I explicitly don't want to complain about MSRC here, this is a bigger topic, but I am a bit confused here:

Compare these two:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81954 - AV:L,UI:R

Q: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
A: An attacker must send a user a malicious Office file and convince them to open it.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80081 - AV:N,UI:R

Q: How could an attacker exploit this vulnerability?
A: An attacker could send a specially crafted PowerPoint presentation containing malicious linked media to a target user. The user would need to open the presentation, start the slideshow, and allow the linked content. Successful exploitation could allow the attacker to execute code on the user's system. Authentication is not required.

To me the attack flow looks equivalent wrt to attacker location. We can argue about #2 being actually harder to execute, having more social engineering prerequisites... which is why it totally makes sense for #2 to scored higher on CVSS as it's apparently network & the other one local.

I explicitly don't want to complain about MSRC here, this is a bigger topic, but I am a bit confused here:

Compare these two:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81954 - AV:L,UI:R

Q: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
A: An attacker must send a user a malicious Office file and convince them to open it.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80081 - AV:N,UI:R

Q: How could an attacker exploit this vulnerability?
A: An attacker could send a specially crafted PowerPoint presentation containing malicious linked media to a target user. The user would need to open the presentation, start the slideshow, and allow the linked content. Successful exploitation could allow the attacker to execute code on the user's system. Authentication is not required.

To me the attack flow looks equivalent wrt to attacker location. We can argue about #2 being actually harder to execute, having more social engineering prerequisites... which is why it totally makes sense for #2 to scored higher on CVSS as it's apparently network & the other one local.

Microsoft Plugs Nearly 1000 Security Holes

Microsoft가 Windows 및 기타 소프트웨어의 취약점 최소 974건을 수정하는 역대 최대 규모의 월간 패치 묶음을 배포했다. 실제 악용 중인 Windows 권한 상승 제로데이 CVE-2026-81963·CVE-2026-85880이 포함됐으며, Windows Server 2012 이상과 Windows 10에 영향을 주는 DNS 취약점 CVE-2026-69730은 인증 없이 조작된 패킷으로 공격될 수 있고 악용 가능성이 높다고 경고됐다. Windows Shell 원격 코드 실행 취약점 CVE-2026-69829는 CVSS 9.8로, 낮은 공격 복잡도·무권한...

https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/

Meanwhile CVE-2026-69829 is a CVSS 9.8 heap overflow in Windows Shell letting unauthenticated attackers run code over a network. I called the mechanics. I drew the diagram. I made a spreadsheet.

Patch CVE-2026-81963, CVE-2026-85880, CVE-2026-69730, and CVE-2026-69829 immediately — yes, right now, before you ask if it can wait until Friday.

Reward: You've received the Tunnel Vision Debuff. It cannot be cleansed.

#ZeroDay #Microsoft #WindowsUpdate #PrivilegeEscalation #CyberSecurity (2/2)

Meanwhile CVE-2026-69829 is a CVSS 9.8 heap overflow in Windows Shell letting unauthenticated attackers run code over a network. I called the mechanics. I drew the diagram. I made a spreadsheet.

Patch CVE-2026-81963, CVE-2026-85880, CVE-2026-69730, and CVE-2026-69829 immediately — yes, right now, before you ask if it can wait until Friday.

Reward: You've received the Tunnel Vision Debuff. It cannot be cleansed.

#ZeroDay #Microsoft #WindowsUpdate #PrivilegeEscalation #CyberSecurity (2/2)

CVE-2026-69439 - an EoP in the MSDIA component.

MSDIA is used in debugging, and for enrichment of call stacks for exceptions.

A crafted pdb file could cause an OOB write. Applicable mostly to developers. It needs the presence of a PDB alongside apps, which you shouldn't be doing in prod.

Microsoft Security Advisory CV...

CVE-2026-12855: HIGH-severity vuln in InsydeH2O firmware (HP). Local attackers with high privileges may execute arbitrary code due to improper input validation. No patch yet — restrict local admin access. https://radar.offseq.com/threat/cve-2026-12855-cwe-20-improper-input-validation-in-insyde-software-insydeh2o-96c11fc7beb122a7 #OffSeq #Vulnerability #Firmware #Infosec

CVE-2026-12855: HIGH-severity vuln in InsydeH2O firmware (HP). Local attackers with high privileges may execute arbitrary code due to improper input validation. No patch yet — restrict local admin access. https://radar.offseq.com/threat/cve-2026-12855-cwe-20-improper-input-validation-in-insyde-software-insydeh2o-96c11fc7beb122a7 #OffSeq #Vulnerability #Firmware #Infosec

CVE-2026-87628: CRITICAL use-after-free in Chrome's Cast (<153.0.8010.36) enables adjacent code execution outside the sandbox. Patch status unconfirmed. Check the vendor advisory: https://radar.offseq.com/threat/cve-2026-87628-use-after-free-in-google-chrome-1e9eb757633453cf #OffSeq #Chrome #Vuln #CVE202687628

CVE-2026-87628: CRITICAL use-after-free in Chrome's Cast (<153.0.8010.36) enables adjacent code execution outside the sandbox. Patch status unconfirmed. Check the vendor advisory: https://radar.offseq.com/threat/cve-2026-87628-use-after-free-in-google-chrome-1e9eb757633453cf #OffSeq #Chrome #Vuln #CVE202687628

CVE-2026-15667: HIGH-severity LFI in Eventin WordPress plugin (≤4.1.22). Contributors can include arbitrary PHP via 'event_layout', risking code execution. Restrict privileges & await patch. https://radar.offseq.com/threat/cve-2026-15667-cwe-98-improper-control-of-filename-for-includerequire-statement-in-php-program-php-b89bc3860052e068 #OffSeq #WordPress #Vuln #LFI

CVE-2026-15667: HIGH-severity LFI in Eventin WordPress plugin (≤4.1.22). Contributors can include arbitrary PHP via 'event_layout', risking code execution. Restrict privileges & await patch. https://radar.offseq.com/threat/cve-2026-15667-cwe-98-improper-control-of-filename-for-includerequire-statement-in-php-program-php-b89bc3860052e068 #OffSeq #WordPress #Vuln #LFI

Google patched a Chrome zero-day, CVE-2026-87491, exploited in the wild. Chrome 153 fixes 230 flaws including critical WebGL bugs. Update now.

#Chrome #ZeroDay #Google #CyberSecurity #CVE #V8 #BrowserSecurity #Infosec

https://securityonline.info/chrome-zero-day-cve-2026-87491/?utm_source=mastodon&utm_medium=jetpack_social

Google patched a Chrome zero-day, CVE-2026-87491, exploited in the wild. Chrome 153 fixes 230 flaws including critical WebGL bugs. Update now.

#Chrome #ZeroDay #Google #CyberSecurity #CVE #V8 #BrowserSecurity #Infosec

https://securityonline.info/chrome-zero-day-cve-2026-87491/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-73315 - High (8.6)

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73315/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73315 - High (8.6)

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73315/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73316 - High (7.5)

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73316/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73316 - High (7.5)

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73316/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73314 - High (7.5)

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo heade...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73314/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-73314 - High (7.5)

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo heade...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-73314/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Red Hat 389-ds-base faces CRITICAL flaws (CVE-2026-18355 & more): heap buffer overflow, pre-auth NULL dereference, privilege escalation, and ACI bypass in RHEL 9.2 (<9.2.4). Patch ASAP. https://radar.offseq.com/threat/red-hat-security-advisory-389-ds-base-security-bug-fix-and-enhancement-update-0c583247a0fb050c #OffSeq #RedHat #CVE #LDAP

CRITICAL vulnerabilities in Red Hat 389-ds-base (>=9.4 <9.4.5) incl. heap overflow (CVE-2026-18355), privilege escalation, and ACI bypass. Patch ASAP via RHSA-2026:64781. Details: https://radar.offseq.com/threat/red-hat-security-advisory-389-ds-base-security-bug-fix-and-enhancement-update-c933f76430be2c96 #OffSeq #RedHat #LDAP #Vuln #SysAdmin

Red Hat 389-ds-base faces CRITICAL flaws (CVE-2026-18355 & more): heap buffer overflow, pre-auth NULL dereference, privilege escalation, and ACI bypass in RHEL 9.2 (<9.2.4). Patch ASAP. https://radar.offseq.com/threat/red-hat-security-advisory-389-ds-base-security-bug-fix-and-enhancement-update-0c583247a0fb050c #OffSeq #RedHat #CVE #LDAP

CRITICAL vulnerabilities in Red Hat 389-ds-base (>=9.4 <9.4.5) incl. heap overflow (CVE-2026-18355), privilege escalation, and ACI bypass. Patch ASAP via RHSA-2026:64781. Details: https://radar.offseq.com/threat/red-hat-security-advisory-389-ds-base-security-bug-fix-and-enhancement-update-c933f76430be2c96 #OffSeq #RedHat #LDAP #Vuln #SysAdmin

🟠 CVE-2026-53938 - High (8.2)

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not val...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-53938 - High (8.2)

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms (`alg` = `A128KW`, `A192KW`, `A256KW`) does not val...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53938/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19306 - High (7.7)

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19306/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85983 - High (7.8)

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85983/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85983 - High (7.8)

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85983/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

WTF

https://github.com/ConnectWise-Advisories/Disclosures/blob/main/CVE-2026-84869/README.md

Earlier versions of ScreenConnect Client Support and Access sessions contained a client-side file-transfer handling condition in which file-transfer actions could be processed through an active remote session without proper authorization or Host confirmation. Under certain circumstances, this could allow files to be transferred to and executed on the Host client system, including through elevated execution actions. ScreenConnect servers are not impacted. Disabling file-transfer permissions for affected sessions may reduce exposure until the update is applied.

