🟠 CVE-2026-125836 - High (8.8)

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-125836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-125836 - High (8.8)

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-125836/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-87772 - High (7.8)

Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation.

This issue affects Pardus About: before 1.2.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87772/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-87772 - High (7.8)

Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows Privilege Escalation.

This issue affects Pardus About: before 1.2.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87772/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-12591 - Critical (9.9)

Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12591/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-12591: CRITICAL missing authorization in Zohocorp M365 Manager Plus (<v4818). Authenticated users can escalate privileges & achieve RCE. Patch to v4818 ASAP. https://radar.offseq.com/threat/cve-2026-12591-cwe-862-missing-authorization-in-zohocorp-m365-manager-plus-e798505f80da0052 #OffSeq #Vuln #RCE #ManageEngine #PatchTuesday

🔴 CVE-2026-12591 - Critical (9.9)

Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12591/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-12591: CRITICAL missing authorization in Zohocorp M365 Manager Plus (<v4818). Authenticated users can escalate privileges & achieve RCE. Patch to v4818 ASAP. https://radar.offseq.com/threat/cve-2026-12591-cwe-862-missing-authorization-in-zohocorp-m365-manager-plus-e798505f80da0052 #OffSeq #Vuln #RCE #ManageEngine #PatchTuesday

🔴 CVE-2026-12507 - Critical (9.1)

Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerabil...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12507/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-12507 - Critical (9.1)

Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerabil...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12507/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101107 - High (8)

An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp. Arbitrary commands may be executed with the root privilege by a user who can log in to the web management console of the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101107/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-101107: HIGH severity OS command injection in SoftBank Air Terminal 6 (0 – 1.01.80) allows authenticated console users root command execution 🖥️. Patch status unconfirmed — restrict access & monitor logs. https://radar.offseq.com/threat/cve-2026-101107-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-bcce6251ee5f1a39 #OffSeq #Vulnerability #SoftBank #InfoSec

🟠 CVE-2026-101107 - High (8)

An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp. Arbitrary commands may be executed with the root privilege by a user who can log in to the web management console of the affected product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101107/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-101107: HIGH severity OS command injection in SoftBank Air Terminal 6 (0 – 1.01.80) allows authenticated console users root command execution 🖥️. Patch status unconfirmed — restrict access & monitor logs. https://radar.offseq.com/threat/cve-2026-101107-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-bcce6251ee5f1a39 #OffSeq #Vulnerability #SoftBank #InfoSec

🟠 CVE-2026-85101 - High (8.6)

An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, wr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85101 - High (8.6)

An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, wr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81584 - High (8.1)

An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81584/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81584 - High (8.1)

An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with control over a compromised LDAP or Active...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81584/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76954 - Critical (9.8)

An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or wr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76954/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76954 - Critical (9.8)

An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or wr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76954/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-74857 - High (8.8)

A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-74857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-74857 - High (8.8)

A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-74857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18633 - High (7.5)

An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct denial-of-service attacks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18633/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18633 - High (7.5)

An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct denial-of-service attacks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18633/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121743 - High (7.8)

Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is requir...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121743/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121743 - High (7.8)

Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is requir...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121743/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-118632 - High (8)

Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118632/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-118632 - High (8)

Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge Pro. Although authentication is required to ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118632/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-13270 - High (7.5)

Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13270/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-13270 - High (7.5)

Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is not required t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13270/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-13269 - High (7.5)

Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13269/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-13269 - High (7.5)

Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Quest NetVault Backup. Authentication is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13269/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121753 - High (7.8)

Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121753/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121753 - High (7.8)

Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121753/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-126785 - High (8.8)

A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carrie...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-126785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-126785: CRITICAL vuln (CVSS 9.3) in rmalright TR-VISION HOME v2.0.5 from incorrect default IOCTL Handler permissions in WFanManager.sys. Local access needed. No patch. Restrict privileges and monitor. https://radar.offseq.com/threat/cve-2026-126785-incorrect-default-permissions-in-rmalright-tr-vision-home-c44a57e70b92761b #OffSeq #Vuln #PrivilegeEscalation

