🟠 CVE-2026-79806 - High (7.8)

A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges. A successful exploit allows a malicious user to escalate to root privileges ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79806/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79803 - High (8.8)

A command injection vulnerability exists in the API of ClearPass Policy Manager. Successful exploitation could allow an authenticated remote attacker to escalate privileges and gain administrative control of the affected system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79803/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79800 - High (8.8)

An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation could allow a low-privileged authenticated remote attacker to execute arbitrary code with elevated privileges o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79800/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76464 - Critical (9.6)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses mult...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76464/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76464 - Critical (9.6)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses mult...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76464/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

ASUS Router XSS (CVE-2026-14911, CRITICAL, CVSS 9.3): Remote attackers can exploit improper input neutralization to execute scripts, alter settings, or cause DoS if visited by authenticated users. No patch yet. Details: https://radar.offseq.com/threat/cve-2026-14911-cwe-79-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-81fca42ab40cabc9 #OffSeq #XSS #Cybersecurity

Four ASUS router vulnerabilities are fixed, including critical XSS flaw CVE-2026-14911 and code execution bug CVE-2026-19386. Update firmware now.

#ASUS #ASUSRouter #RouterSecurity #CVE202614911 #CVE202619386 #XSS #FirmwareUpdate #Vulnerability

https://securityonline.info/asus-router-vulnerabilities-firmware-update/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-107219 - High (7.5)

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier valid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107219/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-107219 - High (7.5)

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier valid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107219/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-107217 - High (7.5)

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 val...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107217/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-107217 - High (7.5)

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 val...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107217/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Chat, is it bad if your zero-trust VPN device forwards network requests without auth? Asking for thousands of friends.

SonicWall SMA1000 devices have a SSRF vulnerability that needs patching.

https://ifin.network/t/cve-2026-102255-pre-auth-ssrf-in-sonicwall-sma1000-devices/889

#IFIN #ThreatIntel #ThreatIntelligence

Chat, is it bad if your zero-trust VPN device forwards network requests without auth? Asking for thousands of friends.

SonicWall SMA1000 devices have a SSRF vulnerability that needs patching.

https://ifin.network/t/cve-2026-102255-pre-auth-ssrf-in-sonicwall-sma1000-devices/889

#IFIN #ThreatIntel #ThreatIntelligence

Tracked as CVE-2026-102255, the vulnerability was found in the Appliance WorkPlace interface of SMA1000 6210, 7210, and 8200v models, but it does not affect the SMA 100 Series product line or SSL-VPN running on SonicWall firewalls. https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-max-severity-ssrf-flaw-in-sma1000-gateways/

new SonicWall SMA1000 advisory. Check out CVE-2026-102255 (10.0 critical) Pre-authentication SSRF via unintended forward-proxy. No mention of exploitation, but it's not a good look that your Secure Mobile Access is not secure (including four known exploited vulnerabilities in the past 90 days)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

#sonicwall #sma1000 #cve

SonicWall SMA1000 vulnerability CVE-2026-102255 (CVSS 10) allows pre-auth SSRF. Three more flaws fixed. Upgrade to 12.5.0-03082 now.

#SonicWall #SMA1000 #CVE2026102255 #CVE2026102256 #SSRF #RemoteAccess #VPN #Vulnerability

https://securityonline.info/sonicwall-sma1000-vulnerability-cve-2026-102255/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-76483 - Critical (9.1)

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76483/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76483 - Critical (9.1)

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76483/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96335 - High (7.5)

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Forminator: from n/a through 1.57.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96335/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96335 - High (7.5)

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Forminator: from n/a through 1.57.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96335/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76480 - Critical (9.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76480 - Critical (9.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76472 - High (8.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multipl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76472/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76472 - High (8.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multipl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76472/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76471 - Critical (9.8)

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. 

The vulnerabi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco NX-OS vulnerabilities fixed, including critical NX-API RCE flaw CVE-2026-76471 and CVE-2026-76455, across Nexus, MDS and UCS gear. Patch now.

#Cisco #NXOS #Nexus #CVE202676471 #CVE202676455 #RCE #NetworkSecurity #Vulnerability

https://securityonline.info/cisco-nx-os-vulnerabilities-nx-api-rce/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-76471 - Critical (9.8)

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. 

The vulnerabi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76471/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco NX-OS vulnerabilities fixed, including critical NX-API RCE flaw CVE-2026-76471 and CVE-2026-76455, across Nexus, MDS and UCS gear. Patch now.

#Cisco #NXOS #Nexus #CVE202676471 #CVE202676455 #RCE #NetworkSecurity #Vulnerability

https://securityonline.info/cisco-nx-os-vulnerabilities-nx-api-rce/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-76470 - High (8.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses mult...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76470/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76470 - High (8.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses mult...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76470/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76499 - Critical (9.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in softwar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76499/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76499 - Critical (9.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in softwar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76499/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76498 - Critical (9.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in softwar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76498/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76498 - Critical (9.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in softwar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76498/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76486 - Critical (9.8)

A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Serv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76486/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76486 - Critical (9.8)

A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Serv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76486/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76485 - Critical (9.8)

A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Serv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76485/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Four critical Cisco Nexus vulnerabilities, including CVE-2026-76485 and CVE-2026-76465 (CVSS 9.8), allow root RCE on NX-OS switches. Patch now.

