Go fuck some shit up, y'all: https://db.gcve.eu/vuln/cve-2026-56265

Go fuck some shit up, y'all: https://db.gcve.eu/vuln/cve-2026-56265

UltraISO Premium Edition ≤9.76 hit by HIGH severity vuln (CVE-2026-12786) in bootpt64.sys — local attackers can bypass kernel access controls. No patch yet. Restrict local access & monitor activity. https://radar.offseq.com/threat/cve-2026-12786-improper-access-controls-in-ezbsyst-f7dadfd56c360b89 #OffSeq #Vulnerability #InfoSec #UltraISO

UltraISO Premium Edition ≤9.76 hit by HIGH severity vuln (CVE-2026-12786) in bootpt64.sys — local attackers can bypass kernel access controls. No patch yet. Restrict local access & monitor activity. https://radar.offseq.com/threat/cve-2026-12786-improper-access-controls-in-ezbsyst-f7dadfd56c360b89 #OffSeq #Vulnerability #InfoSec #UltraISO

CVE-2026-12784 | HIGH severity in IM-Magic Partition Resizer ≤7.9.0: improper access controls in MDA_NTDRV.sys kernel driver. Local exploit is public. Restrict access or remove vulnerable versions. https://radar.offseq.com/threat/cve-2026-12784-improper-access-controls-in-im-magi-c8e575e26aa27402 #OffSeq #Vulnerability #SysSec #CVE2026

CVE-2026-12784 | HIGH severity in IM-Magic Partition Resizer ≤7.9.0: improper access controls in MDA_NTDRV.sys kernel driver. Local exploit is public. Restrict access or remove vulnerable versions. https://radar.offseq.com/threat/cve-2026-12784-improper-access-controls-in-im-magi-c8e575e26aa27402 #OffSeq #Vulnerability #SysSec #CVE2026

CVE-2026-12781 (HIGH, CVSS 8.5) found in EaseUS Partition Master 14.0 – 14.5: improper access controls in kernel driver epmntdrv.sys enable local privilege escalation. Upgrade to latest version ASAP. https://radar.offseq.com/threat/cve-2026-12781-improper-access-controls-in-easeus--0c0fae83fd7ebb81 #OffSeq #Vulnerability #PrivilegeEscalation #CyberSecurity

CVE-2026-12781 (HIGH, CVSS 8.5) found in EaseUS Partition Master 14.0 – 14.5: improper access controls in kernel driver epmntdrv.sys enable local privilege escalation. Upgrade to latest version ASAP. https://radar.offseq.com/threat/cve-2026-12781-improper-access-controls-in-easeus--0c0fae83fd7ebb81 #OffSeq #Vulnerability #PrivilegeEscalation #CyberSecurity

CVE-2026-12782: HIGH severity vuln in EaseUS Partition Master (14.0 – 14.5). Improper access in kernel driver (EUEDKEPM.sys), local attack, public exploit out. Upgrade ASAP. Details: https://radar.offseq.com/threat/cve-2026-12782-improper-access-controls-in-easeus--1339881f4c691ee7 #OffSeq #Vulnerability #InfoSec #CVE202612782

CVE-2026-12782: HIGH severity vuln in EaseUS Partition Master (14.0 – 14.5). Improper access in kernel driver (EUEDKEPM.sys), local attack, public exploit out. Upgrade ASAP. Details: https://radar.offseq.com/threat/cve-2026-12782-improper-access-controls-in-easeus--1339881f4c691ee7 #OffSeq #Vulnerability #InfoSec #CVE202612782

OpenBSD MPLS kernel stack leaks remotely (CVE-2026-56099) https://pop.argus-systems.ai/advisory/adv-040.html

Apple Patches Beats Studio Buds Eavesdropping Flaw

Apple patched a high-severity flaw (CVE-2025-20701) in Beats Studio Buds that allowed nearby attackers to eavesdrop via the microphone.

**Update your Beats Studio Buds firmware immediately to version 1B211 to prevent unauthorized microphone access.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/apple-patches-beats-studio-buds-eavesdropping-flaw-4-l-h-1-u/gD2P6Ple2L

Apple Patches Beats Studio Buds Eavesdropping Flaw

Apple patched a high-severity flaw (CVE-2025-20701) in Beats Studio Buds that allowed nearby attackers to eavesdrop via the microphone.