🟠 CVE-2026-126785 - High (8.8)

A vulnerability has been found in rmalright TR-VISION HOME 2.0.5. Impacted is the function sub_11504 in the library WFanManager.sys of the component IOCTL Handler. Such manipulation leads to incorrect default permissions. The attack must be carrie...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-126785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-126785: CRITICAL vuln (CVSS 9.3) in rmalright TR-VISION HOME v2.0.5 from incorrect default IOCTL Handler permissions in WFanManager.sys. Local access needed. No patch. Restrict privileges and monitor. https://radar.offseq.com/threat/cve-2026-126785-incorrect-default-permissions-in-rmalright-tr-vision-home-c44a57e70b92761b #OffSeq #Vuln #PrivilegeEscalation

🟠 CVE-2026-122044 - High (8.8)

Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge Pro. Authentication is not requi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-122044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-122044 - High (8.8)

Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge Pro. Authentication is not requi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-122044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121744 - High (7.8)

Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is requi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121744 - High (7.8)

Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is requi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121742 - High (7.8)

Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121742/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121742 - High (7.8)

Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121742/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121741 - High (7.8)

Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121741/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121741 - High (7.8)

Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp. User interaction is required to exploit this ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121741/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Google Chrome security update 157.0.8103.78 fixes 83 flaws, including five Critical use-after-free bugs such as CVE-2026-126885. Update Chrome now.

#Chrome #GoogleChrome #UseAfterFree #V8 #BrowserSecurity #PatchNow #CyberSecurity #InfoSec

https://securityonline.info/chrome-security-update-157-0-8103-78/?utm_source=mastodon&utm_medium=jetpack_social

Google Chrome security update 157.0.8103.78 fixes 83 flaws, including five Critical use-after-free bugs such as CVE-2026-126885. Update Chrome now.

#Chrome #GoogleChrome #UseAfterFree #V8 #BrowserSecurity #PatchNow #CyberSecurity #InfoSec

https://securityonline.info/chrome-security-update-157-0-8103-78/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-126855 – HIGH severity in Chrome ImageCapture (<157.0.8103.78): Compromised renderer can bypass web origin policy, risking unauthorized access. Update Chrome ASAP. https://radar.offseq.com/threat/cve-2026-126855-cwe-862-missing-authorization-in-google-chrome-e1f03524124b863b #OffSeq #Chrome #Infosec #Vulnerability

CVE-2026-126855 – HIGH severity in Chrome ImageCapture (<157.0.8103.78): Compromised renderer can bypass web origin policy, risking unauthorized access. Update Chrome ASAP. https://radar.offseq.com/threat/cve-2026-126855-cwe-862-missing-authorization-in-google-chrome-e1f03524124b863b #OffSeq #Chrome #Infosec #Vulnerability

🟠 CVE-2026-68539 - High (7.5)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per elem...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-68539 - High (7.5)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.4.4 to before version 0.29.0, the CSS string-set named-string values resolved from a document were accumulated per elem...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Node.js security updates are now available

Node.js 프로젝트가 2026년 11월 11일자 보안 릴리스로 26.x, 24.x, 22.x 라인의 취약점을 패치했다. llhttp, undici, sqlite 의존성 업데이트와 함께 HTTP/2·TLS 관련 high 등급 취약점이 다수 포함됐다. 인증 없는 클라이언트가 서버를 중단시키거나, TLS 개인 키를 포함한 다른 연결의 힙 메모리를 읽거나, 메모리와 파일 디스크립터를 누수시킬 수 있고, TLS 1.2 재협상으로 클라이언트 인증서 인증을 우회할 수도 있다(CVE-2026-123863~123874, CVE-2026-126051 등). 여러 건은 Chris Rohlf...