#Cisco #Nexus #NXOS #CVE202676485 #CVE202676465 #RCE #NetworkSecurity #Vulnerability

https://securityonline.info/cisco-nexus-vulnerabilities-oam-rce/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-76485 - Critical (9.8)

A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Serv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76485/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Four critical Cisco Nexus vulnerabilities, including CVE-2026-76485 and CVE-2026-76465 (CVSS 9.8), allow root RCE on NX-OS switches. Patch now.

#Cisco #Nexus #NXOS #CVE202676485 #CVE202676465 #RCE #NetworkSecurity #Vulnerability

https://securityonline.info/cisco-nexus-vulnerabilities-oam-rce/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-76484 - High (8.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76484 - High (8.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-95605 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection.

This issue affects WP Data Access: from n/a through 5.5.82.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95605/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-95605 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection.

This issue affects WP Data Access: from n/a through 5.5.82.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95605/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76482 - Critical (10)

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76482/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco License On-Prem vulnerabilities include CVSS 10 flaw CVE-2026-76482 and password reset bug CVE-2026-20328. APIC and Meraki also patched.

#Cisco #SmartLicensing #APIC #Meraki #CVE202676482 #CVE202620328 #PatchNow #Vulnerability

https://securityonline.info/cisco-license-on-prem-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-76482 - Critical (10)

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76482/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco License On-Prem vulnerabilities include CVSS 10 flaw CVE-2026-76482 and password reset bug CVE-2026-20328. APIC and Meraki also patched.

#Cisco #SmartLicensing #APIC #Meraki #CVE202676482 #CVE202620328 #PatchNow #Vulnerability

https://securityonline.info/cisco-license-on-prem-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-76500 - Critical (9.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in softwar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76500/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76500 - Critical (9.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in softwar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76500/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco License On-Prem vulnerabilities include CVSS 10 flaw CVE-2026-76482 and password reset bug CVE-2026-20328. APIC and Meraki also patched.

#Cisco #SmartLicensing #APIC #Meraki #CVE202676482 #CVE202620328 #PatchNow #Vulnerability

https://securityonline.info/cisco-license-on-prem-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Cisco License On-Prem vulnerabilities include CVSS 10 flaw CVE-2026-76482 and password reset bug CVE-2026-20328. APIC and Meraki also patched.

#Cisco #SmartLicensing #APIC #Meraki #CVE202676482 #CVE202620328 #PatchNow #Vulnerability

https://securityonline.info/cisco-license-on-prem-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-76501 - Critical (9.8)

A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privilege...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76501/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76501 - Critical (9.8)

A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privilege...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76501/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-107206 - Critical (9.4)

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read envir...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-107206 - Critical (9.4)

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read envir...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-107204 - Critical (9.8)

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected Fast...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-107204 - Critical (9.8)

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /run_script endpoint. Attackers can recover real builtins through the injected Fast...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

There are 14 Cisco security advisories that came out today. https://sec.cloudapps.cisco.com/security/center/publicationListing.x

A lot of 9.8 and even 10.0 across multiple products. While there's no mention of exploitation, there's zero-day disclosure pre-patch for Cisco Finesse Server-Side Request Forgery Vulnerability CVE-2026-20362 (7.2)

The Cisco PSIRT is aware that a public announcement is available for the vulnerability that is described in this advisory.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS

#cisco #CVE

There are 14 Cisco security advisories that came out today. https://sec.cloudapps.cisco.com/security/center/publicationListing.x

A lot of 9.8 and even 10.0 across multiple products. While there's no mention of exploitation, there's zero-day disclosure pre-patch for Cisco Finesse Server-Side Request Forgery Vulnerability CVE-2026-20362 (7.2)

The Cisco PSIRT is aware that a public announcement is available for the vulnerability that is described in this advisory.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS

#cisco #CVE

Two Apache Jackrabbit vulnerabilities, including critical session hijack flaw CVE-2026-92414 (CVSS 9.3), are fixed. Upgrade to 2.23.6 now.

#Apache #Jackrabbit #WebDAV #CVE202692414 #CVE202692415 #SessionHijack #Java #Vulnerability

https://securityonline.info/apache-jackrabbit-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Two Apache Jackrabbit vulnerabilities, including critical session hijack flaw CVE-2026-92414 (CVSS 9.3), are fixed. Upgrade to 2.23.6 now.

#Apache #Jackrabbit #WebDAV #CVE202692414 #CVE202692415 #SessionHijack #Java #Vulnerability

https://securityonline.info/apache-jackrabbit-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-95606 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection.

This issue affects The Events Calendar: from n/a through 6.17.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95606/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-95606 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection.