**Update your Beats Studio Buds firmware immediately to version 1B211 to prevent unauthorized microphone access.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/apple-patches-beats-studio-buds-eavesdropping-flaw-4-l-h-1-u/gD2P6Ple2L

CVE-2026-12780: HIGH severity vuln in AOMEI Backupper ≤8.3.0. Local attackers can abuse improper access controls in amwrtdrv.sys for potential privilege escalation. No patch available — limit local access & watch for updates. https://radar.offseq.com/threat/cve-2026-12780-improper-access-controls-in-aomei-b-bd5bc4597d816b66 #OffSeq #Vuln #AOMEI

CVE-2026-12780: HIGH severity vuln in AOMEI Backupper ≤8.3.0. Local attackers can abuse improper access controls in amwrtdrv.sys for potential privilege escalation. No patch available — limit local access & watch for updates. https://radar.offseq.com/threat/cve-2026-12780-improper-access-controls-in-aomei-b-bd5bc4597d816b66 #OffSeq #Vuln #AOMEI

AOMEI Dynamic Disk Manager ≤10.10.1: CVE-2026-12779 (HIGH, CVSS 8.5) allows local privilege abuse via improper access controls in ddmdrv.sys. Exploit is public, no patch available. Restrict access & monitor systems. https://radar.offseq.com/threat/cve-2026-12779-improper-access-controls-in-aomei-d-5bbdcb6786a305ad #OffSeq #CVE202612779 #vuln #cybersecurity

AOMEI Dynamic Disk Manager ≤10.10.1: CVE-2026-12779 (HIGH, CVSS 8.5) allows local privilege abuse via improper access controls in ddmdrv.sys. Exploit is public, no patch available. Restrict access & monitor systems. https://radar.offseq.com/threat/cve-2026-12779-improper-access-controls-in-aomei-d-5bbdcb6786a305ad #OffSeq #CVE202612779 #vuln #cybersecurity

CVE-2026-12774: SSRF in BerriAI litellm v1.82.0 – 1.82.2 (MEDIUM, CVSS 5.3). Remote attackers can manipulate server requests via _execute_with_mcp_client. No patch yet — monitor vendor advisories. https://radar.offseq.com/threat/cve-2026-12774-server-side-request-forgery-in-berr-96b3ed54597a7e96 #OffSeq #Infosec #SSRF #Vuln

CVE-2026-12774: SSRF in BerriAI litellm v1.82.0 – 1.82.2 (MEDIUM, CVSS 5.3). Remote attackers can manipulate server requests via _execute_with_mcp_client. No patch yet — monitor vendor advisories. https://radar.offseq.com/threat/cve-2026-12774-server-side-request-forgery-in-berr-96b3ed54597a7e96 #OffSeq #Infosec #SSRF #Vuln

CVE-2026-5366 (CRITICAL, CVSS 9.9): prefecthq/prefect 3.6.23 lets users with deployment creation rights inject git flags via commit_sha/directories in GitRepository, enabling remote code exec. Restrict permissions & monitor updates. https://radar.offseq.com/threat/cve-2026-5366-cwe-94-improper-control-of-generatio-ef5838b1259ff631 #OffSeq #CVE20265366 #infosec

CVE-2026-5366 (CRITICAL, CVSS 9.9): prefecthq/prefect 3.6.23 lets users with deployment creation rights inject git flags via commit_sha/directories in GitRepository, enabling remote code exec. Restrict permissions & monitor updates. https://radar.offseq.com/threat/cve-2026-5366-cwe-94-improper-control-of-generatio-ef5838b1259ff631 #OffSeq #CVE20265366 #infosec

CVE-2026-48939 (CRITICAL): iCagenda for Joomla (v1.0.0-3.9.14, 4.0.0-4.0.7) allows unauthenticated PHP file upload & execution. No patch yet — disable or restrict access, use WAF to block. Full site/server compromise risk. Details: https://radar.offseq.com/threat/cve-2026-48939-cwe-284-improper-access-control-in--bc923bedc1d1c47e #OffSeq #Joomla #infosec

CVE-2026-48939 (CRITICAL): iCagenda for Joomla (v1.0.0-3.9.14, 4.0.0-4.0.7) allows unauthenticated PHP file upload & execution. No patch yet — disable or restrict access, use WAF to block. Full site/server compromise risk. Details: https://radar.offseq.com/threat/cve-2026-48939-cwe-284-improper-access-control-in--bc923bedc1d1c47e #OffSeq #Joomla #infosec