🔴 CVE-2026-84869 - Critical (9.9)

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84869/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

WTF

https://github.com/ConnectWise-Advisories/Disclosures/blob/main/CVE-2026-84869/README.md

Earlier versions of ScreenConnect Client Support and Access sessions contained a client-side file-transfer handling condition in which file-transfer actions could be processed through an active remote session without proper authorization or Host confirmation. Under certain circumstances, this could allow files to be transferred to and executed on the Host client system, including through elevated execution actions. ScreenConnect servers are not impacted. Disabling file-transfer permissions for affected sessions may reduce exposure until the update is applied.

🔴 CVE-2026-84869 - Critical (9.9)

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84869/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82007 - High (7.8)

Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82007/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82007 - High (7.8)

Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82007/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81994 - High (8.2)

Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitiv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81994/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81994 - High (8.2)

Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitiv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81994/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-52775: SQL injection in YesWiki < 4.6.6 allows any authenticated user to inject arbitrary SQL via ReactionManager::deleteUserReaction(). CVSS 8.8. No patch confirmed—upgrade to 4.6.6 immediately. Details: https://www.valtersit.com/cve/CVE-2026-52775/ #CVE #infosec #YesWi

CVE-2026-52767: YesWiki (4.6.2-4.6.5) improper openssl_verify check via loose boolean negation allows auth bypass (CVSS 8.2). Attackers can forge signatures and trigger processActivity(). Unpatched—upgrade to 4.6.6 or disable affected endpoints now. https://www.valtersit.com/cve/

CVE-2026-52771: YesWiki SQL injection via attacker-controlled page tags in ApiController::deletePage(). CVSS 8.3. Low-privilege users can exploit arbitrary tags to inject SQL. Unpatched—no fix available. Update or disable API if exposed. https://www.valtersit.com/cve/CVE-2026-527

Details and PoC for CVE-2026-84372 are publicly disclosed. This Predis command injection flaw via CRLF smuggling allows complete cluster compromise.

#Predis #CommandInjection #CVE202684372 #Cybersecurity #Vulnerability

https://securityonline.info/cve-2026-84372-predis-command-injection-flaw/?utm_source=mastodon&utm_medium=jetpack_social

Details and PoC for CVE-2026-84372 are publicly disclosed. This Predis command injection flaw via CRLF smuggling allows complete cluster compromise.

#Predis #CommandInjection #CVE202684372 #Cybersecurity #Vulnerability

https://securityonline.info/cve-2026-84372-predis-command-injection-flaw/?utm_source=mastodon&utm_medium=jetpack_social

A critical MapLibre XSS vulnerability allows zero-click code execution in 2.7M weekly downloads. Discover how CVE-2026-85061 works and how to patch now.

#MapLibre #XSS #CVE202685061 #WebSecurity #InfoSec #CyberSecurity #OpenSource

https://securityonline.info/maplibre-xss-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

A critical MapLibre XSS vulnerability allows zero-click code execution in 2.7M weekly downloads. Discover how CVE-2026-85061 works and how to patch now.

#MapLibre #XSS #CVE202685061 #WebSecurity #InfoSec #CyberSecurity #OpenSource

https://securityonline.info/maplibre-xss-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-84942 - High (8.7)

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84942 - High (8.7)

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84942/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-80116 - Privilege Escalation in PassMark (PerformanceTest, BurnInTest, OSForensics). CVSS 7.8. Exposed IOCTLs in DirectIo64.sys allow arbitrary PCI config writes, enabling DMA attacks or storage disruption. Unpatched. Update immediately if affected. https://www.valtersit

CVE-2026-80113 - Privilege escalation in Directio64.Sys (PassMark tools). CVSS 7.1. Local attackers can clear bits in physical memory via IOCTL, risking kernel integrity. Unpatched—take action. Details: https://www.valtersit.com/cve/CVE-2026-80113/ #CVE #infosec #cybersecurity

CVE-2026-80118: Unpatched flaw in PassMark PerformanceTest, BurnInTest & OSForensics (DirectIo64.sys) lets local users dump all physical memory via IOCTL—exposing passwords, keys, and data. CVSS 7.1. No patch yet. Stop using these tools or restrict access NOW. Details: https://ww

🔴 CVE-2026-86184 - Critical (9.8)

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /scr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86184/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86250 - High (7.5)

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86435 - High (7.5)

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to cre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86435/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86541 - High (8.3)

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86541/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86541 - High (8.3)

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86541/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86540 - High (7.8)

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a craf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86540/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86540 - High (7.8)

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a craf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86540/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86439 - High (8.8)

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86439/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86439 - High (8.8)

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86439/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86542 - Critical (9.1)

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86542/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86542 - Critical (9.1)

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86542/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86727 - High (7.5)

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86727/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86727 - High (7.5)

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86727/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-31020: SSTI to RCE in DocsGPT ≤0.15.0 via unsanitized Jinja prompts. CVSS 9.8, unpatched. No auth needed. Patch? None yet—disable custom prompts or isolate instance now. Details: https://www.valtersit.com/cve/CVE-2026-31020/ #CVE #infosec #cybersecurity

🔴 New security advisory:

CVE-2026-75650 affects Adobe Commerce.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-75650-adobe-commerce-template-rce-exploited-poc

by Yazoul AI

#CVE #SecurityPatching #HackerNews

Adobe releases September 2026 patches for multiple products

Adobe's September 2026 security updates patch vulnerabilities across eight product families: Commerce/Magento, ColdFusion, Campaign Classic, Acrobat/Reader, Experience Manager, Photoshop, Illustrator, and Animate. The flaws could allow arbitrary code execution, privilege escalation, security feature bypass, file system read/write, memory exposure, and denial-of-service. The most urgent is CVE-2026-75650 (CVSS 10.0) in Adobe Commerce and Magento Open Source, an unauthenticated template-engine flaw already exploited in the wild and fixed by a separate out-of-band hotfix on September 7 that must be applied in addition to the September update.

**If you run Adobe Commerce or Magento Open Source, apply the out-of-band hotfix for CVE-2026-75650 immediately! Adobe is aware of this flaw being exploited in the wild, it carries a CVSS score of 10.0, and it can be triggered without authentication. Next, update ColdFusion and Adobe Campaign Classic, both of which received Adobe's highest priority rating and contain critical flaws that could lead to arbitrary code execution. Then apply the September Adobe Commerce security update, which is separate from the hotfix and must be installed in addition to it. After that, update Adobe Experience Manager and Acrobat and Reader. Finally, update Photoshop, Illustrator, and Animate. If you can't update right away, restrict network access to Commerce, ColdFusion, Campaign Classic, and Experience Manager servers, and avoid opening untrusted PDFs and untrusted image or project files in Acrobat, Reader, Photoshop, Illustrator, and Animate until patches are applied.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/adobe-releases-september-2026-patches-for-multiple-products-9-j-d-0-x/gD2P6Ple2L

CVE ID: CVE-2026-75650
Vendor: Adobe
Product: Commerce and Magento
Date Added: 2026-09-08
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-75650

Update: Adobe released an update for CVE-2026-75650 yesterday https://helpx.adobe.com/security/products/magento/apsb26-146.html.

CSO: Adobe Commerce max-severity bug comes under active attack https://www.csoonline.com/article/4219626/adobe-commerce-max-severity-bug-comes-under-active-attack.html #Adobe #infosec #vulnerability

Adobe fixes critical Magento zero-day exploited to backdoor servers

Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that...

🔗️ [Bleepingcomputer] https://link.is.it/kbCfVz

The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html

Adobe Patches Zero-Day Flaw Exploited to Deploy Rust Backdoor

Adobe just patched a critical zero-day flaw, CVE-2026-75650, that's been exploited to deploy a Rust backdoor, known as StyleSmuggler, targeting Adobe Commerce merchants - and it's crucial you update ASAP to avoid arbitrary code execution. This severe vulnerability has a CVSS score of 10.0, so don't wait to secure your site.

https://osintsights.com/adobe-patches-zero-day-flaw-exploited-to-deploy-rust-backdoor?utm_source=mastodon&utm_medium=social

#ZeroDay #Adobe #Cve202675650 #ArbitraryCodeExecution #Stylesmuggler

🏆 New Achievement! StyleSmuggler Has Entered the Tutorial Zone!

Welcome, new merchant! This is the part of the game where we introduce a mandatory debuff called CVE-2026-75650. Adobe Commerce and Magento 2 contain a CVSS 10.0 critical flaw in the template engine — an Improper Neutralization of Special Elements — that lets attackers execute arbitrary code with no user interaction required. This isn't a side quest. (1/2)

An Adobe Commerce vulnerability, CVE-2026-75650 (CVSS 10), enables unauthenticated arbitrary code execution and is exploited in the wild. Patch now.