https://nodejs.org/en/blog/vulnerability/november-2026-security-releases

Node.js security updates are now available

Node.js 프로젝트가 2026년 11월 11일자 보안 릴리스로 26.x, 24.x, 22.x 라인의 취약점을 패치했다. llhttp, undici, sqlite 의존성 업데이트와 함께 HTTP/2·TLS 관련 high 등급 취약점이 다수 포함됐다. 인증 없는 클라이언트가 서버를 중단시키거나, TLS 개인 키를 포함한 다른 연결의 힙 메모리를 읽거나, 메모리와 파일 디스크립터를 누수시킬 수 있고, TLS 1.2 재협상으로 클라이언트 인증서 인증을 우회할 수도 있다(CVE-2026-123863~123874, CVE-2026-126051 등). 여러 건은 Chris Rohlf...

https://nodejs.org/en/blog/vulnerability/november-2026-security-releases

Panorama: Sicherheitslücke CVE-2026-0330 erlaubt Codeausführung mit Root-Rechten

Palo Alto Networks hat am 11. November 2026 einen Sicherheitshinweis zu einer Schwachstelle in der PAN-OS-Software veröffentlicht, die auf Panorama läuft. Sie erlaubt es einem authentifizierten Administrator mit Netzwerkzugriff, beliebigen Code mit Root-Rechten auszuführen. Der Hersteller empfiehlt, betroffene Installationen zu patchen.

https://shorturl.at/6U7rF
#schwachstellen #sicherheitsupdates #security

TIL by default the apache installation on Debian doesn't enabled HTTP/2 support.

Went looking into this since the critical apache vulnerability from yesterday (https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability) sounds bad.

#apache #debian

Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know | Wiz Blog
https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

Critical RCE Vulnerability in Apache HTTP Server https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

The programming mistake behind CVE-2026-119618 is C, but not C.

Had the code used malloc/free(), all would have been fine. But Apache httpd‘s runtime uses its own memory pools. These are not thread safe:

If you allocate memory from two threads you can corrupt the pools. Just via the allocate calls alone.

The pools are kept internally in several data structures and not visible in calls. Modify the „wrong“ hashtable and things explode under load.

Footguns.

As far as I know, CVE-2026-119618, the Apache mod_http2 RCE vulnerability, is not exploitable on a typical installation. It can crash your processes, of course.

@GossiTheDog has further details.
#apache #httpd

Apache httpd 2.4.71 Fixes Critical HTTP/2 RCE (CVE-2026-119618): Root Cause, Detection and Patch Guide

https://thecybersecguru.com/news/apache-httpd-2-4-71-cve-2026-119618-http2-rce/

Critical RCE Vulnerability in Apache HTTP Server

Link: https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
Discussion: https://news.ycombinator.com/item?id=50462177

Apache Flaw Exposes Servers to Remote Code Execution

A critical bug in Apache HTTP Server's HTTP/2 module, tracked as CVE-2026-119618, allows unauthenticated remote attackers to run code on vulnerable servers, giving them full control of the server process. This severe flaw, rated 9.8 out of 10 on the CVSS scale, affects Apache HTTP Server releases 2.4.55 through 2.4.70.

https://osintsights.com/apache-flaw-exposes-servers-to-remote-code-execution?utm_source=mastodon&utm_medium=social

#Cve2026119618 #ApacheHttpServer #RemoteCodeExecution #Http2 #Modhttp2

Critical #RCE #Vulnerability in #Apache HTTP Server https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

A severe remote code execution vulnerability has been identified in Apache HTTP Server's mod_http2 module, affecting versions 2.4.55 through 2.4.70 on servers with HTTP/2 enabled.

Tracked as CVE-2026-119618, the flaw has been rated 9.8 out of 10 by Red Hat.

Version 2.4.71 addresses the issue, and administrators unable to update immediately are advised to remove h2 and h2c from their Protocols directive.

https://en.hacks.gr/krisimo-provlima-asfaleias-ston-apache-server-me-kindyno-apomakrysmenis-prosvasis/

#Apache #HTTP2 #CVE2026119618 #RedHat

Critical RCE Vulnerability in Apache HTTP Server

Link: https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
Discussion: https://news.ycombinator.com/item?id=50462177

Critical RCE Vulnerability in Apache HTTP Server
Link: https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
Comments: https://news.ycombinator.com/item?id=50462177

Critical RCE Vulnerability in Apache HTTP Server - https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

#hackernews

Critical RCE Vulnerability in Apache HTTP Server

https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

Comments: https://news.ycombinator.com/item?id=50462177

#HackerNews

Critical RCE Vulnerability in Apache HTTP Server

https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

#apache

SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2
https://isc.sans.edu/podcastdetail/10176

The programming mistake behind CVE-2026-119618 is C, but not C.