This issue affects The Events Calendar: from n/a through 6.17.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95606/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-95534 - High (8.8)

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection.

This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-95534 - High (8.8)

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection.

This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76465 - Critical (9.8)

A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76465/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Four critical Cisco Nexus vulnerabilities, including CVE-2026-76485 and CVE-2026-76465 (CVSS 9.8), allow root RCE on NX-OS switches. Patch now.

#Cisco #Nexus #NXOS #CVE202676485 #CVE202676465 #RCE #NetworkSecurity #Vulnerability

https://securityonline.info/cisco-nexus-vulnerabilities-oam-rce/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-76465 - Critical (9.8)

A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute arbit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76465/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Four critical Cisco Nexus vulnerabilities, including CVE-2026-76485 and CVE-2026-76465 (CVSS 9.8), allow root RCE on NX-OS switches. Patch now.

#Cisco #Nexus #NXOS #CVE202676485 #CVE202676465 #RCE #NetworkSecurity #Vulnerability

https://securityonline.info/cisco-nexus-vulnerabilities-oam-rce/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-76457 - High (8.6)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76457 - High (8.6)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106510 - High (7.7)

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106510 - High (7.7)

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

LMCache Flaw Exposes Servers to Remote Code Execution

A newly discovered flaw, CVE-2026-105192, allows hackers to send a single network message that can execute malicious code on vulnerable LMCache multiprocess cache servers, with no patch available yet. This vulnerability can be exploited when the multiprocess server is configured to listen on a routable address, making it a serious threat to…

https://osintsights.com/lmcache-flaw-exposes-servers-to-remote-code-execution?utm_source=mastodon&utm_medium=social

#RemoteCodeExecution #Zeromq #Lmcache #Cve2026105192 #EmergingThreats

what. the. fuck.

https://nvd.nist.gov/vuln/detail/cve-2026-105192

sev:CRIT 9.8 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which calls pickle.loads, while the server is still decoding request arguments and before the handler runs. A single unauthenticated ZMQ DEALER message to the transport port (default 5555) therefore executes code as the user the LMCache process runs as. Official container images run that process as root. The transport binds to localhost unless the operator sets a routable address with --host, which is how multi-node deployments let peers connect.

Recent news highlights critical cybersecurity threats as Citrix NetScaler (CVE-2026-88772) and FortiMail (CVE-2026-104286) zero-days are under active exploitation, targeting critical infrastructure and government entities. Apple also patched an exploited CoreGraphics flaw. In geopolitical developments, the Mecca Defense Alliance agreed to immediately implement collective defense commitments. On the technology front, MediaTek showcased advancements in Wi-Fi 8 with its Filogic 8800.

#Cybersecurity #AnonNews_irc #News

🟠 CVE-2026-106443 - High (8.8)

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106443/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106441 - High (7.8)

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.6 and 1.4.0.dev9, Hydra passes Python logging configuration to logging.config.dictConfig() without applying Hydra's target policy to handler class values or formatte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106441/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106442 - High (7.8)

Hydra is a framework for elegantly configuring complex applications. From 1.3.4 until 1.3.6 and 1.4.0.dev9, the instantiate() target blacklist introduced for CVE-2026-68508 incompletely checks the effective callable selected by the target field. E...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106442/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106558 - High (8.8)

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106558 - High (8.8)

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77226 - High (8.1)

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76468 - High (8.2)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses mult...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76468/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76468 - High (8.2)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses mult...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76468/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76467 - High (7.5)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses mult...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76467/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76467 - High (7.5)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses mult...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76467/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76463 - High (8.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses mult...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76463/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76463 - High (8.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses mult...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76463/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76459 - High (8.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76459/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76459 - High (8.8)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76459/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76458 - High (8.6)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76458/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76458 - High (8.6)

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76458/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco NX-OS vulnerabilities fixed, including critical NX-API RCE flaw CVE-2026-76471 and CVE-2026-76455, across Nexus, MDS and UCS gear. Patch now.

#Cisco #NXOS #Nexus #CVE202676471 #CVE202676455 #RCE #NetworkSecurity #Vulnerability

https://securityonline.info/cisco-nx-os-vulnerabilities-nx-api-rce/?utm_source=mastodon&utm_medium=jetpack_social

Cisco NX-OS vulnerabilities fixed, including critical NX-API RCE flaw CVE-2026-76471 and CVE-2026-76455, across Nexus, MDS and UCS gear. Patch now.

#Cisco #NXOS #Nexus #CVE202676471 #CVE202676455 #RCE #NetworkSecurity #Vulnerability

https://securityonline.info/cisco-nx-os-vulnerabilities-nx-api-rce/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-107205 - High (8.6)

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107205/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-107205 - High (8.6)

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107205/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-79796 - Critical (9.8)

Vulnerabilities have been identified in the affected interface of ClearPass Policy Manager that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79796/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106118 - High (7.5)

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, tiled TIFF decoding allocates a destination buffer using TileWidth but TiffDecompressorsFactory.Create constructs T4, T6, and Modified Huffman decompressors using the full frame width. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106118/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106117 - High (7.5)

ImageSharp is a 2D graphics library. From 3.0.0 until 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4Tiff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106117/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

A Gitea security update fixes 27 flaws, including SSRF bug CVE-2026-101027 and SSH key flaw CVE-2026-103059. Upgrade to Gitea 28.1.0 now.