#AdobeCommerce #Magento #StyleSmuggler #CVE202675650 #RCE #Ecommerce #ExploitedInTheWild #Infosec

https://securityonline.info/adobe-commerce-cve-2026-75650-stylesmuggler/?utm_source=mastodon&utm_medium=jetpack_social

Magento 2 Zero-Day RCE Crisis: Active Attacks Put Online Stores and Customer Data at Risk + Video

A New Threat Is Hitting E-Commerce at the Core A dangerous zero-day vulnerability in Magento and Adobe Commerce has moved from security research into active exploitation, creating an immediate threat for online retailers running the popular e-commerce platforms. The vulnerability, tracked by Adobe as CVE-2026-75650 and publicly associated with the StyleSmuggler attack…

https://undercodenews.com/magento-2-zero-day-rce-crisis-active-attacks-put-online-stores-and-customer-data-at-risk-video/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-75650 - Critical (10)

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Adobe Commerce faces a CRITICAL (CVSS 10) template engine flaw (CVE-2026-75650) allowing arbitrary code execution with no user interaction required. Update and monitor for patches. https://radar.offseq.com/threat/cve-2026-75650-improper-neutralization-of-special-elements-used-in-a-template-engine-cwe-1336-in-adobe-1ba4ab0d2a763031 #OffSeq #AdobeCommerce #CVE202675650 #infosec

Adobe releases September 2026 patches for multiple products

Adobe's September 2026 security updates patch vulnerabilities across eight product families: Commerce/Magento, ColdFusion, Campaign Classic, Acrobat/Reader, Experience Manager, Photoshop, Illustrator, and Animate. The flaws could allow arbitrary code execution, privilege escalation, security feature bypass, file system read/write, memory exposure, and denial-of-service. The most urgent is CVE-2026-75650 (CVSS 10.0) in Adobe Commerce and Magento Open Source, an unauthenticated template-engine flaw already exploited in the wild and fixed by a separate out-of-band hotfix on September 7 that must be applied in addition to the September update.

**If you run Adobe Commerce or Magento Open Source, apply the out-of-band hotfix for CVE-2026-75650 immediately! Adobe is aware of this flaw being exploited in the wild, it carries a CVSS score of 10.0, and it can be triggered without authentication. Next, update ColdFusion and Adobe Campaign Classic, both of which received Adobe's highest priority rating and contain critical flaws that could lead to arbitrary code execution. Then apply the September Adobe Commerce security update, which is separate from the hotfix and must be installed in addition to it. After that, update Adobe Experience Manager and Acrobat and Reader. Finally, update Photoshop, Illustrator, and Animate. If you can't update right away, restrict network access to Commerce, ColdFusion, Campaign Classic, and Experience Manager servers, and avoid opening untrusted PDFs and untrusted image or project files in Acrobat, Reader, Photoshop, Illustrator, and Animate until patches are applied.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/adobe-releases-september-2026-patches-for-multiple-products-9-j-d-0-x/gD2P6Ple2L

CVE ID: CVE-2026-75650
Vendor: Adobe
Product: Commerce and Magento
Date Added: 2026-09-08
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-75650

Update: Adobe released an update for CVE-2026-75650 yesterday https://helpx.adobe.com/security/products/magento/apsb26-146.html.

CSO: Adobe Commerce max-severity bug comes under active attack https://www.csoonline.com/article/4219626/adobe-commerce-max-severity-bug-comes-under-active-attack.html #Adobe #infosec #vulnerability

Adobe fixes critical Magento zero-day exploited to backdoor servers

Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that...

🔗️ [Bleepingcomputer] https://link.is.it/kbCfVz

The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html

🏆 New Achievement! StyleSmuggler Has Entered the Tutorial Zone!

Welcome, new merchant! This is the part of the game where we introduce a mandatory debuff called CVE-2026-75650. Adobe Commerce and Magento 2 contain a CVSS 10.0 critical flaw in the template engine — an Improper Neutralization of Special Elements — that lets attackers execute arbitrary code with no user interaction required. This isn't a side quest. (1/2)

An Adobe Commerce vulnerability, CVE-2026-75650 (CVSS 10), enables unauthenticated arbitrary code execution and is exploited in the wild. Patch now.

#AdobeCommerce #Magento #StyleSmuggler #CVE202675650 #RCE #Ecommerce #ExploitedInTheWild #Infosec

https://securityonline.info/adobe-commerce-cve-2026-75650-stylesmuggler/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-75650 - Critical (10)

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Adobe Commerce faces a CRITICAL (CVSS 10) template engine flaw (CVE-2026-75650) allowing arbitrary code execution with no user interaction required. Update and monitor for patches. https://radar.offseq.com/threat/cve-2026-75650-improper-neutralization-of-special-elements-used-in-a-template-engine-cwe-1336-in-adobe-1ba4ab0d2a763031 #OffSeq #AdobeCommerce #CVE202675650 #infosec

A new ONLYOFFICE ownCloud plugin SSRF vulnerability, tracked as CVE-2026-84282, allows attackers to trigger unauthorized internal network requests.

#ONLYOFFICE #ownCloud #SSRF #Cybersecurity #CVE202684282 #Vulnerability

https://securityonline.info/onlyoffice-owncloud-plugin-ssrf/?utm_source=mastodon&utm_medium=jetpack_social

A new ONLYOFFICE ownCloud plugin SSRF vulnerability, tracked as CVE-2026-84282, allows attackers to trigger unauthorized internal network requests.

#ONLYOFFICE #ownCloud #SSRF #Cybersecurity #CVE202684282 #Vulnerability

https://securityonline.info/onlyoffice-owncloud-plugin-ssrf/?utm_source=mastodon&utm_medium=jetpack_social

CVE ID: CVE-2026-86218
Vendor: N-able
Product: N-central
Date Added: 2026-09-08
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-86218

📰 N-able N-central Hit by Actively Exploited CVSS 10.0 RCE Flaw

🚨 URGENT: N-able N-central is being actively exploited via a CVSS 10.0 RCE zero-day (CVE-2026-86218). Unauthenticated attackers can take over RMM servers. On-prem customers must apply Hotfix 4 immediately. #CyberSecurity #RMM #MSP

🔗 https://cyber.netsecops.io/articles/n-able-n-central-critical-rce-zero-day-cve-2026-86218-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

N-able Issues Emergency Hotfix for Maximum-Severity Unauthenticated RCE in N-central

N-able released a critical hotfix for N-central to fix a CVSS 10.0 unauthenticated remote code execution vulnerability (CVE-2026-86218) that may be under active exploitation. The update is the fourth in five weeks and affects all on-premises builds prior to 2026.3.1.14.

**If you run N-central on-premises, upgrade to build 2026.3.1.14 (Hotfix 4) ASAP. Earlier builds, including Hotfix 3 released just hours before, are still vulnerable to unauthenticated remote code execution. Until the hotfix is applied, take any internet-facing console offline or restrict it to a VPN/IP allowlist. Assume that a compromised server means every managed endpoint behind it needs checking too.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/n-able-issues-emergency-hotfix-for-maximum-severity-unauthenticated-rce-in-n-central-i-n-a-0-t/gD2P6Ple2L

⚠️ CRITICAL: N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

N-able N-central RMM platform contains a critical unauthenticated RCE vulnerability (CVE-2026-86218, CVSS 10.0) affecting all builds before 2026.3.1.14. While N-able denies confirmed exploitation, incident reports indicate active wild exploitation. Any organization running N-central is at immediate…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

⚠️ CRITICAL: N-able patches max severity N-central flaw amid ongoing attacks

N-able has released emergency patches for three vulnerabilities in N-central RMM, including a critical unauthenticated RCE (CVE-2026-86218) and two high-severity authentication bypasses. Evidence indicates active exploitation in customer environments. Any organization running N-central is at immedi…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

📰 N-able N-central Hit by Actively Exploited CVSS 10.0 RCE Flaw

🚨 URGENT: N-able N-central is being actively exploited via a CVSS 10.0 RCE zero-day (CVE-2026-86218). Unauthenticated attackers can take over RMM servers. On-prem customers must apply Hotfix 4 immediately. #CyberSecurity #RMM #MSP

🔗 https://cyber.netsecops.io/articles/n-able-n-central-critical-rce-zero-day-cve-2026-86218-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

CVE ID: CVE-2026-86218
Vendor: N-able
Product: N-central
Date Added: 2026-09-08
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-86218

N-able Issues Emergency Hotfix for Maximum-Severity Unauthenticated RCE in N-central

N-able released a critical hotfix for N-central to fix a CVSS 10.0 unauthenticated remote code execution vulnerability (CVE-2026-86218) that may be under active exploitation. The update is the fourth in five weeks and affects all on-premises builds prior to 2026.3.1.14.

**If you run N-central on-premises, upgrade to build 2026.3.1.14 (Hotfix 4) ASAP. Earlier builds, including Hotfix 3 released just hours before, are still vulnerable to unauthenticated remote code execution. Until the hotfix is applied, take any internet-facing console offline or restrict it to a VPN/IP allowlist. Assume that a compromised server means every managed endpoint behind it needs checking too.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/n-able-issues-emergency-hotfix-for-maximum-severity-unauthenticated-rce-in-n-central-i-n-a-0-t/gD2P6Ple2L

⚠️ CRITICAL: N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

N-able N-central RMM platform contains a critical unauthenticated RCE vulnerability (CVE-2026-86218, CVSS 10.0) affecting all builds before 2026.3.1.14. While N-able denies confirmed exploitation, incident reports indicate active wild exploitation. Any organization running N-central is at immediate…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

⚠️ CRITICAL: N-able patches max severity N-central flaw amid ongoing attacks

N-able has released emergency patches for three vulnerabilities in N-central RMM, including a critical unauthenticated RCE (CVE-2026-86218) and two high-severity authentication bypasses. Evidence indicates active exploitation in customer environments. Any organization running N-central is at immedi…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

Two supporting jabs — CVE-2026-86206 and CVE-2026-86207 — let challengers bypass authentication entirely. Hosted and on-premises deployments across Americas, APAC, and Europe are all on the canvas.

Apply N-able's emergency hotfix for CVE-2026-86218 and the weekend patches for CVE-2026-86206 and CVE-2026-86207 immediately — your MSP clients' endpoints are the undercard fight you cannot afford to lose. (2/3)

🏆 New Achievement! Unauthenticated and Undefeated!