JoomShaper SP LMS for Joomla (v1.0.0 – 4.1.3) hit by CRITICAL vuln (CVE-2026-48909): unsafe cookie deserialization enables unauth RCE. No patch yet — restrict access & monitor traffic. Details: https://radar.offseq.com/threat/cve-2026-48909-cwe-502-deserialization-of-untruste-b0460f6997894c12 #OffSeq #Joomla #CVE #infosec

JoomShaper SP LMS for Joomla (v1.0.0 – 4.1.3) hit by CRITICAL vuln (CVE-2026-48909): unsafe cookie deserialization enables unauth RCE. No patch yet — restrict access & monitor traffic. Details: https://radar.offseq.com/threat/cve-2026-48909-cwe-502-deserialization-of-untruste-b0460f6997894c12 #OffSeq #Joomla #CVE #infosec

CRITICAL vuln (CVSS 10) in Joomla SP Page Builder (1.0.0 – 6.6.1): CVE-2026-48908 enables unauthenticated PHP uploads, risking full compromise. No patch yet — restrict/disable extension, monitor activity. Details: https://radar.offseq.com/threat/cve-2026-48908-cwe-284-improper-access-control-in--a8937f9d4a0573e0 #OffSeq #Joomla #CVE #AppSec

CRITICAL vuln (CVSS 10) in Joomla SP Page Builder (1.0.0 – 6.6.1): CVE-2026-48908 enables unauthenticated PHP uploads, risking full compromise. No patch yet — restrict/disable extension, monitor activity. Details: https://radar.offseq.com/threat/cve-2026-48908-cwe-284-improper-access-control-in--a8937f9d4a0573e0 #OffSeq #Joomla #CVE #AppSec

CVE-2026-11912: HIGH severity vulnerability in eemitch Simple File List ≤6.3.7 lets unauthenticated attackers modify/delete server files due to missing auth checks. No patch yet — restrict or disable plugin. https://radar.offseq.com/threat/cve-2026-11912-cwe-862-missing-authorization-in-ee-9819171d864aac20 #OffSeq #WordPress #vuln

CVE-2026-11912: HIGH severity vulnerability in eemitch Simple File List ≤6.3.7 lets unauthenticated attackers modify/delete server files due to missing auth checks. No patch yet — restrict or disable plugin. https://radar.offseq.com/threat/cve-2026-11912-cwe-862-missing-authorization-in-ee-9819171d864aac20 #OffSeq #WordPress #vuln

CVE-2026-11911: HIGH severity path traversal in eemitch Simple File List (≤6.3.7). Unauth attackers can delete files via exposed AJAX action, risking RCE. Restrict admin-ajax.php or disable plugin. Details: https://radar.offseq.com/threat/cve-2026-11911-cwe-22-improper-limitation-of-a-pat-c1bb6257a58c2645 #OffSeq #WordPress #Security

CVE-2026-11911: HIGH severity path traversal in eemitch Simple File List (≤6.3.7). Unauth attackers can delete files via exposed AJAX action, risking RCE. Restrict admin-ajax.php or disable plugin. Details: https://radar.offseq.com/threat/cve-2026-11911-cwe-22-improper-limitation-of-a-pat-c1bb6257a58c2645 #OffSeq #WordPress #Security

CVE-2026-9843 - Critical RCE in Database for Contact Form 7, WPforms, Elementor forms for WordPress. Arbitrary file deletion via insufficient path validation. CVSS 8.1. No patch available. Immediately review and restrict plugin usage. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-9843/

CVE-2026-9843: HIGH severity (CVSS 8.1) path traversal in crmperks Database for Contact Form 7, WPforms, Elementor forms (≤1.5.1). Unauthenticated file deletion possible if admin interacts with malicious entries. Restrict access, monitor logs. https://radar.offseq.com/threat/cve-2026-9843-cwe-22-improper-limitation-of-a-path-a3dfc4d21233784d #OffSeq #WordPress #CVE20269843 #BlueTeam