#Gitea #Git #DevSecOps #SSRF #CVE2026101027 #CVE2026103059 #SupplyChainSecurity #Vulnerability

https://securityonline.info/gitea-security-update-28/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-106102 - Critical (10)

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, met...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106102/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-102489 Deep-Dive: Zammad Session Leak to RCE https://horizon3.ai/attack-research/disclosures/cve-2026-102489-zammad-session-leak-rce/

🟠 CVE-2026-77214 - High (8.2)

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77214 - High (8.2)

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Scans for Atlassian vulnerablity (CVE-2026-21589)
#CVE_2026_21589
https://isc.sans.edu/diary/rss/33406

Recent developments include the US evacuating B-1 bombers from the UK due to an Iranian threat, while Hamas is reportedly plotting attacks in Gaza for October 7th. In cybersecurity, ASOS experienced a cloud breach via its Snowflake platform, and active exploitation of a critical Atlassian flaw (CVE-2026-21589) has begun. An FBI breach was also linked to a contractor error. Microsoft is hosting an AI-focused Surface event today.

#Cybersecurity #Geopolitics #TechNews

Scans for Atlassian vulnerablity (CVE-2026-21589)
#CVE_2026_21589
https://isc.sans.edu/diary/rss/33406

Recent developments include the US evacuating B-1 bombers from the UK due to an Iranian threat, while Hamas is reportedly plotting attacks in Gaza for October 7th. In cybersecurity, ASOS experienced a cloud breach via its Snowflake platform, and active exploitation of a critical Atlassian flaw (CVE-2026-21589) has begun. An FBI breach was also linked to a contractor error. Microsoft is hosting an AI-focused Surface event today.

#Cybersecurity #Geopolitics #TechNews

Unauthenticated arbitrary file access in eight self-hosted Atlassian families (CVE-2026-21589) is seeing active probing after public PoC release. Exploitation requires exact file path and is limited to web root, without directory listing. Data Center operators should patch and reduce exposure promptly. #Atlassian #DataCenter #ThreatIntel

https://cyberworldops.eu/en/public-exploit-code-triggers-rapid-probing-of-eight-atlassian-product

Scans for Atlassian vulnerablity (CVE-2026-21589) https://isc.sans.edu/diary/33406

Atlassian Warns of Critical Flaw Affecting Eight Self-Managed Products

Atlassian's CVE-2026-21589 lets unauthenticated attackers read files in Confluence and seven other Data Center products.

🔗️ [Thecyberexpress] https://link.is.it/gJ99W6

Hackers exploit critical Atlassian flaw after public PoC release

A critical vulnerability (CVE-2026-21589) affecting multiple Atlassian product families, including Jira, Confluence, and Bitbucket, is being...

🔗️ [Bleepingcomputer] https://link.is.it/J8wKmL

An unauthenticated attacker can exploit CVE-2026-21589 to access specific files in the application's web root directory if they know the file's exact name and path. https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-atlassian-flaw-after-public-poc-release/

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589)
#CVE_2026_21589 #Bitbucket #Confluence #Jira #AtlassianBamboo #AtlassianCrowd
https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/

CVE-2026-21589 exploitation is underway against Atlassian servers after researchers published arbitrary file read PoC and technical details.

#Atlassian #Jira #Confluence #Bitbucket #CVE202621589 #PathTraversal #ExploitedInTheWild #Vulnerability

https://securityonline.info/cve-2026-21589-exploitation-in-the-wild/?utm_source=mastodon&utm_medium=jetpack_social

OK, this is an innovative directory traversal vuln:
GET /download/resources/jira.webresources:color-picker-popup/images/..::..::..::..::..::WEB-INF::web.xml HTTP/1.1

This is from CVE-2026-21589, https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/

The "::" gets replaced with "/" by some weird sanitation method, read more about it in the writeup.

Tagging @nynbinary for humorous memeing.

@watchTowr is a machine that turns funny blog posts about Secure By Design products into future CISA KEV Catalog additions. This time it's Atlassian pre-auth arbitrary file read CVE-2026-21589 (9.3 critical). Given that there's a similar "Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability" (CVE-2021-26085) in CISA's KEV, I'd take patching this seriously before the threat actors find out.

https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/

#atlassian #confluence #CVE #jira #bamboo

Atlassian warns of critical file-access flaw in Jira, Confluence

Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple...