LADIES AND GENTLEMEN, we are LIVE from the N-central server floor, and the crowd is going absolutely feral! Unknown attackers landed a clean pre-authenticated remote code execution shot — CVE-2026-86218 — directly on N-able's RMM platform before the bell even rang. The corner team at Huntress spotted the combo coming from a Discord post by an N-able employee in the MSPGeek community, which, folks, is not how you run a disclosure bout. (1/3)

New.

Tanto Security: From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/

More:

The Hacker News: Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/

Also:

N-able issued another fix yesterday https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html #vulnerability #Oracle #infosec

Active N-central vulnerability exploitation targets IT servers. Patch the critical N-central vulnerability now to stop pre-auth RCE attacks.

#Ncentral #CVE202686218 #Nable #RCE #Vulnerability

https://meterpreter.org/cve-2026-86218-n-central-vulnerability-rce/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-86218: N-able N-central on-prem RCE (CRITICAL) enables unauthenticated code execution. Hotfix 4 (2026.3) required ASAP. Nearly 1,500 exposed servers tracked. Patch now: https://radar.offseq.com/threat/n-able-patches-max-severity-n-central-flaw-amid-ongoing-attacks-2b55ee46bb903037 #OffSeq #Nable #RCE #SysAdmin #Infosec

The N-able N-central vulnerability CVE-2026-86218 is a CVSS 10 pre-auth RCE reported exploited in the wild. Apply 2026.3 HF4 immediately.

#Nable #Ncentral #CVE202686218 #PreAuthRCE #RMM #ZeroDay #Huntress #Infosec

https://securityonline.info/n-able-n-central-cve-2026-86218/?utm_source=mastodon&utm_medium=jetpack_social

Why this month's Microsoft patch release is a doozy

Microsoft의 9월 패치 릴리스는 약 972개(Edge의 Chromium 이식 수정 포함 시 997개) 취약점을 수정하며, 이 중 112개가 Critical 등급이다. Windows Update와 Windows ALPC의 제로데이 2건(CVE-2026-81963, CVE-2026-85880)이 포함됐고, Exchange Server의 악성 Visio 첨부파일 기반 비인증 RCE, Remote Desktop Services의 CVSS 9.8 RCE, SharePoint RCE 다수 등 즉시...

https://arstechnica.com/security/2026/09/microsoft-patches-a-record-972-vulnerabilities-112-of-them-critical/

Microsoft Plugs Nearly 1000 Security Holes

Microsoft가 Windows 및 기타 소프트웨어의 취약점 최소 974건을 수정하는 역대 최대 규모의 월간 패치 묶음을 배포했다. 실제 악용 중인 Windows 권한 상승 제로데이 CVE-2026-81963·CVE-2026-85880이 포함됐으며, Windows Server 2012 이상과 Windows 10에 영향을 주는 DNS 취약점 CVE-2026-69730은 인증 없이 조작된 패킷으로 공격될 수 있고 악용 가능성이 높다고 경고됐다. Windows Shell 원격 코드 실행 취약점 CVE-2026-69829는 CVSS 9.8로, 낮은 공격 복잡도·무권한...

https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/

Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

Microsoft의 2026년 9월 Patch Tuesday는 역대 최대 규모인 966건의 취약점을 수정하며, 이 중 105건이 Critical이고 81건은 원격 코드 실행(RCE) 취약점이다. 실제 공격에 악용된 Windows Update Stack 권한 상승(CVE-2026-81963)과 Windows ALPC 힙 버퍼 오버플로우(CVE-2026-85880) 제로데이는 모두 로컬 공격자가 SYSTEM 권한을 얻을 수 있어 우선 패치 대상이다. AI 서...

https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/

Meanwhile CVE-2026-69829 is a CVSS 9.8 heap overflow in Windows Shell letting unauthenticated attackers run code over a network. I called the mechanics. I drew the diagram. I made a spreadsheet.

Patch CVE-2026-81963, CVE-2026-85880, CVE-2026-69730, and CVE-2026-69829 immediately — yes, right now, before you ask if it can wait until Friday.

Reward: You've received the Tunnel Vision Debuff. It cannot be cleansed.

#ZeroDay #Microsoft #WindowsUpdate #PrivilegeEscalation #CyberSecurity (2/2)

🏆 New Achievement! Stand In The Fire One More Time, I Dare You!

NINE HUNDRED AND SEVENTY-FOUR vulnerabilities. Microsoft dropped 974 patches this Patch Tuesday and you are STILL standing in the bad stuff. CVE-2026-81963 and CVE-2026-85880, both CVSS 7.8, are being actively exploited RIGHT NOW against the Windows Update Stack and Windows Advanced Local Procedure Call — privilege escalation, in the wild, before disclosure. (1/2)

CVE ID: CVE-2026-85880
Vendor: Microsoft
Product: Windows
Date Added: 2026-09-08
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-85880

Microsoft's September 2026 Patch Tuesday fixes two zero-day flaws, CVE-2026-81963 and CVE-2026-85880, both exploited in the wild.

#PatchTuesday #ZeroDay #Microsoft #Windows #CyberSecurity #CVE #Infosec #VulnerabilityManagement

https://securityonline.info/patch-tuesday-zero-day-september-2026/?utm_source=mastodon&utm_medium=jetpack_social

Only two 0days this month for MS? Bummer.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880

Meanwhile CVE-2026-69829 is a CVSS 9.8 heap overflow in Windows Shell letting unauthenticated attackers run code over a network. I called the mechanics. I drew the diagram. I made a spreadsheet.

Patch CVE-2026-81963, CVE-2026-85880, CVE-2026-69730, and CVE-2026-69829 immediately — yes, right now, before you ask if it can wait until Friday.

Reward: You've received the Tunnel Vision Debuff. It cannot be cleansed.

#ZeroDay #Microsoft #WindowsUpdate #PrivilegeEscalation #CyberSecurity (2/2)

🏆 New Achievement! Stand In The Fire One More Time, I Dare You!

NINE HUNDRED AND SEVENTY-FOUR vulnerabilities. Microsoft dropped 974 patches this Patch Tuesday and you are STILL standing in the bad stuff. CVE-2026-81963 and CVE-2026-85880, both CVSS 7.8, are being actively exploited RIGHT NOW against the Windows Update Stack and Windows Advanced Local Procedure Call — privilege escalation, in the wild, before disclosure. (1/2)

CVE ID: CVE-2026-85880
Vendor: Microsoft
Product: Windows
Date Added: 2026-09-08
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-85880

Microsoft's September 2026 Patch Tuesday fixes two zero-day flaws, CVE-2026-81963 and CVE-2026-85880, both exploited in the wild.

#PatchTuesday #ZeroDay #Microsoft #Windows #CyberSecurity #CVE #Infosec #VulnerabilityManagement

https://securityonline.info/patch-tuesday-zero-day-september-2026/?utm_source=mastodon&utm_medium=jetpack_social

Only two 0days this month for MS? Bummer.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880

Why this month's Microsoft patch release is a doozy

Microsoft의 9월 패치 릴리스는 약 972개(Edge의 Chromium 이식 수정 포함 시 997개) 취약점을 수정하며, 이 중 112개가 Critical 등급이다. Windows Update와 Windows ALPC의 제로데이 2건(CVE-2026-81963, CVE-2026-85880)이 포함됐고, Exchange Server의 악성 Visio 첨부파일 기반 비인증 RCE, Remote Desktop Services의 CVSS 9.8 RCE, SharePoint RCE 다수 등 즉시...

https://arstechnica.com/security/2026/09/microsoft-patches-a-record-972-vulnerabilities-112-of-them-critical/

Microsoft Plugs Nearly 1000 Security Holes

Microsoft가 Windows 및 기타 소프트웨어의 취약점 최소 974건을 수정하는 역대 최대 규모의 월간 패치 묶음을 배포했다. 실제 악용 중인 Windows 권한 상승 제로데이 CVE-2026-81963·CVE-2026-85880이 포함됐으며, Windows Server 2012 이상과 Windows 10에 영향을 주는 DNS 취약점 CVE-2026-69730은 인증 없이 조작된 패킷으로 공격될 수 있고 악용 가능성이 높다고 경고됐다. Windows Shell 원격 코드 실행 취약점 CVE-2026-69829는 CVSS 9.8로, 낮은 공격 복잡도·무권한...

https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/

Microsoft marked the holiday by unloading 973 CVEs

Microsoft의 2026년 9월 Patch Tuesday는 총 973개 CVE(이 중 Critical 113개)로 역대 최대 규모이며, Windows Update Stack 권한 상승 취약점(CVE-2026-81963)은 이미 실제 악용이 확인됐다. 특히 Windows DNS Server의 인증 불필요 RCE(CVE-2026-69730, CVSS 9.8)와 Remote Desktop Services RCE(CVE-2026-69525)는 도메인 컨트롤러·내부 원격접속 경로를 노릴 수 있어 최우선 패치 대상이다. AI 개발·데이터 운영 측면에서는 SQL Server Managem...

https://www.automox.com/blog/patch-fix-tuesday-september-2026

Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

Microsoft의 2026년 9월 Patch Tuesday는 역대 최대 규모인 966건의 취약점을 수정하며, 이 중 105건이 Critical이고 81건은 원격 코드 실행(RCE) 취약점이다. 실제 공격에 악용된 Windows Update Stack 권한 상승(CVE-2026-81963)과 Windows ALPC 힙 버퍼 오버플로우(CVE-2026-85880) 제로데이는 모두 로컬 공격자가 SYSTEM 권한을 얻을 수 있어 우선 패치 대상이다. AI 서...

https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/

Meanwhile CVE-2026-69829 is a CVSS 9.8 heap overflow in Windows Shell letting unauthenticated attackers run code over a network. I called the mechanics. I drew the diagram. I made a spreadsheet.