Had the code used malloc/free(), all would have been fine. But Apache httpd‘s runtime uses its own memory pools. These are not thread safe:

If you allocate memory from two threads you can corrupt the pools. Just via the allocate calls alone.

The pools are kept internally in several data structures and not visible in calls. Modify the „wrong“ hashtable and things explode under load.

Footguns.

As far as I know, CVE-2026-119618, the Apache mod_http2 RCE vulnerability, is not exploitable on a typical installation. It can crash your processes, of course.

@GossiTheDog has further details.
#apache #httpd

Apache httpd 2.4.71 Fixes Critical HTTP/2 RCE (CVE-2026-119618): Root Cause, Detection and Patch Guide

https://thecybersecguru.com/news/apache-httpd-2-4-71-cve-2026-119618-http2-rce/

Critical RCE Vulnerability in Apache HTTP Server

Link: https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
Discussion: https://news.ycombinator.com/item?id=50462177

Critical #RCE #Vulnerability in #Apache HTTP Server https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

Critical RCE Vulnerability in Apache HTTP Server

Link: https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
Discussion: https://news.ycombinator.com/item?id=50462177

Critical RCE Vulnerability in Apache HTTP Server
Link: https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
Comments: https://news.ycombinator.com/item?id=50462177

Critical RCE Vulnerability in Apache HTTP Server

https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

Comments: https://news.ycombinator.com/item?id=50462177

#HackerNews

Critical RCE Vulnerability in Apache HTTP Server

https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability

#apache

SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2
https://isc.sans.edu/podcastdetail/10176

SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2
https://isc.sans.edu/podcastdetail/10176

SANS Stormcast Thursday, November 12th, 2026: Apache mod_http2 RCE (CVE-2026-119618); Fortinet FortiMail Criticals; Ivanti EPM SQLi (CVE-2026-121653); Windows SignDrop CLFS; N-able N-central HF2
https://isc.sans.edu/podcastdetail/10176

Go 1.27.4 and 1.26.11 deliver 12 Go security fixes, blocking cgo code execution at build time (CVE-2026-97033) and an HTTP/1 server crash.

#Golang #Go #cgo #SupplyChainSecurity #RCE #CVE202697033 #CyberSecurity #InfoSec

https://securityonline.info/go-security-fixes-1-27-4/?utm_source=mastodon&utm_medium=jetpack_social

Go 1.27.4 and 1.26.11 deliver 12 Go security fixes, blocking cgo code execution at build time (CVE-2026-97033) and an HTTP/1 server crash.

#Golang #Go #cgo #SupplyChainSecurity #RCE #CVE202697033 #CyberSecurity #InfoSec

https://securityonline.info/go-security-fixes-1-27-4/?utm_source=mastodon&utm_medium=jetpack_social

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-20320 – Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability

Executive risk and governance perspective on CVE-2026-20320, providing leadership with actionable compliance strategies, asset integrity audits, and boardroom oversight metrics....

https://thecybermind.co/ykr1

(CISA TS-MAN) The Cyber Mind TSUITE Brief: CVE-2026-20320 – Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability

Actionable threat intelligence on CVE-2026-20320 targeting Cisco BroadWorks, featuring verified detection queries and endpoint hardening guidance....

https://thecybermind.co/baqb

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-20320 – Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability

Executive risk and governance perspective on CVE-2026-20320, providing leadership with actionable compliance strategies, asset integrity audits, and boardroom oversight metrics....

https://thecybermind.co/ykr1

(CISA TS-MAN) The Cyber Mind TSUITE Brief: CVE-2026-20320 – Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability

Actionable threat intelligence on CVE-2026-20320 targeting Cisco BroadWorks, featuring verified detection queries and endpoint hardening guidance....

