.3/1.123.22 now! https://radar.offseq.com/threat/cve-2026-27497-cwe-94-improper-control-of-generati-7583bd72 #OffSeq #n8n #CodeInjection #Infosec

🟠 CVE-2026-27850 - High (7.5)

Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all services which are normally only accessible through the local network.
This issue affects MR9600: 1.0.4.20...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22719 - High (8.1)

VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted prod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22719/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-27577 in n8n allows authenticated users to inject code & run system commands (CVSS 9.4). Affected: <2.10.1, <2.9.3, <1.123.22. Upgrade ASAP & restrict workflow perms! https://radar.offseq.com/threat/cve-2026-27577-cwe-94-improper-control-of-generati-fe1b37b0 #OffSeq #n8n #vuln #infosec

🟠 CVE-2026-26985 - High (8.1)

LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Starting in version 24.0.0 and prior to versions 26.0.5, 27.0.2, and 28.0.0, an authenti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26985/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27575 - Critical (9.1)

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27575/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25191 - High (7.8)

The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is directed to place a malicious DLL file and the installer to the same directory and execute the installer, arbitrary code may b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25191/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-27498: CRITICAL code injection in n8n-io n8n (<1.123.8, 2.0.0 – 2.2.0). Auth users can exploit workflow/gIT nodes for RCE. Patch to 2.2.0+ or 1.123.8+, restrict permissions, & disable risky nodes now. https://radar.offseq.com/threat/cve-2026-27498-cwe-94-improper-control-of-generati-673d3ea0 #OffSeq #n8n #Vuln #Security

🟠 CVE-2026-1311 - High (8.8)

The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup upload functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1311/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27952 - High (8.8)

Agenta is an open-source LLMOps platform. In Agenta-API prior to version 0.48.1, a Python sandbox escape vulnerability existed in Agenta's custom code evaluator. Agenta used RestrictedPython as a sandboxing mechanism for user-supplied evaluator co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27952/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27961 - High (8.8)

Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in Agenta's API server evaluator template rendering. Although the vulnerable code lives in the SDK package, it is ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22720 - High (8)

VMware Aria Operations contains a stored cross-site scripting vulnerability. A malicious actor with privileges to create custom benchmarks may be able to inject script to perform administrative actions in VMware Aria Operations. 

To remediate CV...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⛔ New security advisory:

CVE-2025-12981 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://yazoul.net/advisory/cve/cve-2025-12981

#Cybersecurity #SecurityPatching #HackerNews

🔴 CVE-2025-12981 - Critical (9.8)

The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in the bundled listee-core plugin's user registration function that fails to properly saniti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12981/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-12981 - Critical (9.8)

The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in the bundled listee-core plugin's user registration function that fails to properly saniti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-12981/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-50857 - Critical (9.8)

ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a crafted file upload

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-50857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-50857 - Critical (9.8)

ZenTaoPMS v18.11 through v21.6.beta is vulnerable to Directory Traversal in /module/ai/control.php. This allows attackers to execute arbitrary code via a crafted file upload