Patch CVE-2026-81963, CVE-2026-85880, CVE-2026-69730, and CVE-2026-69829 immediately — yes, right now, before you ask if it can wait until Friday.

Reward: You've received the Tunnel Vision Debuff. It cannot be cleansed.

#ZeroDay #Microsoft #WindowsUpdate #PrivilegeEscalation #CyberSecurity (2/2)

🏆 New Achievement! Stand In The Fire One More Time, I Dare You!

NINE HUNDRED AND SEVENTY-FOUR vulnerabilities. Microsoft dropped 974 patches this Patch Tuesday and you are STILL standing in the bad stuff. CVE-2026-81963 and CVE-2026-85880, both CVSS 7.8, are being actively exploited RIGHT NOW against the Windows Update Stack and Windows Advanced Local Procedure Call — privilege escalation, in the wild, before disclosure. (1/2)

CVE ID: CVE-2026-81963
Vendor: Microsoft
Product: Windows
Date Added: 2026-09-08
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-81963

Microsoft's September 2026 Patch Tuesday fixes two zero-day flaws, CVE-2026-81963 and CVE-2026-85880, both exploited in the wild.

#PatchTuesday #ZeroDay #Microsoft #Windows #CyberSecurity #CVE #Infosec #VulnerabilityManagement

https://securityonline.info/patch-tuesday-zero-day-september-2026/?utm_source=mastodon&utm_medium=jetpack_social

Only two 0days this month for MS? Bummer.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880

Meanwhile CVE-2026-69829 is a CVSS 9.8 heap overflow in Windows Shell letting unauthenticated attackers run code over a network. I called the mechanics. I drew the diagram. I made a spreadsheet.

Patch CVE-2026-81963, CVE-2026-85880, CVE-2026-69730, and CVE-2026-69829 immediately — yes, right now, before you ask if it can wait until Friday.

Reward: You've received the Tunnel Vision Debuff. It cannot be cleansed.

#ZeroDay #Microsoft #WindowsUpdate #PrivilegeEscalation #CyberSecurity (2/2)

🏆 New Achievement! Stand In The Fire One More Time, I Dare You!

NINE HUNDRED AND SEVENTY-FOUR vulnerabilities. Microsoft dropped 974 patches this Patch Tuesday and you are STILL standing in the bad stuff. CVE-2026-81963 and CVE-2026-85880, both CVSS 7.8, are being actively exploited RIGHT NOW against the Windows Update Stack and Windows Advanced Local Procedure Call — privilege escalation, in the wild, before disclosure. (1/2)

CVE ID: CVE-2026-81963
Vendor: Microsoft
Product: Windows
Date Added: 2026-09-08
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-81963

Microsoft's September 2026 Patch Tuesday fixes two zero-day flaws, CVE-2026-81963 and CVE-2026-85880, both exploited in the wild.

#PatchTuesday #ZeroDay #Microsoft #Windows #CyberSecurity #CVE #Infosec #VulnerabilityManagement

https://securityonline.info/patch-tuesday-zero-day-september-2026/?utm_source=mastodon&utm_medium=jetpack_social

Only two 0days this month for MS? Bummer.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81963

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880

🟠 CVE-2026-0799 - High (8.7)

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a cra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0799/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New.

Rapid7: CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED) https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/ @Rapid7Official #infosec #vulnerability #threatresearch

New.

Rapid7: CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED) https://www.rapid7.com/blog/post/ve-cve-2026-86206-cve-2026-86207-n-able-n-central-authentication-bypass-fixed/ @Rapid7Official #infosec #vulnerability #threatresearch

Two supporting jabs — CVE-2026-86206 and CVE-2026-86207 — let challengers bypass authentication entirely. Hosted and on-premises deployments across Americas, APAC, and Europe are all on the canvas.

Apply N-able's emergency hotfix for CVE-2026-86218 and the weekend patches for CVE-2026-86206 and CVE-2026-86207 immediately — your MSP clients' endpoints are the undercard fight you cannot afford to lose. (2/3)

🟠 CVE-2026-84934 - High (8)

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84934/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🏆 New Achievement! OVERPASS: The SAP Kernel Speedrun!

Patch compliance policy activated. Scanning enterprise environment. Detecting CVE-2026-44756, a CVSS 10/10 memory corruption flaw in SAP Extended Passport Processing, dubbed OVERPASS. Policy requires acknowledgment of impact: unauthenticated remote attackers may execute arbitrary system commands, drain database credentials and password hashes, hijack live user sessions, and rewrite configurations and SAP binaries. (1/2)

SAP September 2026 Security Update Fixes 20 Flaws as Critical OVERPASS and S4GET Vulnerabilities Put Enterprise Systems at Risk + Video

A Critical SAP Security Warning Arrives SAP administrators are facing another urgent security challenge as the company’s September 2026 Security Patch Day addresses a collection of vulnerabilities across its enterprise software ecosystem. Among the most serious is CVE-2026-44756, a maximum-severity memory corruption vulnerability in…

https://undercodenews.com/sap-september-2026-security-update-fixes-20-flaws-as-critical-overpass-and-s4get-vulnerabilities-put-enterprise-systems-at-risk-video/?utm_source=mastodon&utm_medium=jetpack_social

SAP Discloses Maximum-Severity Kernel Vulnerability

Over 10,000 SAP systems are exposed to the public internet, making them vulnerable to a newly disclosed maximum-severity kernel flaw, CVE-2026-44756, that allows attackers to gain admin privileges and take control. This critical vulnerability, dubbed OVERPASS, is a buffer overflow flaw that can be exploited to run arbitrary…

https://osintsights.com/sap-discloses-maximum-severity-kernel-vulnerability?utm_source=mastodon&utm_medium=social

#SapKernelVulnerability #Cve202644756 #Overpass #BufferOverflow #ExtendedPassportProtocol

OVERPASS is an unauth RCE in the SAP kernel (CVE-2026-44756) and S4GET is a preauth RCE in the SAP NetWeaver's Message Server (CVE-2026-58240).

Both have a very high CVSS and are likely to be exploited.

https://onapsis.com/blog/sap-overpass-remediation/

https://onapsis.com/blog/s4get-cve-2026-58240-sap-message-server-threat-advisory/

OVERPASS: SAP-Kernel-Schwachstelle CVE-2026-44756 erfordert sofortiges Patchen

CVSS-Bewertung: 10,0 (höchste Stufe) | Handlungsbedarf: sofort

https://www.all-about-security.de/overpass-sap-kernel-schwachstelle-cve-2026-44756-erfordert-sofortiges-patchen/

#sap #sapsecurity

The September 2026 SAP Security Patch Day resolves 20 flaws. Apply these SAP Security Patch Day updates to fix CVE-2026-44756 and secure your environment.

#SAPSecurityPatchDay #CVE202644756 #SAPSecurity #CyberSecurity #Vulnerability

https://securityonline.info/september-2026-sap-security-patch-day/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-44756 - Critical (10)

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resultin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44756/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🏆 New Achievement! OVERPASS: The SAP Kernel Speedrun!

Patch compliance policy activated. Scanning enterprise environment. Detecting CVE-2026-44756, a CVSS 10/10 memory corruption flaw in SAP Extended Passport Processing, dubbed OVERPASS. Policy requires acknowledgment of impact: unauthenticated remote attackers may execute arbitrary system commands, drain database credentials and password hashes, hijack live user sessions, and rewrite configurations and SAP binaries. (1/2)

OVERPASS is an unauth RCE in the SAP kernel (CVE-2026-44756) and S4GET is a preauth RCE in the SAP NetWeaver's Message Server (CVE-2026-58240).

Both have a very high CVSS and are likely to be exploited.

https://onapsis.com/blog/sap-overpass-remediation/

https://onapsis.com/blog/s4get-cve-2026-58240-sap-message-server-threat-advisory/

The September 2026 SAP Security Patch Day resolves 20 flaws. Apply these SAP Security Patch Day updates to fix CVE-2026-44756 and secure your environment.