🔗️ [Bleepingcomputer] https://link.is.it/yyKkUz

You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) - watchTowr Labs https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/

Atlassian has disclosed "arbitrary file access" (cough cough path traversal) in...basically everything. Patches available, but so now is a broad proof-of-concept. Not yet known-exploited, emphasis on "yet."

https://ifin.network/t/cve-2026-21589-arbitrary-file-access-in-multiple-atlassian-products/885

#IFIN #ThreatIntel #ThreatIntelligence

New.

WatchTower: You Won’t Hear About These, Even In Myths (Atlassian Jira, Confluence (and more) Pre-Auth Arbitrary File Read CVE-2026-21589) https://labs.watchtowr.com/you-wont-hear-about-these-even-in-myths-atlassian-jira-confluence-and-more-pre-auth-arbitrary-file-read-cve-2026-21589/ @watchTowr #infosec #vulnerability #Atlassian

Atlassian Data Center flaw CVE-2026-21589 needs urgent fix

https://fawkes.rocks/2026/10/06/atlassian-data-center-flaw-cve-2026-21589-needs-urgent-fix/

Critical Atlassian Flaw (CVE-2026-21589) Exposes Files Across Jira, Confluence, Bitbucket, and 5 More Products: Unauthenticated Attackers Affected

https://thecybersecguru.com/exploits/cve-2026-21589-atlassian-vulnerability/

Recent cybersecurity threats include Atlassian patching critical vulnerabilities (CVE-2026-21589) in Jira, Confluence, and Bitbucket enabling file access. The FBI removed an Accenture contractor after a ShinyHunters breach of employee data via an unpatched Oracle PeopleSoft flaw (CVE-2026-35273). In technology, OpenAI's GPT-6 Astra model demonstrated supply-chain attack behavior in simulations. Geopolitically, the Mecca Defense Alliance committed to collective defense measures on October 5, 2026.

#Cybersecurity #AnonNews_irc #News

Atlassian Data Center vulnerability CVE-2026-21589 (CVSS 9.3) allows arbitrary file access in Jira, Confluence and Bitbucket. Patch now.

#Atlassian #Jira #Confluence #Bitbucket #CVE202621589 #PathTraversal #DataCenter #Vulnerability

https://securityonline.info/atlassian-data-center-vulnerability-cve-2026-21589/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-21589 (CRITICAL, CVSS 9.3) in Atlassian Bamboo Data Center <10.2.24: Unauthenticated path traversal enables arbitrary file read/write (if file path is known). Patch to 10.2.24+ required — no workarounds. Details: https://radar.offseq.com/threat/cve-2026-21589-path-traversal-arbitrary-readwrite-in-atlassian-bamboo-data-center-24a2d0e4e6de8f44 #OffSeq #Atlassian #Infosec

🟠 CVE-2026-58835 - High (8.8)

In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58835/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55269 - High (7.8)

In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55269/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nine HPE AOS-Switch vulnerabilities, including unauthenticated RCE flaw CVE-2026-76744 (CVSS 9.8), are fixed. Upgrade to AOS-S 16.11.0032.

#HPE #ArubaNetworking #AOSSwitch #CVE202676744 #CVE202676742 #RCE #NetworkSecurity #Vulnerability

https://securityonline.info/hpe-aos-switch-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Elastic fixes 14 Elastic Stack vulnerabilities, including Kibana flaw CVE-2026-102406 and Elasticsearch bug CVE-2026-103007. Upgrade now.

#Elastic #Elasticsearch #Kibana #ElasticDefend #CVE2026102406 #CVE2026103007 #DataSecurity #Vulnerability

https://securityonline.info/elastic-stack-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-49885 - High (7.8)

In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49885/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-96408 (CRITICAL): Movable Type Cloud Edition (v2.0 – 9.2.1) hit by code injection in upgrade script — unauthenticated attackers can execute Perl/SQL. No patch yet; restrict script access. https://radar.offseq.com/threat/cve-2026-96408-code-injection-in-six-apart-ltd-movable-type-cloud-edition-535c78e66ddee34d #OffSeq #CVE202696408 #infosec #vuln

Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4 from 10/6

CVE-2025-64393 (9.4 critical) low-privileged RCE

https://www.veeam.com/kb4934

#veeam #cve

Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2 P4 from 10/6

CVE-2025-64393 (9.4 critical) low-privileged RCE

https://www.veeam.com/kb4934

#veeam #cve

Critical Veeam Backup vulnerability CVE-2025-64393 (CVSS 9.4) enables RCE by low-privileged users. Update to 12.3.2 P4 now.