https://thecybermind.co/baqb

『Chrome 曝出高危 0day 漏洞：已遭黑客实际利用，Google 紧急发布更新｜CVE-2026-125350』
Google Chrome 浏览器曝出一个已经被黑客实际利用的高危漏洞：CVE-2026-125350，高危，8.8分。 该漏洞编号 CVE-2026-125350，存在于 Chrome 的 XML
……
阅读全文： :sys_link: https://www.appinn.com/chrome-cve-2026-125350-zero-day-exploit/

#小众软件

Meanwhile, Vivaldi had an update within 24 hours:

The Chromium update includes a fix for CVE-2026-125350 (Use after free in XML), which has a known exploit in the wild.

https://vivaldi.com/blog/desktop/minor-update-two-8-3/

Microsoft Edge now has a patch for the Google Chromium Use-After-Free zero-day:

The Chromium team reported that CVE-2026-125350 has an exploit in the wild, and this update contains a fix for it.

https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#november-11-2026

『Chrome 曝出高危 0day 漏洞：已遭黑客实际利用，Google 紧急发布更新｜CVE-2026-125350』
Google Chrome 浏览器曝出一个已经被黑客实际利用的高危漏洞：CVE-2026-125350，高危，8.8分。 该漏洞编号 CVE-2026-125350，存在于 Chrome 的 XML
……
阅读全文： :sys_link: https://www.appinn.com/chrome-cve-2026-125350-zero-day-exploit/

#小众软件

Meanwhile, Vivaldi had an update within 24 hours:

The Chromium update includes a fix for CVE-2026-125350 (Use after free in XML), which has a known exploit in the wild.

https://vivaldi.com/blog/desktop/minor-update-two-8-3/

Microsoft Edge now has a patch for the Google Chromium Use-After-Free zero-day:

The Chromium team reported that CVE-2026-125350 has an exploit in the wild, and this update contains a fix for it.

https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#november-11-2026

📰 Microsoft Patches Actively Exploited Outlook Zero-Day in Massive Update

Microsoft patches actively exploited Outlook zero-day CVE-2026-124194 in its massive November Patch Tuesday update. The flaw allows attackers to steal NTLM hashes. CISA has added it to the KEV catalog. #PatchTuesday #Outlook #ZeroDay #Cybersecurity

🔗 https://cyber.netsecops.io/articles/microsoft-patches-outlook-zero-day-cve-2026-124194-in-november-update/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Microsoft Discloses 1,094 Bugs, Warns of Actively Exploited Outlook Flaw

Microsoft just dropped a major security alert, revealing 1,094 bugs fixed in its latest Patch Tuesday release - and warning of a critical Outlook flaw that's already being exploited by hackers. The vulnerability, CVE-2026-124194, lets attackers cleverly disguise malicious messages, potentially exposing…

https://osintsights.com/microsoft-discloses-1094-bugs-warns-of-actively-exploited-outlook-flaw?utm_source=mastodon&utm_medium=social

#MicrosoftPatchTuesday #Cve2026124194 #OutlookFlaw #ActivelyExploited #EmergingThreats

CW: sebezhetőség — A Microsoft novemberi Patch Keddjén >1000 hibát hoztak nyilvánosságra; egyet aktívan kihasználnak: CVE-2026-124194 (Outlook) — speciális üzenetfájl hitelesítési adatok kiszivárgásához vezethet. CISA felvette a KEV-be, határidő a hónap végéig. Barracuda: CVE-2026-116606, CVE-2026-111560. #Microsoft #CVE #CISA #infosec #Outlook
https://linuxmint.hu/hir/2026/11/a-microsoft-novemberi-frissitesei-tobb-mint-ezer-serulekenyseget-erintenek

Barracuda Email Security Gateway: due falle corrette il 2/11 risultano sfruttate in attacchi reali.

CVE-2026-116606: bypass dell'autorizzazione senza login (serve l'Admin UI raggiungibile). CVE-2026-111560: command injection, anche su WAF, ADC, Message Archiver, WSG. In catena: root.