CVE-2026-9843: HIGH severity (CVSS 8.1) path traversal in crmperks Database for Contact Form 7, WPforms, Elementor forms (≤1.5.1). Unauthenticated file deletion possible if admin interacts with malicious entries. Restrict access, monitor logs. https://radar.offseq.com/threat/cve-2026-9843-cwe-22-improper-limitation-of-a-path-a3dfc4d21233784d #OffSeq #WordPress #CVE20269843 #BlueTeam

🟠 CVE-2026-56082 - High (7.5)

Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time, which is granted to the anon role and callable with only the public Supabase publishabl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56082/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56082 - High (7.5)

Capgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time, which is granted to the anon role and callable with only the public Supabase publishabl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56082/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: Cap-go capgo (<12.128.2) hit by CVE-2026-56081. Attackers can register with victim emails pre-verification, enable 2FA, and fully take over accounts — including org policy control. No patch confirmed. Monitor new signups. https://radar.offseq.com/threat/cve-2026-56081-weak-password-recovery-mechanism-fo-0cc6e5efaf2e4722 #OffSeq #CVE202656081 #Infosec

🔴 CVE-2026-56081 - Critical (9.1)

Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56081/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: Cap-go capgo (<12.128.2) hit by CVE-2026-56081. Attackers can register with victim emails pre-verification, enable 2FA, and fully take over accounts — including org policy control. No patch confirmed. Monitor new signups. https://radar.offseq.com/threat/cve-2026-56081-weak-password-recovery-mechanism-fo-0cc6e5efaf2e4722 #OffSeq #CVE202656081 #Infosec

🔴 CVE-2026-56081 - Critical (9.1)

Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56081/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-56073 (CRITICAL) affects Cap-go capgo <12.128.2: Insufficient data authenticity checks allow OTP bypass, enabling attackers to activate 2FA & take over accounts. No patch yet — monitor vendor updates. https://radar.offseq.com/threat/cve-2026-56073-insufficient-verification-of-data-a-d7403d6896f5b084 #OffSeq #CVE #Infosec #AppSec

CVE-2026-56073 (CRITICAL) affects Cap-go capgo <12.128.2: Insufficient data authenticity checks allow OTP bypass, enabling attackers to activate 2FA & take over accounts. No patch yet — monitor vendor updates. https://radar.offseq.com/threat/cve-2026-56073-insufficient-verification-of-data-a-d7403d6896f5b084 #OffSeq #CVE #Infosec #AppSec

CVE-2026-11551 - Critical privilege escalation in Branda WordPress plugin. Unauthenticated account takeover via improper password reset validation. CVSS 9.8. No patch available. Disable immediately. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-11551/

🔴 CVE-2026-11551 - Critical (9.8)

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This mak...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-11551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-11551: CRITICAL (CVSS 9.8) privilege escalation in wpmudev Branda ≤3.4.29. Weak password recovery lets unauthenticated attackers reset admin passwords. No patch. Restrict or disable plugin, monitor activity. https://radar.offseq.com/threat/cve-2026-11551-cwe-640-weak-password-recovery-mech-4f398affc6b799d5 #OffSeq #WordPress #Vuln #BlueTeam

🔴 CVE-2026-11551 - Critical (9.8)

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This mak...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-11551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-11551: CRITICAL (CVSS 9.8) privilege escalation in wpmudev Branda ≤3.4.29. Weak password recovery lets unauthenticated attackers reset admin passwords. No patch. Restrict or disable plugin, monitor activity. https://radar.offseq.com/threat/cve-2026-11551-cwe-640-weak-password-recovery-mech-4f398affc6b799d5 #OffSeq #WordPress #Vuln #BlueTeam

CVE-2026-9375 - DoS in Urllib3. Decompression bomb bypass in streaming API with Brotli. CVSS 7.5. No patch available yet. Monitor for updates. #CVE #infosec #python

https://www.valtersit.com/cve/CVE-2026-9375/

CVE-2026-47645 - Open redirect in Microsoft 365 Copilot. CVSS 8.8. Privilege escalation via untrusted URL redirection. No patch available. Monitor activity and restrict access. #CVE #Microsoft #infosec

https://www.valtersit.com/cve/CVE-2026-47645/

⚪️ Critical Copilot bug allowed theft of two-factor authentication codes

🗨️ In early June, Microsoft engineers announced that they had fixed a critical vulnerability, CVE-2026-42824. Now specialists from Varonis have revealed the details of this issue and described an attack that has been dubbed SearchLeak. As it turned out, the vulnerability…