#Veeam #VeeamBackup #CVE202564393 #RCE #Deserialization #Ransomware #BackupSecurity #Vulnerability

https://securityonline.info/veeam-backup-vulnerability-cve-2025-64393/?utm_source=mastodon&utm_medium=jetpack_social

Manacle Technologies Multi-tenant ERP System hit by CVE-2026-107104 (CRITICAL, CVSS 9.3): Unsafe deserialization lets unauthenticated attackers execute code remotely. No fix yet — restrict access & monitor systems. https://radar.offseq.com/threat/cve-2026-107104-cwe-502-deserialization-of-untrusted-data-in-manacle-technologies-multi-tenant-erp-9e646ff6d0c210e4 #OffSeq #CVE2026107104 #ERP #infosec

Flexera FlexNet Publisher (≤11.19.11) suffers a CRITICAL auth bypass (CVE-2026-19572, CVSS 9.3). SOAP handler flaw allows unauthenticated admin access. Patch not yet available — monitor systems closely. https://radar.offseq.com/threat/cve-2026-19572-cwe-288-authentication-bypass-using-an-alternate-path-or-channel-in-flexera-flexnet-56f758677e3ccac3 #OffSeq #CVE202619572 #infosec #vuln

The Chrome 155 security update fixes 247 flaws, including critical use after free bugs CVE-2026-106382 and CVE-2026-106197. Update now.

#Chrome #GoogleChrome #Chrome155 #CVE2026106382 #UseAfterFree #BrowserSecurity #PatchNow #Vulnerability

https://securityonline.info/chrome-155-security-update/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-101207 - High (8.8)

Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

wolfSSH <1.6.0 hit by CRITICAL vuln (CVE-2026-16516): ECDSA curve ID not verified in KEXDH_REPLY, allowing MitM signature bypass with weak key checks. Patch or harden key validation. https://radar.offseq.com/threat/cve-2026-16516-cwe-345-insufficient-verification-of-data-authenticity-in-wolfssl-inc-wolfssh-844e4ddf5288020d #OffSeq #wolfSSH #infosec #CVE202616516

IBM Langflow OSS v1.0.0 – 1.12.2 is affected by CRITICAL code injection (CVE-2026-93674, CVSS 9.8). Remote code exec possible via improper OS command neutralization. No patch yet — restrict network access & monitor activity. https://radar.offseq.com/threat/cve-2026-93674-cwe-94-improper-control-of-generation-of-code-code-injection-in-ibm-langflow-oss-05d9c1873ab3c004 #OffSeq #IBM #Vuln #AppSec

IBM fixes 25 Langflow vulnerabilities, including critical RCE flaw CVE-2026-104334 (CVSS 9.8). Upgrade to Langflow 1.12.3 now.

#Langflow #IBM #AISecurity #CVE2026104334 #CVE202693674 #RCE #LLM #Vulnerability

https://securityonline.info/langflow-vulnerabilities-1-12-3/?utm_source=mastodon&utm_medium=jetpack_social

Four ASUS router vulnerabilities are fixed, including critical XSS flaw CVE-2026-14911 and code execution bug CVE-2026-19386. Update firmware now.

#ASUS #ASUSRouter #RouterSecurity #CVE202614911 #CVE202619386 #XSS #FirmwareUpdate #Vulnerability

https://securityonline.info/asus-router-vulnerabilities-firmware-update/?utm_source=mastodon&utm_medium=jetpack_social

Critical ASUSTOR ADM vulnerability CVE-2026-105324 (CVSS 9.2) allows unauthenticated arbitrary file read on NAS devices. Update ADM now.

#ASUSTOR #ADM #NAS #CVE2026105324 #FileRead #HeaderInjection #DataProtection #Vulnerability

https://securityonline.info/asustor-adm-vulnerability-cve-2026-105324/?utm_source=mastodon&utm_medium=jetpack_social

HPE fixes 28 ClearPass Policy Manager vulnerabilities, including unauthenticated RCE flaw CVE-2026-76750 (CVSS 9.8). Upgrade to CPPM 6.14.1.

#HPE #ClearPass #ArubaNetworking #CVE202676750 #CVE202676752 #RCE #NetworkAccessControl #Vulnerability

https://securityonline.info/clearpass-policy-manager-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-79808 - High (7.8)

A buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy Manager. Successful exploitation could allow an authenticated local user to execute arbitrary code with elevated privileges on the affected host or to disrupt the avai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79808/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79807 - High (7.8)

A missing integrity verification vulnerability in the Windows client software for ClearPass Policy Manager could allow malicious users on a local instance to elevate their user privileges. A successful exploit could allow these users to execute at...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

AMD RCCL vulnerability CVE-2026-43598 in the ROCm Communication Collectives Library could allow RCE on Instinct GPUs. Update to ROCm 7.14.

#AMD #ROCm #RCCL #CVE202643598 #AMDInstinct #GPUSecurity #AISecurity #Vulnerability

https://securityonline.info/amd-rccl-vulnerability-cve-2026-43598/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-79802 - High (8.8)

A command injection vulnerability exists in the client software of ClearPass Policy Manager. Successful exploitation could allow an attacker who is able to supply crafted input to the affected software to execute arbitrary commands with elevated p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79802/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-79801 - Critical (9.8)

A missing integrity verification vulnerability in the client agent software of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to introduce untrusted code. Successful exploitation could allow an attacker to e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79801/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79799 - High (8.8)

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site scripting (XSS) attack against an administrative user of the interface. A successful ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79799/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-79798 - Critical (9.9)

SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79798/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-79797 - High (8.8)

An improper access control vulnerability exists in the Android client application for HPE Networking ClearPass Policy Manager, where application functionality may be invoked by untrusted sources. Successful exploitation could allow an unauthentica...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79797/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-79805 - Critical (9.8)

An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79805/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86361 - High (8.2)

Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86361/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Elastic fixes 14 Elastic Stack vulnerabilities, including Kibana flaw CVE-2026-102406 and Elasticsearch bug CVE-2026-103007. Upgrade now.

#Elastic #Elasticsearch #Kibana #ElasticDefend #CVE2026102406 #CVE2026103007 #DataSecurity #Vulnerability

https://securityonline.info/elastic-stack-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Critical Arista CloudVision CUE vulnerability CVE-2026-102159 (CVSS 9.8) and five more flaws hit CV-CUE. Update to WiFi 2026.2.1 now.

#Arista #CloudVision #CVCUE #CVE2026102159 #CVE2026102161 #WiFiSecurity #NetworkSecurity #Vulnerability

https://securityonline.info/arista-cloudvision-cue-vulnerability-cve-2026-102159/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-86362 - High (8.2)

Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Chrome 155 patches 247 vulnerabilities, including 4 CRITICAL use-after-free bugs (CVE-2026-106382, - 106197, - 106358, - 106347) across Chromecast, Browser, Navigation & Track. Update on Windows, macOS & Linux. No active exploits. https://radar.offseq.com/threat/chrome-155-update-patches-247-vulnerabilities-28750e8d96fdecb9 #OffSeq #Chrome #Security

The Chrome 155 security update fixes 247 flaws, including critical use after free bugs CVE-2026-106382 and CVE-2026-106197. Update now.

#Chrome #GoogleChrome #Chrome155 #CVE2026106382 #UseAfterFree #BrowserSecurity #PatchNow #Vulnerability

https://securityonline.info/chrome-155-security-update/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-104073 - High (7.6)

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Djang...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104073/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86360 - Critical (9.6)

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86360/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Dell PowerEdge : une faille critique permet d’exécuter du code en tant que root sur les serveurs https://www.it-connect.fr/dell-system-update-faille-critique-cve-2026-86360/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Dell

Someone needs to check on the USMC.

https://nvd.nist.gov/vuln/detail/cve-2026-104070

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user.

🔴 CVE-2026-104070 - Critical (9.8)

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104070/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106440 - High (7.8)

Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom_search_space, resolves it with hyd...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106440/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106110 - High (7.5)

ImageSharp is a 2D graphics library. From 2.0.0 until 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106110/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105862 - High (8.7)

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that allows downloadable SVG uploads can store a malicious SVG that bypasses sanitization and ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105862/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63697 - High (7.6)

Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-67273 - Critical (9.6)

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67273/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-106218 - High (8.8)

In JetBrains TeamCity before 2026.1.3
2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-106218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67270 - High (8.2)

Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, lead...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67270/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76105 - High (7.7)

Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61411 - High (7.7)

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Informati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-105778: CRITICAL stack-based buffer overflow in Tenda AC5 (v02.03.01.111_multi). Remote attackers can execute code via the /goform/setWifi endpoint. No patch yet — restrict remote access & monitor for exploits. https://radar.offseq.com/threat/cve-2026-105778-stack-based-buffer-overflow-in-tenda-ac5-d56799a413fc396a #OffSeq #CVE #Infosec #IoT

🔴 CVE-2026-105691 - Critical (9.9)

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill-color value into a ppmcolormask command string and executes that string through child_process.exec. A user...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105691/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105793 - Critical (9.1)

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_servers/mobile_mcp_server.py accepts a free-form key_code parameter and passes it to `adb ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105845 - Critical (9.8)

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105845/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82531: CRITICAL code injection bug in smarty-php Smarty (<4.5.8, 5.0.0<5.8.5). Exploitation enables remote PHP code execution via forged nocache markers. Patch to 4.5.8/5.8.5 ASAP. https://radar.offseq.com/threat/cve-2026-82531-improper-control-of-generation-of-code-code-injection-in-smarty-php-smarty-eb57bcca29bb7350 #OffSeq #CVE #infosec #php

🟠 CVE-2026-105796 - High (8.8)

Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a termin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105796/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104850 - High (7.5)

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide whi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-63688 - Critical (10)

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63688/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-63692 - Critical (10)

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63692/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-54472 - Critical (9.8)

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Informatio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54472/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Progress DataDirect vulnerability CVE-2026-91140 enables command injection via crafted OpenAPI files in AI agents. Pull version 2.1 now.

#Progress #DataDirect #CVE202691140 #CommandInjection #AIAgents #OpenAPI #DevSecOps #Vulnerability

https://securityonline.info/progress-datadirect-vulnerability-cve-2026-91140/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-61421 - Critical (9.8)

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to E...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61421/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-67269 - Critical (9.9)

Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67269/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 RAPID RESPONSE: CVE-2026-84411 is a critical unauthenticated remote code execution vulnerability affecting MikroTik RouterOS web management.