CISA KEV dal 10/11, scadenza FCEB 13/11. Nessun IOC pubblico.

Da fare: verificare la patch, togliere l'Admin UI da internet.

https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

#Barracuda #infosec #blueteam

CW: sebezhetőség — A Microsoft novemberi Patch Keddjén >1000 hibát hoztak nyilvánosságra; egyet aktívan kihasználnak: CVE-2026-124194 (Outlook) — speciális üzenetfájl hitelesítési adatok kiszivárgásához vezethet. CISA felvette a KEV-be, határidő a hónap végéig. Barracuda: CVE-2026-116606, CVE-2026-111560. #Microsoft #CVE #CISA #infosec #Outlook
https://linuxmint.hu/hir/2026/11/a-microsoft-novemberi-frissitesei-tobb-mint-ezer-serulekenyseget-erintenek

Barracuda Email Security Gateway: due falle corrette il 2/11 risultano sfruttate in attacchi reali.

CVE-2026-116606: bypass dell'autorizzazione senza login (serve l'Admin UI raggiungibile). CVE-2026-111560: command injection, anche su WAF, ADC, Message Archiver, WSG. In catena: root.

CISA KEV dal 10/11, scadenza FCEB 13/11. Nessun IOC pubblico.

Da fare: verificare la patch, togliere l'Admin UI da internet.

https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

#Barracuda #infosec #blueteam

CW: sebezhetőség — A Microsoft novemberi Patch Keddjén >1000 hibát hoztak nyilvánosságra; egyet aktívan kihasználnak: CVE-2026-124194 (Outlook) — speciális üzenetfájl hitelesítési adatok kiszivárgásához vezethet. CISA felvette a KEV-be, határidő a hónap végéig. Barracuda: CVE-2026-116606, CVE-2026-111560. #Microsoft #CVE #CISA #infosec #Outlook
https://linuxmint.hu/hir/2026/11/a-microsoft-novemberi-frissitesei-tobb-mint-ezer-serulekenyseget-erintenek

CVE-2026-18869: IBM i 7.3-7.6 lets authenticated attackers bypass security via FTP PORT/EPRT validation flaws, reaching internal network services. CVSS 6.4, no patch confirmed. Check exposure and restrict FTP access now. #CVE #infosec #IBM https://www.valtersit.com/cve/CVE-2026-18869/

CVE-2026-91142 Cockpit integer overflow in do_lastlog() on ILP32 builds lets a low-priv user with a large UID read and write other users' lastlog records. CVSS 3.6, no patch yet. Review exposure and restrict access now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-91142/

CVE-2026-93562: Netty HTTP/1 decoder request smuggling via malformed Transfer-Encoding headers, CVSS 6.5. Patch is still under review, so track vendor guidance and apply the fix when released #CVE #infosec #Netty https://www.valtersit.com/cve/CVE-2026-93562/

@sigint Old news. Has been released in 22.04 and higher since yesterday:
https://ubuntu.com/security/CVE-2026-98432

🐧 SIGINT // Ubuntu Watch — 2026-11-12

Primary source from Canonical on a Linux kernel CVE. Fixes sit in the proposed pocket, so they are not in stable updates yet. Homelabbers can test them on a non-critical box, or wait for the stable release, and plan a reboot. Don't rely on upstream fix status alone.

🔗 https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432

#Ubuntu #Linux #infosec

CVE-2026-118669 – HIGH severity in python-oauthlib affects RHEL 9.8 EUS+; allows privilege escalation via client identity confusion in OAuth token grants. Update to 3.1.1-5.el9_8.1 ASAP. https://radar.offseq.com/threat/red-hat-security-advisory-python-oauthlib-security-update-cb303aa14cf05295 #OffSeq #RedHat #Vuln #OAuth #Linux

CVE-2026-118669 – HIGH severity in python-oauthlib affects RHEL 9.8 EUS+; allows privilege escalation via client identity confusion in OAuth token grants. Update to 3.1.1-5.el9_8.1 ASAP. https://radar.offseq.com/threat/red-hat-security-advisory-python-oauthlib-security-update-cb303aa14cf05295 #OffSeq #RedHat #Vuln #OAuth #Linux