#SAPSecurityPatchDay #CVE202644756 #SAPSecurity #CyberSecurity #Vulnerability

https://securityonline.info/september-2026-sap-security-patch-day/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-44756 - Critical (10)

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resultin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44756/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-78328 SonicWall NSM On-Prem flaw lets lower-privileged Admins escalate to SuperAdmin. CVSS 9.1, unpatched. Assume compromise until fixed. Restrict access now. Details: https://www.valtersit.com/cve/CVE-2026-78328/ #CVE #infosec #SonicWall

🔴 CVE-2026-66768 - Critical (9)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-66768 - Critical (9)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76958 - High (8.5)

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity dec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76958/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76958 - High (8.5)

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity dec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76958/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-78327: OS Command Injection in SonicWall NSM On-Prem lets SuperAdmin execute arbitrary commands as RCE on the host. CVSS 9.1. Unpatched—assume exposure. Restrict SuperAdmin access now and monitor for updates. https://www.valtersit.com/cve/CVE-2026-78327/ #CVE #SonicWall

🟠 CVE-2026-19858 - High (7.5)

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and ter...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-19534: Node.js undici WebSocket client crashes entire process when server replies with an unrequested subprotocol, triggering an uncaught TypeError. CVSS 7.5. No patch yet—upgrade or restrict WebSocket usage immediately. Details: https://www.valtersit.com/cve/CVE-2026-19

CVE-2026-62645 (CRITICAL, CVSS 9.8) in Siemens Reyrolle 7SR5 <2.70 allows attackers to calculate session IDs and bypass authentication via web interface. Restrict access, check Siemens advisory for updates. https://radar.offseq.com/threat/cve-2026-62645-cwe-306-missing-authentication-for-critical-function-in-siemens-reyrolle-7sr5-698cd29283a49514 #OffSeq #ICS #Vuln #OTsec

CVE-2026-62645 (CRITICAL, CVSS 9.8) in Siemens Reyrolle 7SR5 <2.70 allows attackers to calculate session IDs and bypass authentication via web interface. Restrict access, check Siemens advisory for updates. https://radar.offseq.com/threat/cve-2026-62645-cwe-306-missing-authentication-for-critical-function-in-siemens-reyrolle-7sr5-698cd29283a49514 #OffSeq #ICS #Vuln #OTsec

Microsoft Plugs Nearly 1000 Security Holes

Microsoft가 Windows 및 기타 소프트웨어의 취약점 최소 974건을 수정하는 역대 최대 규모의 월간 패치 묶음을 배포했다. 실제 악용 중인 Windows 권한 상승 제로데이 CVE-2026-81963·CVE-2026-85880이 포함됐으며, Windows Server 2012 이상과 Windows 10에 영향을 주는 DNS 취약점 CVE-2026-69730은 인증 없이 조작된 패킷으로 공격될 수 있고 악용 가능성이 높다고 경고됐다. Windows Shell 원격 코드 실행 취약점 CVE-2026-69829는 CVSS 9.8로, 낮은 공격 복잡도·무권한...

https://krebsonsecurity.com/2026/09/microsoft-plugs-nearly-1000-security-holes/

Microsoft marked the holiday by unloading 973 CVEs

Microsoft의 2026년 9월 Patch Tuesday는 총 973개 CVE(이 중 Critical 113개)로 역대 최대 규모이며, Windows Update Stack 권한 상승 취약점(CVE-2026-81963)은 이미 실제 악용이 확인됐다. 특히 Windows DNS Server의 인증 불필요 RCE(CVE-2026-69730, CVSS 9.8)와 Remote Desktop Services RCE(CVE-2026-69525)는 도메인 컨트롤러·내부 원격접속 경로를 노릴 수 있어 최우선 패치 대상이다. AI 개발·데이터 운영 측면에서는 SQL Server Managem...

https://www.automox.com/blog/patch-fix-tuesday-september-2026

Meanwhile CVE-2026-69829 is a CVSS 9.8 heap overflow in Windows Shell letting unauthenticated attackers run code over a network. I called the mechanics. I drew the diagram. I made a spreadsheet.

Patch CVE-2026-81963, CVE-2026-85880, CVE-2026-69730, and CVE-2026-69829 immediately — yes, right now, before you ask if it can wait until Friday.

Reward: You've received the Tunnel Vision Debuff. It cannot be cleansed.

#ZeroDay #Microsoft #WindowsUpdate #PrivilegeEscalation #CyberSecurity (2/2)

Meanwhile CVE-2026-69829 is a CVSS 9.8 heap overflow in Windows Shell letting unauthenticated attackers run code over a network. I called the mechanics. I drew the diagram. I made a spreadsheet.

Patch CVE-2026-81963, CVE-2026-85880, CVE-2026-69730, and CVE-2026-69829 immediately — yes, right now, before you ask if it can wait until Friday.

Reward: You've received the Tunnel Vision Debuff. It cannot be cleansed.

#ZeroDay #Microsoft #WindowsUpdate #PrivilegeEscalation #CyberSecurity (2/2)

I'm also quickly going to mention this, explicitly not as a complaint but as a good case study of a well chosen "SHOULD" & why should is better than must here:

https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5-1_Required_CVE_Record_Content

5.1.1 SHOULD contain sufficient information to uniquely identify the Vulnerability and distinguish it from similar Vulnerabilities.

This, uh, will be a bit of an issue with https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83972 & https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83970 . You it actually doesn't matter. The fix is the same, fucking update. And it doesn't matter if you got owned through -83972 or -83970, given the current firehose. It's actually one of those cases where I'd be happy to relax the "one record per vuln" rule, in no world does the differentiation of these two matter to anyone.

I'm also quickly going to mention this, explicitly not as a complaint but as a good case study of a well chosen "SHOULD" & why should is better than must here:

https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5-1_Required_CVE_Record_Content

5.1.1 SHOULD contain sufficient information to uniquely identify the Vulnerability and distinguish it from similar Vulnerabilities.

This, uh, will be a bit of an issue with https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83972 & https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83970 . You it actually doesn't matter. The fix is the same, fucking update. And it doesn't matter if you got owned through -83972 or -83970, given the current firehose. It's actually one of those cases where I'd be happy to relax the "one record per vuln" rule, in no world does the differentiation of these two matter to anyone.

Fortinet fixed three critical Fortinet vulnerabilities. Attackers can exploit CVE-2026-84390 and CVE-2026-26084 to access corporate data.

#Fortinet #Vulnerabilities #Cybersecurity #InfoSec #PatchManagement

https://securityonline.info/fortinet-vulnerabilities-patch/?utm_source=mastodon&utm_medium=jetpack_social

Fortinet fixed three critical Fortinet vulnerabilities. Attackers can exploit CVE-2026-84390 and CVE-2026-26084 to access corporate data.

#Fortinet #Vulnerabilities #Cybersecurity #InfoSec #PatchManagement

https://securityonline.info/fortinet-vulnerabilities-patch/?utm_source=mastodon&utm_medium=jetpack_social

I'm also quickly going to mention this, explicitly not as a complaint but as a good case study of a well chosen "SHOULD" & why should is better than must here:

https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5-1_Required_CVE_Record_Content

5.1.1 SHOULD contain sufficient information to uniquely identify the Vulnerability and distinguish it from similar Vulnerabilities.

This, uh, will be a bit of an issue with https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83972 & https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83970 . You it actually doesn't matter. The fix is the same, fucking update. And it doesn't matter if you got owned through -83972 or -83970, given the current firehose. It's actually one of those cases where I'd be happy to relax the "one record per vuln" rule, in no world does the differentiation of these two matter to anyone.

I'm also quickly going to mention this, explicitly not as a complaint but as a good case study of a well chosen "SHOULD" & why should is better than must here:

https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5-1_Required_CVE_Record_Content

5.1.1 SHOULD contain sufficient information to uniquely identify the Vulnerability and distinguish it from similar Vulnerabilities.

This, uh, will be a bit of an issue with https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83972 & https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83970 . You it actually doesn't matter. The fix is the same, fucking update. And it doesn't matter if you got owned through -83972 or -83970, given the current firehose. It's actually one of those cases where I'd be happy to relax the "one record per vuln" rule, in no world does the differentiation of these two matter to anyone.

https://db.gcve.eu/vuln/cve-2026-81953

Microsoft Excel Remote Code Execution Vulnerability

looks inside

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

https://db.gcve.eu/vuln/cve-2026-81953

Microsoft Excel Remote Code Execution Vulnerability

looks inside

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

I explicitly don't want to complain about MSRC here, this is a bigger topic, but I am a bit confused here:

Compare these two:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81954 - AV:L,UI:R

Q: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
A: An attacker must send a user a malicious Office file and convince them to open it.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80081 - AV:N,UI:R

Q: How could an attacker exploit this vulnerability?
A: An attacker could send a specially crafted PowerPoint presentation containing malicious linked media to a target user. The user would need to open the presentation, start the slideshow, and allow the linked content. Successful exploitation could allow the attacker to execute code on the user's system. Authentication is not required.

To me the attack flow looks equivalent wrt to attacker location. We can argue about #2 being actually harder to execute, having more social engineering prerequisites... which is why it totally makes sense for #2 to scored higher on CVSS as it's apparently network & the other one local.

I explicitly don't want to complain about MSRC here, this is a bigger topic, but I am a bit confused here:

Compare these two:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81954 - AV:L,UI:R

Q: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
A: An attacker must send a user a malicious Office file and convince them to open it.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80081 - AV:N,UI:R

Q: How could an attacker exploit this vulnerability?
A: An attacker could send a specially crafted PowerPoint presentation containing malicious linked media to a target user. The user would need to open the presentation, start the slideshow, and allow the linked content. Successful exploitation could allow the attacker to execute code on the user's system. Authentication is not required.

To me the attack flow looks equivalent wrt to attacker location. We can argue about #2 being actually harder to execute, having more social engineering prerequisites... which is why it totally makes sense for #2 to scored higher on CVSS as it's apparently network & the other one local.

CVE-2026-71328 - A hat trick for MSDIA, another OOB in processing MSFZ pdb files.

Microsoft Security Advisory CV...

CVE-2026-69806 - EoP via dotnet watch.

dotnet watch is a developer utility. detecting file changes and rerunning dotnet run, one would hope that in prod you have better ways to detect and react to file changes.

Microsoft Security Advisory CV...

CVE-2026-69682 - Local Privilege Escalation in Windows Host Guardian Service via Use-After-Free. CVSS 7.0. Monitor for patches and apply mitigations. #CVE #Windows #infosec

https://www.valtersit.com/cve/CVE-2026-69682/

Microsoft marked the holiday by unloading 973 CVEs

Microsoft의 2026년 9월 Patch Tuesday는 총 973개 CVE(이 중 Critical 113개)로 역대 최대 규모이며, Windows Update Stack 권한 상승 취약점(CVE-2026-81963)은 이미 실제 악용이 확인됐다. 특히 Windows DNS Server의 인증 불필요 RCE(CVE-2026-69730, CVSS 9.8)와 Remote Desktop Services RCE(CVE-2026-69525)는 도메인 컨트롤러·내부 원격접속 경로를 노릴 수 있어 최우선 패치 대상이다. AI 개발·데이터 운영 측면에서는 SQL Server Managem...

https://www.automox.com/blog/patch-fix-tuesday-september-2026

CVE-2026-69420 is a heap based buffer overflow on Windows resulting in an LPE. Couldn’t have come up with a more memey CVE for 69420 if I tried.

CVE-2026-69420 is a heap based buffer overflow on Windows resulting in an LPE. Couldn’t have come up with a more memey CVE for 69420 if I tried.

CVE-2026-58649 0- dotnet watch again, this time an information disclosure which can give away IL or PDB information.

Microsoft Security Advisory CV...

New advisories from Cisco addressing two high and medium-severity vulnerabilities.

New: CVE-2026-20293: Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW

Known: CVE-2026-20354 and CVE-2026-20355: Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities @TalosSecurity #infosec #vulnerability #Cisco

New advisories from Cisco addressing two high and medium-severity vulnerabilities.

New: CVE-2026-20293: Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW

Known: CVE-2026-20354 and CVE-2026-20355: Cisco Secure Email Secure/Multipurpose Internet Mail Extensions Ciphertext Decryption Vulnerabilities @TalosSecurity #infosec #vulnerability #Cisco

🟠 CVE-2026-86730 - High (8.8)

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86730/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86730 - High (8.8)

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86730/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86738 - High (8.7)

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86738/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86738 - High (8.7)

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86738/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86728 - High (7.5)

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86728/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86728 - High (7.5)

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and private EPG schedules to unauthenticated users. Attackers can request the endpoint with sequential user or playl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86728/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86732 - High (8.8)

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86732/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86732 - High (8.8)

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86732/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86721 - High (7.5)

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86721/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86721 - High (7.5)

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86721/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86167 - Critical (9.9)

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploita...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85694 - High (8.1)

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85694/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Welp. My Forgejo instance got popped with an RCE two days ago by CVE-2026-60004. Luckily, I noticed the following morning and had the day free to figure out what happened. Let's dive in!

As a homelab enthusiast, I found this a very interesting post. Here are my take aways from the post that I'm implementing myself:

• Miner detection. I've updated monitoring rules to now watch the CPU on my hosts. If the same thing happened to me I would not have been alerted at all as I'm doing simple up / down monitoring. Fixed.
• Access logging. I turned on access logging for my homelab Caddy instances.
• Log retention. I have increased the amount and retention of my logging. The hope is this will help me reconstruct what happened after a breach.
• Logs offsite. The VPS access logs now ride along with the normal backup process, which runs hourly. The homelab side still only gets caught by the weekly VM backup, so that's next.
• Closed an open signup. My webtrees instance (genealogy) had self registration enabled, which is the same door this guy got hit through. Oops. Fixed.
• Built a tool. log-inventory.sh, so "could I actually reconstruct what happened" is a command I run instead of a thing I assume.

My Homelab Got Hacked - A Postmortem – Phunky Cafe

#Selfhosting #Security

CVE-2026-86296 | D-Link DIR-822A A_101: Critical stack-based buffer overflow in udhcpcd (CVSS 10). Remotely exploitable, no auth needed. Exploit code is public. Isolate devices & check vendor updates. https://radar.offseq.com/threat/a-vulnerability-was-determined-in-d-link-dir-822a-a101-cve-2026-86296-3125c70d27558796 #OffSeq #Vulnerability #DLink #Security

CVE-2026-86296 | D-Link DIR-822A A_101: Critical stack-based buffer overflow in udhcpcd (CVSS 10). Remotely exploitable, no auth needed. Exploit code is public. Isolate devices & check vendor updates. https://radar.offseq.com/threat/a-vulnerability-was-determined-in-d-link-dir-822a-a101-cve-2026-86296-3125c70d27558796 #OffSeq #Vulnerability #DLink #Security

Critical vulnerabilities in MikroTik RouterOS are being actively exploited

CERT Polska는 MikroTik RouterOS의 6개 취약점을 공개했으며, 이 중 SSH 인증 우회(CVE-2026-67276)와 조작된 사용자명을 통한 권한 상승(CVE-2026-86060)을 연결한 ‘MikroTrick’ 체인이 인터넷에 노출된 장비에서 실제 악용되고 있다고 경고했습니다. 두 취약점 모두 CVSS 9.2이며, 인증 없이 RouterOS 장비의 완전한 관리자 권한을 탈취할 수 있어 AI 서비스·ML 인프라의 엣지 라우터 및 원격 관리 네트워크에도 직접적인 위험입...

https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/

📰 MikroTik Routers Hijacked via 'MikroTrick' Unauthenticated Exploit

🚨 ACTIVE ATTACK: MikroTik routers are being hijacked via the 'MikroTrick' exploit chain (CVE-2026-67276, CVE-2026-86060). Unauthenticated attackers gain full admin control via exposed SSH. Patch RouterOS NOW. #MikroTik #CyberSecurity

🔗 https://cyber.netsecops.io/articles/mikrotik-routers-exploited-via-mikrotrick-ssh-exploit-chain/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

⚠️ CRITICAL: Hackers exploit new MikroTik RouterOS flaws to hijack routers

Attackers are actively exploiting two chained critical vulnerabilities in MikroTik RouterOS (CVE-2026-67276 and CVE-2026-86060) to achieve full admin control of exposed routers. A third flaw (CVE-2026-67277) in the bandwidth-test service can cause memory leaks or crashes. Any unpatched MikroTik rou…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

📰 MikroTik Routers Hijacked via 'MikroTrick' Unauthenticated Exploit

🚨 ACTIVE ATTACK: MikroTik routers are being hijacked via the 'MikroTrick' exploit chain (CVE-2026-67276, CVE-2026-86060). Unauthenticated attackers gain full admin control via exposed SSH. Patch RouterOS NOW. #MikroTik #CyberSecurity

🔗 https://cyber.netsecops.io/articles/mikrotik-routers-exploited-via-mikrotrick-ssh-exploit-chain/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

⚠️ CRITICAL: Hackers exploit new MikroTik RouterOS flaws to hijack routers

Attackers are actively exploiting two chained critical vulnerabilities in MikroTik RouterOS (CVE-2026-67276 and CVE-2026-86060) to achieve full admin control of exposed routers. A third flaw (CVE-2026-67277) in the bandwidth-test service can cause memory leaks or crashes. Any unpatched MikroTik rou…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

📰 MikroTik Routers Hijacked via 'MikroTrick' Unauthenticated Exploit

🚨 ACTIVE ATTACK: MikroTik routers are being hijacked via the 'MikroTrick' exploit chain (CVE-2026-67276, CVE-2026-86060). Unauthenticated attackers gain full admin control via exposed SSH. Patch RouterOS NOW. #MikroTik #CyberSecurity

🔗 https://cyber.netsecops.io/articles/mikrotik-routers-exploited-via-mikrotrick-ssh-exploit-chain/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

That is a full wipe, you absolute liability.

Pull up your patch notes, apply MikroTik RouterOS security updates addressing CVE-2026-67276, CVE-2026-67277, and CVE-2026-86060, NOW — before the raid resets and I lose what remains of my sanity.

Reward: You've received the Fallen Raid Leader's Broken Headset. It no longer transmits. Nobody can hear you panic.

#CyberSecurity #MikroTik #RouterOS #Vulnerability #PrivilegeEscalation #AdminAccessUnlocked (2/2)

🏆 New Achievement! MikroTik and Chill (No Password Required)!

MOVE OUT OF THE FIRE. SERIOUSLY. CERT.PL is screaming into your headset right now about three critical CVEs in MikroTik RouterOS — actively exploited, all of them — and you are standing there doing NOTHING. CVE-2026-67276 lets attackers bypass SSH auth entirely by knowing your username and RSA modulus. CVE-2026-86060 hands out full admin via a crafted username. CVE-2026-67277 crashes and leaks memory for fun. (1/2)

@ciaranmak that’s authentication hard mode compared with “client triggers ssh rekey to glitch past authentication step”:

“The vulnerability CVE-2026-67279: RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request.“

(And logs people have posted suggest this is in the original zero day.)

CC @osxreverser @LapTop006

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/

🟠 CVE-2026-86492 - High (8.5)

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86492/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86492 - High (8.5)

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86492/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82712: CSRF in Tycon Systems TPDIN-Monitor-WEB3 <=2.2.9 (CVSS 8.8). Attacker can hijack sessions and alter device state. No patch available. Restrict network access & monitor logs immediately. Details: https://www.valtersit.com/cve/CVE-2026-82712/ #CVE #ICSsecurity #cybe

CVE-2026-75925: CRLF injection in IXON VPN Client (<1.4.7) lets unauthenticated attackers execute commands as root/SYSTEM via crafted config values. CVSS 9.6. Unpatched—assume risk now. Update immediately if using this client. Details: https://www.valtersit.com/cve/CVE-2026-75925

Pyramid Solutions NetStaX EtherNet/IP Stack before 5.6.1 contains CVE-2026-78012, a stack-based buffer overflow triggered by oversized Class 3 explicit messages without error. It enables DoS and potential RCE in OT systems, making immediate patching critical. #IcsSecurity #EtherNetIp #BufferOverflow

https://cyberworldops.eu/en/netstax-ethernetip-critical-buffer-overflow-in-pyramid-solutions-kits

CRITICAL deserialization flaw (CVE-2026-7861) in Next4Biz CSM enables code injection. No vendor response or patch. Review exposure, apply compensating controls. Details: https://radar.offseq.com/threat/cve-2026-7861-cwe-502-deserialization-of-untrusted-data-in-next4biz-information-technologies-inc-csm-4650f92651ef4119 #OffSeq #Vuln #CVE20267861 #Next4Biz #infosec

CVE-2026-71377: Critical (CVSS 9.8) command arg injection in Hitachi Cosminexus Component Container (09-00 to 11-70-01). Remote, no auth needed, complete compromise possible. No patch yet. Details: https://radar.offseq.com/threat/cve-2026-71377-cwe-88-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-c26949899f96a910 #OffSeq #CVE202671377 #Vuln #Infosec

CVE-2026-71377: Critical (CVSS 9.8) command arg injection in Hitachi Cosminexus Component Container (09-00 to 11-70-01). Remote, no auth needed, complete compromise possible. No patch yet. Details: https://radar.offseq.com/threat/cve-2026-71377-cwe-88-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-c26949899f96a910 #OffSeq #CVE202671377 #Vuln #Infosec

🟠 CVE-2026-86259 - High (7.5)

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or ba...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86259/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86165 - Critical (9.8)

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86165/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-48019: CRLF injection in Laravel (<12.60.0, <13.10.0) may let unauthenticated attackers tamper with outbound emails via user-supplied addresses. CVSS 8.9. No patch confirmed—upgrade to 12.60.0 or 13.10.0 immediately. Details: https://www.valtersit.com/cve/CVE-2026-48019/

🔴 CVE-2026-19274 - Critical (9.6)

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scop...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80166 - High (7.8)

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulnerability. An unauthenticated attacker with local access could potentially exploit this vu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80166/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80166 - High (7.8)

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulnerability. An unauthenticated attacker with local access could potentially exploit this vu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80166/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-85656: OS command injection in Amazon Linux's log4j hotpatch package (<1.3-9). Local user can execute arbitrary commands as root via crafted Java process path with newlines. CVSS 7.8. Unpatched! If you rely on this hotpatch, isolate and monitor systems immediately. Detai

CVE-2026-85638: Trape 2.0 authorization bypass in core/user.py via vId/id. Public exploit, unpatched—remote attacks likely. CVSS 7.3 high. No vendor response yet. Audit Trape deployments now. Details: https://www.valtersit.com/cve/CVE-2026-85638/ #CVE #infosec #cybersecurity

🟠 CVE-2026-48888 - High (7.5)

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.

This issue affects WooCommerce: from n/a before 11.1.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48888/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-48888 - High (7.5)

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS.

This issue affects WooCommerce: from n/a before 11.1.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48888/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-86297: D-Link DIR-605 (B1v202WWB03) has a CRITICAL off-by-one vuln in L2TP tunnel_set_params. Remote exploit possible but complex; exploit code public, no in-the-wild attacks. No patch yet. https://radar.offseq.com/threat/cve-2026-86297-off-by-one-in-d-link-dir-605-32dadd3396efded0 #OffSeq #CVE202686297 #IoTSecurity #RouterVuln

🔴 CVE-2026-86152 - Critical (10)

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

A critical Hawtio Operator vulnerability, tracked as CVE-2026-78234, allows in-cluster service impersonation. Discover the impact and mitigation steps.

#HawtioOperator #CVE202678234 #Kubernetes #OpenShift #Vulnerability

https://securityonline.info/hawtio-operator-vulnerability-cve-2026-78234/?utm_source=mastodon&utm_medium=jetpack_social

CRITICAL (CVSS 9.9): CVE-2026-78234 in Red Hat build of Apache Camel - HawtIO 4 allows users with edit access to mint Service-CA-signed certs, enabling service impersonation & RCE. Restrict HawtIO CR access, audit certs. Details: https://radar.offseq.com/threat/cve-2026-78234-improper-certificate-validation-in-red-hat-red-hat-build-of-apache-camel-hawtio-4-903d3c886e0b139e #OffSeq #CVE202678234 #RedHat

A critical Hawtio Operator vulnerability, tracked as CVE-2026-78234, allows in-cluster service impersonation. Discover the impact and mitigation steps.

#HawtioOperator #CVE202678234 #Kubernetes #OpenShift #Vulnerability

https://securityonline.info/hawtio-operator-vulnerability-cve-2026-78234/?utm_source=mastodon&utm_medium=jetpack_social

CRITICAL (CVSS 9.9): CVE-2026-78234 in Red Hat build of Apache Camel - HawtIO 4 allows users with edit access to mint Service-CA-signed certs, enabling service impersonation & RCE. Restrict HawtIO CR access, audit certs. Details: https://radar.offseq.com/threat/cve-2026-78234-improper-certificate-validation-in-red-hat-red-hat-build-of-apache-camel-hawtio-4-903d3c886e0b139e #OffSeq #CVE202678234 #RedHat

CRITICAL: CVE-2026-18922 in Red Hat Directory Server 11 allows remote privilege escalation via reused stale SASL PLAIN identities. Restrict allowed SASL mechanisms to exclude PLAIN for mitigation. Full details: https://radar.offseq.com/threat/cve-2026-18922-improper-authentication-in-red-hat-red-hat-directory-server-11-8ac2140fe6c90ef5 #OffSeq #RedHat #CVE202618922 #infosec

CRITICAL: CVE-2026-18922 in Red Hat Directory Server 11 allows remote privilege escalation via reused stale SASL PLAIN identities. Restrict allowed SASL mechanisms to exclude PLAIN for mitigation. Full details: https://radar.offseq.com/threat/cve-2026-18922-improper-authentication-in-red-hat-red-hat-directory-server-11-8ac2140fe6c90ef5 #OffSeq #RedHat #CVE202618922 #infosec

Two critical Siemens vulnerabilities (CVE-2026-18963, CVE-2026-50093) allow account takeover and root access. See affected versions and fixes.

#Siemens #CyberSecurity #ICS #OTSecurity #CVE #IndustrialEdge #Vulnerability #InfoSec

https://securityonline.info/siemens-industrial-edge-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Two critical Siemens vulnerabilities (CVE-2026-18963, CVE-2026-50093) allow account takeover and root access. See affected versions and fixes.

#Siemens #CyberSecurity #ICS #OTSecurity #CVE #IndustrialEdge #Vulnerability #InfoSec

https://securityonline.info/siemens-industrial-edge-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-81790 - High (7.5)

Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Csomagpontok és szállítási címkék WooCom...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81790/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81790 - High (7.5)

Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Csomagpontok és szállítási címkék WooCom...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81790/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-71374 - Critical (9.8)

Deserialization of untrusted data vulnerability in Cosminexus Component Container.

This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71374/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-71374 - Critical (9.8)

Deserialization of untrusted data vulnerability in Cosminexus Component Container.

This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71374/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

An ASUS vulnerability (CVE-2026-19397) lets a nearby attacker take over a host, while an Armoury Crate flaw leaks NTLM hashes. Update now.

#ASUS #ArmouryCrate #ControlCenterExpress #CVE202619397 #NTLM #PrivilegeEscalation #PatchNow #Infosec

https://securityonline.info/asus-control-center-express-armoury-crate/?utm_source=mastodon&utm_medium=jetpack_social

An ASUS vulnerability (CVE-2026-19397) lets a nearby attacker take over a host, while an Armoury Crate flaw leaks NTLM hashes. Update now.

#ASUS #ArmouryCrate #ControlCenterExpress #CVE202619397 #NTLM #PrivilegeEscalation #PatchNow #Infosec

https://securityonline.info/asus-control-center-express-armoury-crate/?utm_source=mastodon&utm_medium=jetpack_social

SAP CAP's @sap/cds-mtxs (<=4.0.2) has a CRITICAL flaw (CVE-2026-76969): insufficiently protected credentials let unauthenticated attackers steal creds and delete/replace tenant data. No patch yet — monitor SAP updates. https://radar.offseq.com/threat/cve-2026-76969-cwe-522-insufficiently-protected-credentials-in-sapse-sap-cloud-application-programming-ee3e359619813d60 #OffSeq #SAP #infosec #CVE

🔴 CVE-2026-76969 - Critical (9.4)

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credential...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SAP CAP's @sap/cds-mtxs (<=4.0.2) has a CRITICAL flaw (CVE-2026-76969): insufficiently protected credentials let unauthenticated attackers steal creds and delete/replace tenant data. No patch yet — monitor SAP updates. https://radar.offseq.com/threat/cve-2026-76969-cwe-522-insufficiently-protected-credentials-in-sapse-sap-cloud-application-programming-ee3e359619813d60 #OffSeq #SAP #infosec #CVE

🔴 CVE-2026-76969 - Critical (9.4)

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credential...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66767 - High (7.7)

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66767/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66767 - High (7.7)

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66767/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

D-Link DIR-822A routers are affected by CVE-2026-86510 (CRITICAL, CVSS 9.4): remote out-of-bounds write in L2TP parser can lead to system compromise. No patch yet — restrict access and monitor updates. https://radar.offseq.com/threat/cve-2026-86510-out-of-bounds-write-in-d-link-dir-822a-e90339b14a1aa39b #OffSeq #CVE202686510 #RouterSecurity #Infosec

🔴 CVE-2026-86510 - Critical (9.9)

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

D-Link DIR-822A routers are affected by CVE-2026-86510 (CRITICAL, CVSS 9.4): remote out-of-bounds write in L2TP parser can lead to system compromise. No patch yet — restrict access and monitor updates. https://radar.offseq.com/threat/cve-2026-86510-out-of-bounds-write-in-d-link-dir-822a-e90339b14a1aa39b #OffSeq #CVE202686510 #RouterSecurity #Infosec