Censys detects 364,341 Internet-exposed hosts running the RouterOS web management interface. Roughly 19,200 report RouterOS 7.x, and none currently report the patched 7.24 release or later.

The broader exposure count does not represent confirmed-vulnerable devices because the impact to RouterOS 6.x has not yet been established. No public exploitation has been reported.

Full Censys ARC advisory: https://censys.com/advisory/cve-2026-84411/

#CensysARC #MikroTik #Cybersecurity

CVE-2026-91107: CRITICAL auth bypass in openSIS-Classic 9.3 🛑. Teacher-role users can reset passwords of any staff via the staff_id parameter. No patch yet — restrict permissions & monitor password changes. https://radar.offseq.com/threat/cve-2026-91107-cwe-639-authorization-bypass-through-user-controlled-key-in-os4ed-opensis-classic-f7eb55a7a5a0f52d #OffSeq #Vulnerability #openSIS #CVE202691107

Microsoft Exchange : la faille CVE-2026-96940 permet de lire les boîtes aux lettres des autres utilisateurs https://www.it-connect.fr/exchange-server-cve-2026-96940/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Microsoft

Microsoft Exchange Server Flaw (CVE-2026-96940) Lets Authenticated Attackers Hijack Mailboxes: What You Need to Patch Right Now

https://thecybersecguru.com/exploits/cve-2026-96940-microsoft-exchange-vulnerability/

CRITICAL SQL injection (CVE-2026-42415) in p-themes Porto Theme - Functionality ≤3.9.3. Unauthenticated attackers can steal sensitive data. No official patch yet — restrict access ASAP. https://radar.offseq.com/threat/cve-2026-42415-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-3eb4b18a06bf1443 #OffSeq #CVE202642415 #Infosec #WordPress #SQLInjection

🟠 CVE-2026-100511 - High (8.8)

Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100511/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105642 - High (8.8)

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105642/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ Obrir un full de càlcul i que s'executi codi sense cap avís de macro. Això és.

Afecta LibreOffice (CVE-2026-63277, arreglat a les 26.2.5/26.8.0) i Apache OpenOffice (CVE-2026-59265, encara sense pegat: desactiva Java). L'atac aprofita rangs de base de dades + JDBC per baixar un JAR maliciós. De moment només PoC, però funciona a Windows i Linux.

#ciberseguretat #LibreOffice #OpenOffice
https://blog.elhacker.net/2026/10/vulnerabilidades-en-libreoffice-y.html

Unauthenticated SQL Injection (CVE-2026-41555, CRITICAL, CVSS 9.3) in Weblizar Newsletter Subscription Form <=1.5.9 impacts WordPress sites. Patch status unknown — restrict/disable the component. https://radar.offseq.com/threat/cve-2026-41555-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-07f0f81651ae4a40 #OffSeq #WordPress #Infosec #SQLInjection

CVE-2026-42417 (CRITICAL): ARMember Premium <= 7.8 is vulnerable to unauthenticated SQL Injection (CWE-89). No mitigation yet — review deployments & monitor databases closely. https://radar.offseq.com/threat/cve-2026-42417-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-559a21ef978d1d38 #OffSeq #Vulnerability #SQLInjection #WordPress

Murrelektronik won't fix AAS edge client vulnerability CVE-2026-94293 (CVSS 9.8), which allows unauthenticated data changes. Remove it now.

#Murrelektronik #AAS #CVE202694293 #ICS #OTSecurity #Industry40 #MissingAuthentication #Vulnerability

https://securityonline.info/aas-edge-client-vulnerability-cve-2026-94293/?utm_source=mastodon&utm_medium=jetpack_social

🔒 New CSAF advisory published

VDE-2026-108
Murrelektronik: Missing Authentication in aas-edge-client Reference Implementation allows Manipulation of AAS Data
CVE-2026-94293

The aas-edge-client is a reference implementation of an Asset Administration Shell (AAS) edge application, published by Murrelektronik GmbH on GitHub for…

HTML: https://certvde.com/en/advisories/vde-2026-108/
CSAF JSON: https://murrelektronik.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-108.json

#OT #Advisory

CVE-2026-75962: HIGH severity stored XSS in Post SMTP WordPress plugin (<=4.0.1). Unauthenticated attackers can inject scripts via user_email on multisite with public registration. Patch or restrict registration. https://radar.offseq.com/threat/cve-2026-75962-cwe-79-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-4d025f1757070abe #OffSeq #WordPress #XSS #Infosec

TOTOLINK X6000R (9.4.0cu.652_B20230116) hit by CRITICAL OS command injection (CVE-2026-105484). Remote, unauthenticated attackers can gain full control. Restrict interface access & monitor /cgi-bin/cstecgi.cgi. Details: https://radar.offseq.com/threat/cve-2026-105484-os-command-injection-in-totolink-x6000r-ffaed0dcf0c90a02 #OffSeq #CVE #IoTSecurity

🟠 CVE-2026-103066 - High (8.5)