CVE-2026-82885: IBM Guardium Data Protection 12.2 missing authorization in REST API lets remote authenticated attackers gain elevated privileges. CVSS 8.8, no patch yet. Restrict API access and monitor closely. #CVE #infosec #IBM https://www.valtersit.com/cve/CVE-2026-82885/

CVE-2026-80521: Use-after-free in AF_UNIX ermöglicht Rechteausweitung im Linux-Kernel

Für die Schwachstelle CVE-2026-80521 im Linux-Kernel liegen seit Kurzem technische Details und ein funktionierender Exploit vor. Betroffen ist die Garbage Collection von AF_UNIX-Sockets. Lokale Nutzer können sich damit Root-Rechte verschaffen. Korrigierte Kernel-Versionen stehen bereit.

https://www.all-about-security.de/cve-2026-80521-use-after-free-in-af_unix-ermoeglicht-rechteausweitung-im-linux-kernel/

#linux

A public exploit for CVE-2026-80521, an AF_UNIX use-after-free, enables Linux kernel privilege escalation. Fixed in 7.1.10, 6.12.111 and 7.2.

#Linux #LinuxKernel #CVE202680521 #PrivilegeEscalation #kernelCTF #PoC #CyberSecurity #InfoSec

https://securityonline.info/cve-2026-80521-linux-kernel-privilege-escalation/?utm_source=mastodon&utm_medium=jetpack_social

A public exploit for CVE-2026-80521, an AF_UNIX use-after-free, enables Linux kernel privilege escalation. Fixed in 7.1.10, 6.12.111 and 7.2.

#Linux #LinuxKernel #CVE202680521 #PrivilegeEscalation #kernelCTF #PoC #CyberSecurity #InfoSec

https://securityonline.info/cve-2026-80521-linux-kernel-privilege-escalation/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-76901: CordysCRM prior to 1.7.4 has an IDOR letting any pool-read user pull other records by id. CVSS 5.8. Patch still under review, so watch for 1.7.4 and apply promptly. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-76901/

CVE-2026-61723: FluidSynth DLS parser integer overflow triggers ~4GB allocation, crashing the parser via crafted file (DoS), CVSS 6.8. Fixed in 2.5.6. Update now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-61723/

CVE-2026-93763 MongoDB: CSFLE config flaw silently stores fields in cleartext, exposing data to any read-access user. CVSS 6.5. Patch under review - audit your encryption config now. #CVE #infosec #MongoDB https://www.valtersit.com/cve/CVE-2026-93763/

🟠 CVE-2026-67547 - High (8.8)

taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes built-in skills — including the code_exec skill which runs arbitrary Python via subprocess.run(["python3", "-c"...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67547/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67547 - High (8.8)

taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes built-in skills — including the code_exec skill which runs arbitrary Python via subprocess.run(["python3", "-c"...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67547/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67546 - High (8.8)

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.75, the same POST /api/mcp/fetch-tools endpoint (any authenticated user, lowest role) also accepts the stdio transport, which...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67546/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67546 - High (8.8)

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.75, the same POST /api/mcp/fetch-tools endpoint (any authenticated user, lowest role) also accepts the stdio transport, which...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67546/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67544 - High (8.8)

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.71, Heym's workflow engine accepts an arbitrary Python code string in the playwrightCode field of a Playwright node. This str...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67544 - High (8.8)

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.71, Heym's workflow engine accepts an arbitrary Python code string in the playwrightCode field of a Playwright node. This str...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-68540 - High (7.5)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-posit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68540/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-68540 - High (7.5)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.6.0 to before version 0.33.0, quadratic style-list reprocessing during containing-block resolution for absolutely-posit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68540/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-68538 - High (7.5)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.15.0 to before version 0.27.0, resolving the CSS counters(name, sep) function in generated content was bounded neither ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-68538 - High (7.5)

fulgur converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. From version 0.15.0 to before version 0.27.0, resolving the CSS counters(name, sep) function in generated content was bounded neither ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack