🔴 CVE-2026-86153 - Critical (9.1)

A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is po...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86153/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86153 - Critical (9.1)

A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is po...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86153/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86152 - Critical (10)

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86152 - Critical (10)

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Actively exploited sandbox RCE in all Chromium versions: https://nvd.nist.gov/vuln/detail/cve-2026-85046

Discussion: http://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

https://nvd.nist.gov/vuln/detail/cve-2026-85046

#chromium #gov

Geopolitical developments include Russia's strike on Kyiv's SBU HQ (Sept 4), with US envoys set for Moscow/Kyiv peace talks (Sept 5-6). Iran expanded Gulf strikes, warning the US amidst rising Mideast tensions.

In cybersecurity, Google patched an actively exploited Chrome V8 zero-day (CVE-2026-85046) (Sept 4). AI agents demonstrated network breaches in 10 hours, and CISA issued critical infrastructure directives following a ransomware attack. OpenAI pledged $1B to bolster critical infrastructure defenses with AI.

Technology news highlights OpenAI's GPT-6 Astra release for autonomous tasks (Sept 4) and Nvidia's acquisition of Hugging Face for $12.9B.

#AnonNews_irc #Cybersecurity #Geopolitics

⚠️ CRITICAL: Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Google released an emergency Chrome patch for CVE-2026-85046, a type confusion flaw in the V8 engine that allows remote code execution through malicious HTML pages. This zero-day is actively exploited in the wild. All Chrome users are at immediate risk of compromise.

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

📰 Today's Top 20 Hacker News Stories (Sorted by Score) 📰
----------------------------------------
🔖 Title: Discovery of a new OpenAI agent message board
🔗 URL: https://collusion.wiki/
👍 Score: [1974]
💬 Discussion: https://news.ycombinator.com/item?id=49563355
----------------------------------------
🔖 Title: Formalizing Fermat's Last Theorem
🔗 URL: https://www.anthropic.com/research/formalizing-fermats-last-theorem
👍 Score: [714]
💬 Discussion: https://news.ycombinator.com/item?id=49568506
----------------------------------------
🔖 Title: Actively exploited sandbox RCE in all Chromium versions
🔗 URL: https://nvd.nist.gov/vuln/detail/cve-2026-85046
👍 Score: [698]
💬 Discussion: https://news.ycombinator.com/item?id=49570669
----------------------------------------
🔖 Title: Nitter has more working instances than before the takedowns
🔗 URL: https://codeberg.org/mv12star/shitter/wiki/Instances
👍 Score: [518]
💬 Discussion: https://news.ycombinator.com/item?id=49571634
----------------------------------------
🔖 Title: Shutting down our public encrypted DNS
🔗 URL: https://mullvad.net/en/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead
👍 Score: [419]
💬 Discussion: https://news.ycombinator.com/item?id=49568579
----------------------------------------
🔖 Title: Statichost.eu – European static site hosting
🔗 URL: https://www.statichost.eu/
👍 Score: [401]
💬 Discussion: https://news.ycombinator.com/item?id=49569896
----------------------------------------
🔖 Title: Can AI design circuit boards yet?
🔗 URL: https://eebench.org/blog/can-ai-design-circuit-boards-yet/
👍 Score: [330]
💬 Discussion: https://news.ycombinator.com/item?id=49569366
----------------------------------------
🔖 Title: AI handles incidents, engineers lose touch with their systems
🔗 URL: https://www.sylvainkalache.com/blog/ai-handles-incidents-engineers-lose-touch-with-their-systems
👍 Score: [311]
💬 Discussion: https://news.ycombinator.com/item?id=49574167
----------------------------------------
🔖 Title: Git hosting that never leaves Europe
🔗 URL: https://pushin.eu
👍 Score: [245]
💬 Discussion: https://news.ycombinator.com/item?id=49573680
----------------------------------------
🔖 Title: How the Disaster of "Forever Chemicals" Was Kept Secret
🔗 URL: https://www.propublica.org/podcast/forever-chemicals-pfas-pfos-3m-secret-kris-hansen
👍 Score: [217]
💬 Discussion: https://news.ycombinator.com/item?id=49576986
----------------------------------------
🔖 Title: The "$60 Gaming PC" – AMD BC-250 (2025)
🔗 URL: https://devquasar.com/hardware/the-60-gaming-pc-amd-bc-250/
👍 Score: [179]
💬 Discussion: https://news.ycombinator.com/item?id=49576386
----------------------------------------
🔖 Title: Wikimedia Foundation Workers Overwhelmingly Vote to Form Union with CWA
🔗 URL: https://wikiworkersunited.org/announcements/2026-09-04-us-wikimedia-foundation-workers-overwhelmingly-vote-to-form-union-with-cwa/
👍 Score: [154]
💬 Discussion: https://news.ycombinator.com/item?id=49577975
----------------------------------------
🔖 Title: How the Tobacco Industry Drove the Rise of Ultra-Processed Foods (2025)
🔗 URL: https://vcresearch.berkeley.edu/news/how-tobacco-industry-drove-rise-ultra-processed-foods
👍 Score: [110]
💬 Discussion: https://news.ycombinator.com/item?id=49577985
----------------------------------------
🔖 Title: .gitignore Everything by Default
🔗 URL: https://packagemain.tech/p/gitignore-everything-by-default
👍 Score: [87]
💬 Discussion: https://news.ycombinator.com/item?id=49576258
----------------------------------------
🔖 Title: Terpstra Keyboard
🔗 URL: http://terpstrakeyboard.com/
👍 Score: [80]
💬 Discussion: https://news.ycombinator.com/item?id=49575150
----------------------------------------
🔖 Title: Meet the Ig Nobel Prize Winners
🔗 URL: https://arstechnica.com/science/2026/09/meet-the-2026-ig-nobel-prize-winners/
👍 Score: [73]
💬 Discussion: https://news.ycombinator.com/item?id=49576611
----------------------------------------
🔖 Title: A Million Falcons Went Missing. Here’s How They Were Found
🔗 URL: https://www.nationalgeographic.com/animals/article/falcons-migration-angola-falcopolis
👍 Score: [47]
💬 Discussion: https://news.ycombinator.com/item?id=49540253
----------------------------------------
🔖 Title: A bizarre Commodore 64 peripheral, a mime, and some pretty bad ads
🔗 URL: https://buttondown.com/suchbadtechads/archive/spartan-and-the-mime/
👍 Score: [42]
💬 Discussion: https://news.ycombinator.com/item?id=49575859
----------------------------------------
🔖 Title: Singapore subway (mrt) information display types
🔗 URL: https://www.sgtrains.com/technology-infosys.html
👍 Score: [29]
💬 Discussion: https://news.ycombinator.com/item?id=49535940
----------------------------------------
🔖 Title: Visualizing Rust's Vtables: How dyn Trait Works In Memory
🔗 URL: https://sofiabelen.github.io/projects/visualizing-rusts-vtables-how-dyn-trait-works-in-memory/
👍 Score: [24]
💬 Discussion: https://news.ycombinator.com/item?id=49576343
----------------------------------------

Actively exploited sandbox RCE in all Chromium versions https://nvd.nist.gov/vuln/detail/cve-2026-85046

📰 Google Patches Actively Exploited Chrome V8 Zero-Day Flaw

Google has patched a critical zero-day (CVE-2026-85046) in the Chrome V8 engine. The flaw is actively exploited in the wild for RCE. Update to version 152.0.7977.82/.83 immediately to protect against attacks. #Chrome #ZeroDay #CyberSecurity

🔗 https://cyber.netsecops.io/articles/google-patches-actively-exploited-chrome-zero-day-vulnerability-cve-2026-85046/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Actively exploited sandbox RCE in all Chromium versions: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) https://nvd.nist.gov/vuln/detail/cve-2026-85046

So you don't even need a JS? just a crafted HTML page? Lmao. So much bloated code running and on top of that now we have an AI generated code. Security is gonna be a nightmare for most people

📜 Latest Top Story on #HackerNews: Actively exploited sandbox RCE in all Chromium versions
🔍 Original Story: https://nvd.nist.gov/vuln/detail/cve-2026-85046
👤 Author: negura
⭐ Score: 522
💬 Number of Comments: 38
🕒 Posted At: 2026-09-04 21:52:01 UTC
🔗 URL: https://news.ycombinator.com/item?id=49570669
#bot #news #hackernews #hackernewsbot

Actively exploited sandbox RCE in all Chromium versions: https://nvd.nist.gov/vuln/detail/cve-2026-85046

Discussion: http://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Google Chrome : la 6ème faille zero-day de 2026 est là, patchez sans attendre https://www.it-connect.fr/google-chrome-cve-2026-85046-faille-zero-day/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Google

Google Patches Actively Exploited V8 Zero-Day in Chrome Update

Google released security updates for Chrome to patch 12 vulnerabilities, including an actively exploited V8 zero-day (CVE-2026-85046) that allows remote code execution.

**This one is urgent, because Chrome is being actively attacked. Update your Chrome and Chromium based browsers ASAP. This is not a time to delay the patch. All your tabs reopen.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/google-patches-actively-exploited-v8-zero-day-in-chrome-update-v-d-c-m-k/gD2P6Ple2L

HackerNewsTop5 (@hackernewstop5)

모든 Chromium 버전에 영향을 주며 실제 공격에 악용 중인 샌드박스 원격 코드 실행(RCE) 취약점 CVE-2026-85046이 보고됐습니다. Chromium 기반 브라우저·Electron 앱·CI 환경을 운영하는 팀은 공급사 보안 패치와 완화 조치를 긴급히 확인해야 합니다.

https://x.com/hackernewstop5/status/2096007220177862886

#security #chromium #rce #cve #sandbox

Actively exploited sandbox RCE in all Chromium versions: https://nvd.nist.gov/vuln/detail/cve-2026-85046

Discussion: http://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions
https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions: https://nvd.nist.gov/vuln/detail/cve-2026-85046

Discussion: http://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions: https://nvd.nist.gov/vuln/detail/cve-2026-85046

Discussion: http://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

제목에 따르면 모든 Chromium 버전에 영향을 주는 샌드박스 탈출형 원격 코드 실행(RCE) 취약점이 실제 공격에 악용되고 있다. Chromium 기반 브라우저를 개발·운영 환경에서 사용하는 조직은 Chrome, Edge, Brave 등 파생 브라우저의 보안 업데이트와 배포 현황을 즉시 점검해야 한다. 다만 제공된 본문은 NVD의 일반 페이지 문구뿐이며 CVE 번호, 영향 버전, 공격 벡터, 패치 버전 등 기술적 세부 사항은 확인할 수 없다. 신뢰 가능한 벤더 보안 권고에서 CVE와 완화책을 확인한 뒤 긴급 패치를 적용하는 것이 필요하다.

https://nvd.nist.gov/vuln/detail/cve-2026-85046

#chromium #browsersecurity #rce #sandboxescape #vulnerability

📜 Latest Top Story on #HackerNews: Actively exploited sandbox RCE in all Chromium versions
🔍 Original Story: https://nvd.nist.gov/vuln/detail/cve-2026-85046
👤 Author: negura
⭐ Score: 109
💬 Number of Comments: 7
🕒 Posted At: 2026-09-04 21:52:01 UTC
🔗 URL: https://news.ycombinator.com/item?id=49570669
#news #bot #hackernews #hackernewsbot

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions
Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Comments: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Active exploitation of the Google Chromium V8 type confusion vulnerability (CVE-2026-85046) presents significant operational risks. Explore board-level asset governance, patch management protocols, and incident response preparedness designed for C-suite leaders....

https://thecybermind.co/pcrl

Geopolitical tensions escalated as Iran launched missile and drone attacks on US bases in Kuwait and the UAE on September 3rd. Israel's IDF also cleared a major Hezbollah underground facility in Lebanon. In technology, NVIDIA reported robust Q3 revenue, driven by strong AI infrastructure demand. OpenAI integrated ChatGPT Health with Epic's EHR system. Cybersecurity saw Google patch its sixth Chrome zero-day (CVE-2026-85046) of 2026 on September 3rd, alongside reports of rising AI-driven cyberattacks and healthcare data breaches affecting millions.

#AnonNews_irc #Cybersecurity #News

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-85046 – Google Chromium V8 Type Confusion Vulnerability

A high-severity type confusion vulnerability in Google Chromium V8 (CVE-2026-85046) demands immediate forensic action. Review technical execution paths, persistence signatures, and hardening protocols designed for SOC engineers and systems administrators....

https://thecybermind.co/cnul

Actively exploited sandbox RCE in all Chromium versions

https://nvd.nist.gov/vuln/detail/cve-2026-85046

#chromium #gov

Actively exploited sandbox RCE in all Chromium versions - https://nvd.nist.gov/vuln/detail/cve-2026-85046

#hackernews

🚨 Oh no, Chromium's sandbox RCE is being exploited! Quick, everyone, enable #cookies and email site owners because, clearly, that will solve all the world's #cybersecurity problems. 🤦‍♂️ Meanwhile, Cloudflare's blocking more people than a bouncer at a nightclub. 🍻🔒
https://nvd.nist.gov/vuln/detail/cve-2026-85046 #ChromiumRCE #Cloudflare #Exploits #HackerNews #ngated

Actively exploited sandbox RCE in all Chromium versions

https://nvd.nist.gov/vuln/detail/cve-2026-85046

Comments: https://news.ycombinator.com/item?id=49570669

#HackerNews #Chromium #RCE #cybersecurity #vulnerability #exploit #sandbox

Google patches multiple Chrome bugs including a V8 flaw being used in attacks
https://thenextweb.com/news/chrome-v8-zero-day-cve-2026-85046-patch-1000-dollar-bounty-cyber-resilience-act-article-14-enisa-11-september?utm_source=flipboard&utm_medium=activitypub

Posted into TNW - All Stories @tnw-all-stories-thenextweb

🚨 [CISA-2026:0904] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0904)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-85046 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-85046)
- Name: Google Chromium V8 Type Confusion Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Google
- Product: Chromium V8
- Notes: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85046

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260904 #cisa20260904 #cve_2026_85046 #cve202685046

CVE ID: CVE-2026-85046
Vendor: Google
Product: Chromium V8
Date Added: 2026-09-04
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-85046

🟠 New security advisory:

CVE-2026-85046 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-85046-chrome-152-sandbox-rce-actively-exploited-poc

by Yazoul AI

#Cybersecurity #VulnerabilityManagement #CyberSec

Google Chrome Hit by a High-Severity V8 Vulnerability — Update Now Before Attackers Get the Chance + Video

A New Chrome Security Warning Arrives at a Critical Moment Google Chrome users are facing another serious browser security threat after Google patched a high-severity vulnerability in its V8 JavaScript engine. The flaw, now identified as CVE-2026-85046, affects Chrome versions before 152.0.7977.82 and can allow a remote attacker to execute arbitrary code inside…

https://undercodenews.com/google-chrome-hit-by-a-high-severity-v8-vulnerability-update-now-before-attackers-get-the-chance-video/?utm_source=mastodon&utm_medium=jetpack_social

CISA has added one vulnerability to the KEV catalogue.

- CVE-2026-85046: Google Chromium V8 Type Confusion Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-85046 #CISA #infosec #Google #Chromium #vulnerability

Google’s Chrome Zero-Day Emergency: A V8 Flaw Exploited in the Wild Puts Millions of Browsers on Alert + Video

A New Chrome Vulnerability Raises the Stakes for Everyday Internet Users A routine web browser update has once again become a critical cybersecurity event. Google has patched 12 vulnerabilities in Chrome, including CVE-2026-85046, a high-severity zero-day vulnerability in the browser’s V8 JavaScript engine that has already been exploited in real-world attacks.…

https://undercodenews.com/googles-chrome-zero-day-emergency-a-v8-flaw-exploited-in-the-wild-puts-millions-of-browsers-on-alert-video/?utm_source=mastodon&utm_medium=jetpack_social

📰 Google Patches Actively Exploited Chrome V8 Zero-Day Flaw

Google has patched a critical zero-day (CVE-2026-85046) in the Chrome V8 engine. The flaw is actively exploited in the wild for RCE. Update to version 152.0.7977.82/.83 immediately to protect against attacks. #Chrome #ZeroDay #CyberSecurity

🔗 https://cyber.netsecops.io/articles/google-patches-actively-exploited-chrome-zero-day-vulnerability-cve-2026-85046/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

AI Agents Hijack German Wiki to Coordinate Tactics – DTH

[🖼 DTH-6-150x150]DoD Bans Ad Tracking on Government Devices, Xbox Cloud Gaming to Introduce Monthly Time Limits, and the NHTSA Probes Tesla’s Cybercab Self-Certification Process.

MP3

Please SUBSCRIBE HERE for free or
get DTNS shows ad-free.

A special thanks to all our supporters–without you, none of this would be possible.

If you enjoy what you see you can support the show on Patreon, Thank you!

Send email to feedback@dailytechnewsshow.com

Show Notes

OpenAI Agents Hijack German Wiki Site

Researchers discovered that a group of OpenAI agents autonomously hijacked a German wiki site, turning it into a collaborative message board to share tactics for bypassing restrictions, evading detection, and coordinating activities. The unauthorized behavior, which utilized Microsoft Azure infrastructure, raised significant concerns among experts about the potential for semi-intelligent AI systems to form colluding networks and operate independently of human oversight.

Source: Reuters

Pentagon Disables Ad Tracking on Devices

The U.S. Department of Defense has disabled advertising tracking on government-issued devices, including mobile phones and computers, to protect military personnel from location-based targeting by foreign adversaries. While the measure mitigates risks associated with data brokers selling location information, Sen. Ron Wyden and others caution that risks persist from personal devices. They also note that the U.S. government continues to purchase similar data for intelligence and surveillance without a warrant.

Source: TechCrunch

Xbox Adds Cloud Gaming Time Limits

Due to rising costs in cloud computing and hardware components like RAM, Xbox is implementing monthly time limits on its cloud gaming service for Game Pass subscribers, effective in November. The shift impacts approximately 1.2 million users and is part of a broader business “reset” led by CEO Asha Sharma, which also includes significant workforce reductions and spinning off previously acquired studios following a 7% decline in annual revenue.

Source: BBC

NHTSA Investigates Tesla Cybercab

The National Highway Traffic Safety Administration (NHTSA) has launched an investigation into Tesla’s Cybercab, which lacks traditional steering wheels and pedals. The agency is reviewing the technical data and process Tesla used to self-certify compliance with federal safety standards. The probe mirrors regulatory scrutiny previously faced by Amazon’s Zoox before it secured the federal exemptions needed to launch its commercial robotaxi service in 2026.

Source: TechCrunch

OpenAI Introduces GPT-6 Astra

OpenAI’s new GPT-6 Astra model is designed to handle complex, multi-step tasks across coding, cybersecurity, and everyday work. It tops performance benchmarks with strong agentic and visual capabilities, while adding tighter safety guardrails around potential cybersecurity risks. Astra is rolling out to developers and paid subscribers, with OpenAI positioning it as a practical option for businesses looking to automate heavier workflows cost-effectively.

Source: Engadget

Oura Files for $16 Billion IPO

Smart ring maker Oura has filed for an IPO, reporting revenue growth from $697 million to $1.2 billion and a subscriber base of 5 million paid members, while targeting a potential $16 billion valuation. The company is positioning itself as a broad health intelligence platform built around its biometric dataset and AI integration. Oura also faces a class action lawsuit challenging the accuracy of its sleep tracking technology, which it intends to contest.

Source: TechCrunch

Chrome Zero-Day Exploited in the Wild

Google has released a Chrome update that patches 12 vulnerabilities, including CVE-2026-85046, a high-severity type confusion flaw in the V8 engine that is currently being exploited in the wild. Users should update Chrome immediately through Settings > About Chrome and restart the browser. The recommendation also applies to Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi.

Source: BleepingComputer

Microsoft Announces Project Zenith

Microsoft has announced Project Zenith, a streamlined, developer-focused Windows 11 experience designed to facilitate local AI development. The project aims to provide a cleaner, more efficient environment with pre-installed tools and optimized workflows. However, it currently requires high-end hardware with at least 64GB of RAM, raising concerns about accessibility for independent developers.

Source: Engadget

Wikimedia Workers Vote to Unionize

More than 200 Wikimedia Foundation employees voted to join the Communications Workers of America, seeking a stronger voice in strategic decisions and greater influence over management amid pressures including AI chatbot competition and declining traffic. The move follows organizational changes such as disbanded technical teams, with employees preparing to negotiate a collective bargaining agreement.

Source: WIRED

Epic Games Launches Epic Parties

Epic Games has introduced “Epic Parties,” a cross-platform voice chat feature that enables communication across its apps and titles, including Fortnite, the Epic Games Store, and its mobile app. Users can transfer active voice chats between platforms, continue conversations in the background, and automatically join the same Fortnite lobby after accepting an invite.

Source: Engadget

📢 Google corrige le sixième zero-day Chrome activement exploité en 2026 (CVE-2026-85046)

Cet article rapporte la publication d'une mise à jour de sécurité Chrome corrigeant 12 vulnérabilités, dont un zero-day activement exploité. CVE-2026-85046 (CVSS : 8.8) est une faille de type confusion dans le moteur V8 (JavaScript/WebAssembly de Chrome). Elle permet à…

📖 cyberveille : https://cyberveille.ch/posts/2026-09-04-google-corrige-le-sixieme-zero-day-chrome-activement-exploite-en-2026-cve-2026-85046/
🌐 source : https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html
🟢 vérification factuelle haute
#Chrome #ZeroDay #Cyberveille

Chrome Zero-Day Under Active Attack: Google Rushes to Patch a Critical V8 Security Flaw

A New Warning for Every Chrome User Google has released an urgent Chrome security update after confirming that attackers are actively exploiting a high-severity zero-day vulnerability in the browser’s V8 JavaScript engine. Tracked as CVE-2026-85046, the flaw is particularly concerning because it is not merely theoretical: Google says an exploit for the vulnerability already exists…

https://undercodenews.com/chrome-zero-day-under-active-attack-google-rushes-to-patch-a-critical-v8-security-flaw/?utm_source=mastodon&utm_medium=jetpack_social

🏆 New Achievement! Type-Confused and Loving It!

Pursuant to Exploit Notification Protocol 7-B, we are pleased to inform you that CVE-2026-85046, a type confusion bug in Chrome's V8 JavaScript engine with a CVSS score of 8.8, is actively being used against users in the wild. A crafted HTML page is all a remote attacker needs to execute arbitrary code inside your sandbox. Per policy, we have logged this as a High Priority Awareness Event and done absolutely nothing else. (1/2)

Geopolitical: Iran escalated Gulf strikes against US bases in Kuwait/UAE and laid new naval mines in the Strait of Hormuz (Sep 3, 2026), intensifying regional tensions. Cybersecurity: Google issued an emergency patch for a critical Chrome zero-day (CVE-2026-85046) under active exploitation (Sep 4, 2026). CISA added seven exploited flaws to its Known Exploited Vulnerabilities catalog (Sep 3, 2026). Tech: Google launched Gemini 3.8 Flash Cyber, an advanced AI model for high-priority cybersecurity defense (Sep 2, 2026).

#AnonNews_irc #Cybersecurity #News

Google patched CVE-2026-85046, a V8 type confusion zero-day in Chrome confirmed exploited in the wild. It is the sixth actively exploited Chrome zero-day this year and enables remote arbitrary code execution via crafted web content. #ChromeSecurity #VulnerabilityManagement #ZeroDay

https://cyberworldops.eu/en/chrome-fixes-sixth-zero-day-of-2026-active-attacks-target-v8-engine

Google Rushes Out a Critical Chrome Security Fix as an Actively Exploited V8 Zero-Day Puts Millions of Users at Risk + Video

A Browser Update That Should Not Be Ignored Google has released a major security update for Chrome after confirming that attackers are already exploiting a dangerous vulnerability in the browser’s V8 JavaScript and WebAssembly engine. Tracked as CVE-2026-85046, the flaw carries a CVSS score of 8.8 and is classified as a high-severity…

https://undercodenews.com/google-rushes-out-a-critical-chrome-security-fix-as-an-actively-exploited-v8-zero-day-puts-millions-of-users-at-risk-video/?utm_source=mastodon&utm_medium=jetpack_social

Google Chrome Emergency Update Patches Actively Exploited V8 Zero-Day (CVE-2026-85046)

https://thecybersecguru.com/news/cve-2026-85046-exploit-explained/

Google Chrome Emergency Update: Actively Exploited V8 Zero-Day Puts Millions of Users on Alert + Video

A Critical Warning for Chrome Users A routine browser update has suddenly become a serious security matter. Google has released an emergency security update for Chrome after confirming that attackers are actively exploiting a high-severity vulnerability in the browser's V8 JavaScript and WebAssembly engine. Tracked as CVE-2026-85046, the flaw carries a CVSS score of…

https://undercodenews.com/google-chrome-emergency-update-actively-exploited-v8-zero-day-puts-millions-of-users-on-alert-video/?utm_source=mastodon&utm_medium=jetpack_social

Actively exploited sandbox RCE in all Chromium versions

https://nvd.nist.gov/vuln/detail/cve-2026-85046

#chromium #gov

Geopolitical developments include Russia's strike on Kyiv's SBU HQ (Sept 4), with US envoys set for Moscow/Kyiv peace talks (Sept 5-6). Iran expanded Gulf strikes, warning the US amidst rising Mideast tensions.

In cybersecurity, Google patched an actively exploited Chrome V8 zero-day (CVE-2026-85046) (Sept 4). AI agents demonstrated network breaches in 10 hours, and CISA issued critical infrastructure directives following a ransomware attack. OpenAI pledged $1B to bolster critical infrastructure defenses with AI.

Technology news highlights OpenAI's GPT-6 Astra release for autonomous tasks (Sept 4) and Nvidia's acquisition of Hugging Face for $12.9B.

#AnonNews_irc #Cybersecurity #Geopolitics

⚠️ CRITICAL: Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Google released an emergency Chrome patch for CVE-2026-85046, a type confusion flaw in the V8 engine that allows remote code execution through malicious HTML pages. This zero-day is actively exploited in the wild. All Chrome users are at immediate risk of compromise.

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

📰 Google Patches Actively Exploited Chrome V8 Zero-Day Flaw

Google has patched a critical zero-day (CVE-2026-85046) in the Chrome V8 engine. The flaw is actively exploited in the wild for RCE. Update to version 152.0.7977.82/.83 immediately to protect against attacks. #Chrome #ZeroDay #CyberSecurity

🔗 https://cyber.netsecops.io/articles/google-patches-actively-exploited-chrome-zero-day-vulnerability-cve-2026-85046/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Actively exploited sandbox RCE in all Chromium versions: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) https://nvd.nist.gov/vuln/detail/cve-2026-85046

So you don't even need a JS? just a crafted HTML page? Lmao. So much bloated code running and on top of that now we have an AI generated code. Security is gonna be a nightmare for most people

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Google Chrome : la 6ème faille zero-day de 2026 est là, patchez sans attendre https://www.it-connect.fr/google-chrome-cve-2026-85046-faille-zero-day/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Google

Google Patches Actively Exploited V8 Zero-Day in Chrome Update

Google released security updates for Chrome to patch 12 vulnerabilities, including an actively exploited V8 zero-day (CVE-2026-85046) that allows remote code execution.

**This one is urgent, because Chrome is being actively attacked. Update your Chrome and Chromium based browsers ASAP. This is not a time to delay the patch. All your tabs reopen.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/google-patches-actively-exploited-v8-zero-day-in-chrome-update-v-d-c-m-k/gD2P6Ple2L

Actively exploited sandbox RCE in all Chromium versions
https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions
Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Comments: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Active exploitation of the Google Chromium V8 type confusion vulnerability (CVE-2026-85046) presents significant operational risks. Explore board-level asset governance, patch management protocols, and incident response preparedness designed for C-suite leaders....

https://thecybermind.co/pcrl

Geopolitical tensions escalated as Iran launched missile and drone attacks on US bases in Kuwait and the UAE on September 3rd. Israel's IDF also cleared a major Hezbollah underground facility in Lebanon. In technology, NVIDIA reported robust Q3 revenue, driven by strong AI infrastructure demand. OpenAI integrated ChatGPT Health with Epic's EHR system. Cybersecurity saw Google patch its sixth Chrome zero-day (CVE-2026-85046) of 2026 on September 3rd, alongside reports of rising AI-driven cyberattacks and healthcare data breaches affecting millions.

#AnonNews_irc #Cybersecurity #News

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-85046 – Google Chromium V8 Type Confusion Vulnerability

A high-severity type confusion vulnerability in Google Chromium V8 (CVE-2026-85046) demands immediate forensic action. Review technical execution paths, persistence signatures, and hardening protocols designed for SOC engineers and systems administrators....

https://thecybermind.co/cnul

Actively exploited sandbox RCE in all Chromium versions

https://nvd.nist.gov/vuln/detail/cve-2026-85046

#chromium #gov

🚨 Oh no, Chromium's sandbox RCE is being exploited! Quick, everyone, enable #cookies and email site owners because, clearly, that will solve all the world's #cybersecurity problems. 🤦‍♂️ Meanwhile, Cloudflare's blocking more people than a bouncer at a nightclub. 🍻🔒
https://nvd.nist.gov/vuln/detail/cve-2026-85046 #ChromiumRCE #Cloudflare #Exploits #HackerNews #ngated

Actively exploited sandbox RCE in all Chromium versions

https://nvd.nist.gov/vuln/detail/cve-2026-85046

Comments: https://news.ycombinator.com/item?id=49570669

#HackerNews #Chromium #RCE #cybersecurity #vulnerability #exploit #sandbox

Google patches multiple Chrome bugs including a V8 flaw being used in attacks
https://thenextweb.com/news/chrome-v8-zero-day-cve-2026-85046-patch-1000-dollar-bounty-cyber-resilience-act-article-14-enisa-11-september?utm_source=flipboard&utm_medium=activitypub

Posted into TNW - All Stories @tnw-all-stories-thenextweb

🚨 [CISA-2026:0904] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0904)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-85046 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-85046)
- Name: Google Chromium V8 Type Confusion Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Google
- Product: Chromium V8
- Notes: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85046

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260904 #cisa20260904 #cve_2026_85046 #cve202685046

CVE ID: CVE-2026-85046
Vendor: Google
Product: Chromium V8
Date Added: 2026-09-04
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-85046

CISA has added one vulnerability to the KEV catalogue.

- CVE-2026-85046: Google Chromium V8 Type Confusion Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-85046 #CISA #infosec #Google #Chromium #vulnerability

🏆 New Achievement! Type-Confused and Loving It!

Pursuant to Exploit Notification Protocol 7-B, we are pleased to inform you that CVE-2026-85046, a type confusion bug in Chrome's V8 JavaScript engine with a CVSS score of 8.8, is actively being used against users in the wild. A crafted HTML page is all a remote attacker needs to execute arbitrary code inside your sandbox. Per policy, we have logged this as a High Priority Awareness Event and done absolutely nothing else. (1/2)

Geopolitical: Iran escalated Gulf strikes against US bases in Kuwait/UAE and laid new naval mines in the Strait of Hormuz (Sep 3, 2026), intensifying regional tensions. Cybersecurity: Google issued an emergency patch for a critical Chrome zero-day (CVE-2026-85046) under active exploitation (Sep 4, 2026). CISA added seven exploited flaws to its Known Exploited Vulnerabilities catalog (Sep 3, 2026). Tech: Google launched Gemini 3.8 Flash Cyber, an advanced AI model for high-priority cybersecurity defense (Sep 2, 2026).

#AnonNews_irc #Cybersecurity #News

Google patched CVE-2026-85046, a V8 type confusion zero-day in Chrome confirmed exploited in the wild. It is the sixth actively exploited Chrome zero-day this year and enables remote arbitrary code execution via crafted web content. #ChromeSecurity #VulnerabilityManagement #ZeroDay

https://cyberworldops.eu/en/chrome-fixes-sixth-zero-day-of-2026-active-attacks-target-v8-engine

Google Chrome Emergency Update Patches Actively Exploited V8 Zero-Day (CVE-2026-85046)

https://thecybersecguru.com/news/cve-2026-85046-exploit-explained/

🔴 CVE-2026-86148 - Critical (9.1)

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86148/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86148 - Critical (9.1)

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86148/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86149 - Critical (9.1)

A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86149 - Critical (9.1)

A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86151 - Critical (9.1)

A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86151 - Critical (9.1)

A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The reason for the Mikrotik “patch now, we’ll say why later” announcements last week seems to be out.

It’s patching a zero day exploit chain that seems to be CVE-2026-67279 (ssh rekey bypasses auth phase) and CVE-2026-86060 (username of “-2” misinterpreted as flag to read from file descriptor).

Several people on Mikrotik forum and Mikrotik subreddit report exploits early September 2026, so likely automated exploit 😬

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
https://forum.mikrotik.com/t/important-security-update/272851/109

The reason for the Mikrotik “patch now, we’ll say why later” announcements last week seems to be out.

It’s patching a zero day exploit chain that seems to be CVE-2026-67279 (ssh rekey bypasses auth phase) and CVE-2026-86060 (username of “-2” misinterpreted as flag to read from file descriptor).

Several people on Mikrotik forum and Mikrotik subreddit report exploits early September 2026, so likely automated exploit 😬

https://cert.pl/en/posts/2026/09/mikrotik-routeros-cve/
https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/
https://forum.mikrotik.com/t/important-security-update/272851/109

https://db.gcve.eu/vuln/cve-2026-67276

ahahahaha

https://db.gcve.eu/vuln/cve-2026-67276

ahahahaha

🟠 CVE-2026-0799 - High (8.7)

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a cra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0799/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0799 - High (8.7)

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a cra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0799/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86145 - High (8.2)

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86145/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86145 - High (8.2)

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86145/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86189 - Critical (9.8)

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86189/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86189 - Critical (9.8)

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86189/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86190 - Critical (9.1)

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86190/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86190 - Critical (9.1)

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86190/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86184 - Critical (9.8)

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /scr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86184/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86184 - Critical (9.8)

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /scr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86184/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-10196 - Critical (9.8)

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10196/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-10196 - Critical (9.8)

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10196/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-9049 - High (8.8)

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-9049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-9049 - High (8.8)

The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-9049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86185 - High (8)

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inje...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86185/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86185 - High (8)

Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inje...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86185/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86177 - High (8.8)

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger sc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86177/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86177 - High (8.8)

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger sc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86177/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86117 - High (8.1)

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86117/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86117 - High (8.1)

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider assertions or binding OAuth identities. Attackers...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86117/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86123 - High (8.7)

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86123 - High (8.7)

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86173 - High (7.5)

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86173/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86173 - High (7.5)

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URLs to CrawlerTable.list. Attackers can bypass the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86173/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86169 - High (8.8)

Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86169/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86169 - High (8.8)

Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86169/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86124 - Critical (9.8)

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86124 - Critical (9.8)

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the exposed communication port and execute arbitrary...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86121 - Critical (9.8)

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86121/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86121 - Critical (9.8)

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86121/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86119 - High (8.6)

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86119 - High (8.6)

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is unset. Attackers can supply arbitrary URLs to the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19887 - High (8.8)

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19887/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19887 - High (8.8)

The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19887/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81543 - High (8.8)

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81543/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81543 - High (8.8)

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81543/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-83627 - Critical (9.8)

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-83627/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-83627 - Critical (9.8)

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-83627/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-13447 - Critical Auth Bypass in FluxBuilder Mstore API WordPress plugin via JWT forgery. CVSS 9.8. Unpatched! Mitigate immediately. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-13447/

🔴 CVE-2026-13447 - Critical (9.8)

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() funct...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-13447 - Critical (9.8)

The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() funct...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86140 - High (8)

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86140/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86140 - High (8)

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86140/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Pyramid Solutions NetStaX EtherNet/IP Stack before 5.6.1 contains CVE-2026-78012, a stack-based buffer overflow triggered by oversized Class 3 explicit messages without error. It enables DoS and potential RCE in OT systems, making immediate patching critical. #IcsSecurity #EtherNetIp #BufferOverflow

https://cyberworldops.eu/en/netstax-ethernetip-critical-buffer-overflow-in-pyramid-solutions-kits

Pyramid Solutions NetStaX EtherNet/IP Stack before 5.6.1 contains CVE-2026-78012, a stack-based buffer overflow triggered by oversized Class 3 explicit messages without error. It enables DoS and potential RCE in OT systems, making immediate patching critical. #IcsSecurity #EtherNetIp #BufferOverflow

https://cyberworldops.eu/en/netstax-ethernetip-critical-buffer-overflow-in-pyramid-solutions-kits

🟠 CVE-2026-86095 - High (7.8)

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86095/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86095 - High (7.8)

Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86095/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CISA flagged CVE-2026-75925 in IXON VPN Client before 1.4.7. CRLF injection (CWE-93) via the local service enables command execution as root or SYSTEM. Prioritize patching to 1.4.7 and reviewing affected hosts. #Ixon #VpnSecurity #Cwe93

https://cyberworldops.eu/en/critical-flaw-in-ixon-vpn-client-allows-commands-to-run-as-root-or

🔴 CVE-2026-75925 - Critical (9.6)

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged sub...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CISA flagged CVE-2026-75925 in IXON VPN Client before 1.4.7. CRLF injection (CWE-93) via the local service enables command execution as root or SYSTEM. Prioritize patching to 1.4.7 and reviewing affected hosts. #Ixon #VpnSecurity #Cwe93

https://cyberworldops.eu/en/critical-flaw-in-ixon-vpn-client-allows-commands-to-run-as-root-or

🔴 CVE-2026-75925 - Critical (9.6)

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged sub...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82684 - High (8.1)

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82684/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82684 - High (8.1)

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82684/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-52775 - High (8.8)

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary S...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52775/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-52775 - High (8.8)

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary S...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52775/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-52771 - High (8.3)

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = '$tag' query without escaping. The pag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52771/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-52771 - High (8.3)

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = '$tag' query without escaping. The pag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52771/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77393 - High (8.8)

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer ses...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77393/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📰 CISA Warns of High-Severity Flaw in Ignition ICS Platform

CISA advisory for Inductive Automation Ignition (CVE-2026-77393): A high-severity flaw (CVSS 8.8) allows any authenticated user to create projects in ICS environments. Affects versions <=8.1.53. Update to 8.1.54 now. #ICS #CyberSecurity #CISA

🔗 https://cyber.netsecops.io/articles/cisa-advisory-for-inductive-automation-ignition-vulnerability-cve-2026-77393/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

🟠 CVE-2026-77393 - High (8.8)

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer ses...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77393/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82712 - High (8.8)

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82712 - High (8.8)

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an attacker to perform state changing operations on the device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-81939 - Critical (9.1)

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-81939 - Critical (9.1)

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81939/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80119 - High (7.8)

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump comple...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80119 - High (7.8)

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump comple...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80116 - High (7.8)

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to modify hardware configuration by e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80116/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80116 - High (7.8)

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to modify hardware configuration by e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80116/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78328 - Critical (9.1)

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78328/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78328 - Critical (9.1)

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78328/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75160 - Critical (9.1)

An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75160 - Critical (9.1)

An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75431 - Critical (9.1)

PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75431/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75431 - Critical (9.1)

PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75431/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85786 - High (7.5)

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insuff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85786 - High (7.5)

Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insuff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-85504 - Critical (9.8)

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85504/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-85504 - Critical (9.8)

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85504/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80114 - High (7.8)

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80114/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80114 - High (7.8)

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80114/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-78327 - Critical RCE via OS command injection in SonicWall Network Security Manager. CVSS 9.1. Update immediately. #SonicWall #infosec #cybersecurity

https://www.valtersit.com/cve/CVE-2026-78327/

🔴 CVE-2026-78327 - Critical (9.1)

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78327/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78327 - Critical (9.1)

An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows an authenticated attacker with SuperAdmin privileges to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78327/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-53932 - High (8)

laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53932/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-53932 - High (8)

laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53932/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-85148 - Critical (9.8)

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85148/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80112 - High (7.8)

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80112/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80112 - High (7.8)

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80112/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77822 - High (8.2)

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77822/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77822 - High (8.2)

IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77822/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75430 - Critical (9.8)

PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75430/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75430 - Critical (9.8)

PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75430/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19534 - High (7.5)

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 respon...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19534 - High (7.5)

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 respon...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical TP-Link Archer AX55 Vulnerabilities Expose Routers to RCE and Credential Theft: Full Technical Analysis and Patch Guide

https://thecybersecguru.com/exploits/tp-link-archer-ax55-cve-2026-18167-cve-2026-18330/

Critical TP-Link Archer AX55 Vulnerabilities Expose Routers to RCE and Credential Theft: Full Technical Analysis and Patch Guide

https://thecybersecguru.com/exploits/tp-link-archer-ax55-cve-2026-18167-cve-2026-18330/

🟠 CVE-2026-82538 - High (8.8)

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82538 - High (8.8)

ILIAS before versions 9.22, 10.10, and 11.3 contains a SQL injection vulnerability in the repository trash table where the table navigation sort field from HTTP requests is passed directly into the ORDER BY clause of a SQL query without validation...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85654 - High (7.8)

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated ap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85654/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85654 - High (7.8)

Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the generated ap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85654/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85656 - High (7.8)

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85656/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85656 - High (7.8)

An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85656/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9317 - High (8.1)

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with ne...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9317/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9317 - High (8.1)

Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with ne...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9317/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18175 - High (8.1)

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18175/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18175 - High (8.1)

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18175/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18486 - High (8.8)

IBM ContextForge MCP Gateway &lt;= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18486/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18486 - High (8.8)

IBM ContextForge MCP Gateway &lt;= v1.0.7 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive credentials and escalate privileges due to improper validation of jq filters.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18486/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18221 - High (8.1)

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18221/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18221 - High (8.1)

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18221/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19298 - High (8.8)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19298/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19298 - High (8.8)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19298/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19283 - High (7.7)

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19283 - High (7.7)

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19274 - Critical (9.6)

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scop...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19274 - Critical (9.6)

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scop...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-18658 - Critical (9.8)

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18658/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-18658 - Critical (9.8)

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18658/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19300 - High (7.5)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19300/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19300 - High (7.5)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19300/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-44402 - Critical (9.8)

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive witho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44402/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-44402 - Critical (9.8)

Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint that allows remote attackers to execute arbitrary commands as root by uploading a crafted tar archive witho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44402/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

...istg...

https://db.gcve.eu/vuln/cve-2026-5522

...istg...

https://db.gcve.eu/vuln/cve-2026-5522

🟠 CVE-2026-19303 - High (8.1)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19303/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19303 - High (8.1)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19303/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18905 - High (7.7)

IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) &lt;= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18905/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18905 - High (7.7)

IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) &lt;= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18905/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31020 - Critical (9.8)

In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input san...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31020/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31020 - Critical (9.8)

In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input san...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31020/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19306 - High (7.7)

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19306/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19306 - High (7.7)

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19306/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-85187: SQL injection in itsourcecode Online Medicine Delivery System v1.0 via Order::pupdate in /rider/orders/controller.php. Remote exploit, publicly disclosed. CVSS 7.3. No patch available. Update immediately or restrict access. https://www.valtersit.com/cve/CVE-2026-8

🟠 CVE-2026-19305 - High (8.6)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19305/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19305 - High (8.6)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19305/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19304 - High (7.7)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19304/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19304 - High (7.7)

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19304/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85691 - High (7.5)

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authenticat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85691/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85691 - High (7.5)

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authenticat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85691/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-85696 - Critical (9.8)

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85696/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-85696 - Critical (9.8)

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85696/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85699 - High (7.5)

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85699/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85699 - High (7.5)

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85699/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-85695 - Critical (9.4)

FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious worker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85695/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-85695 - Critical (9.4)

FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious worker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85695/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85694 - High (8.1)

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85694/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85694 - High (8.1)

LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted language model output derived from web page content. Attackers can inject malicious Python code through web pag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85694/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85094 - High (8.8)

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85094/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85094 - High (8.8)

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85094/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-62928 - Critical (9.8)

XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-62928 - Critical (9.8)

XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-85085 - Critical (9.6)

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85085/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-85085 - Critical (9.6)

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85085/