🔗 https://hackmag.com/news/searchleak?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

#news

CVE-2026-32208 - XSS flaw in Microsoft Edge allows spoofing. CVSS 8.8. No patch yet. Update when available. #CVE #MicrosoftEdge #infosec

https://www.valtersit.com/cve/CVE-2026-32208/

CVE-2026-48772 (CRITICAL): ProxySQL 2.0.0 – 3.0.8 lets attackers spoof source IPs via PROXY protocol v1, bypassing routing & ACLs. Upgrade to 3.0.9 or later. Restrict frontend port access. Details: https://radar.offseq.com/threat/cve-2026-48772-cwe-348-use-of-less-trusted-source--40b83fbf2f9ef184 #OffSeq #ProxySQL #CVE202648772 #Security

CVE-2026-48772 (CRITICAL): ProxySQL 2.0.0 – 3.0.8 lets attackers spoof source IPs via PROXY protocol v1, bypassing routing & ACLs. Upgrade to 3.0.9 or later. Restrict frontend port access. Details: https://radar.offseq.com/threat/cve-2026-48772-cwe-348-use-of-less-trusted-source--40b83fbf2f9ef184 #OffSeq #ProxySQL #CVE202648772 #Security

CVE-2026-39999 matters to anyone fronting services with Apache APISIX and the jwt-auth plugin. The authentication-bypass-by-spoofing flaw spans versions 2.2 through 3.16.0, a range broad enough that long-running production gateways are likely in scope. Upgrading to 3.17.0 closes it; the advisory claims CVSS v4.0 7.0. Beyond patching, do you have a way to detect spoofed tokens that already got through?
#APISIX #security

The Apache APISIX project published CVE-2026-39999 on June 19, 2026: an authentication-bypass-by-spoofing flaw in the jwt-auth plugin. It affects versions 2.2 through 3.16.0 and is fixed in 3.17.0, with a claimed CVSS v4.0 score of 7.0. If your API gateway leans on jwt-auth to keep callers out, this one moves to the top of the patch queue. What is your rollback plan if 3.17.0 changes plugin behavior?
#APISIX #security

CVE-2026-49287 - Supply chain risk in Statamic. Unaddressed incomplete fix from CVE-2026-41175. Sort param manipulation could delete content/assets. CVSS 7.4. No patch; review templates immediately. #CVE #Statamic #infosec

https://www.valtersit.com/cve/CVE-2026-49287/

CVE-2026-49287 - Supply chain risk in Statamic. Unaddressed incomplete fix from CVE-2026-41175. Sort param manipulation could delete content/assets. CVSS 7.4. No patch; review templates immediately. #CVE #Statamic #infosec

https://www.valtersit.com/cve/CVE-2026-49287/

CVE-2026-11718 (CRITICAL): Google MCP Toolbox for Databases v1.0.0 has an auth bypass flaw in token validation. Issuer checks can be skipped, enabling unauthorized access. Avoid v1.0.0 & monitor for fixes. https://radar.offseq.com/threat/cve-2026-11718-cwe-287-improper-authentication-in--680f47148b06b96d #OffSeq #CVE202611718 #infosec #oauth2

CVE-2026-56142 - Critical privilege escalation in JetBrains Hub. CVSS 9.6. Attackers can attach auth details to accounts. No patch yet. Monitor and restrict access now. #CVE #JetBrains #infosec

https://www.valtersit.com/cve/CVE-2026-56142/

CVE-2026-50242 CRITICAL Authentication Bypass in JetBrains Hub. Direct DB access grants admin control. CVSS 10.0. No patch yet—mitigate immediately. #CVE #JetBrains #infosec

https://www.valtersit.com/cve/CVE-2026-50242/

🚨 CRITICAL: CVE-2026-12530 impacts AWS Bedrock AgentCore Python SDK (v1.1.3 – 1.6.1). Incomplete input sanitization in install_packages() lets attackers abuse pip flags. Update now! https://radar.offseq.com/threat/cve-2026-12530-improper-neutralization-of-argument-917f42dfcc3cfd56 #OffSeq #AWSSecurity #Python #CVE2026_12530

NI grpc-device ≤2.17.0 hit by CRITICAL vuln (CVE-2026-9142, CVSS 9.1) 🛡️ Missing authentication when TLS isn't set & server exposed beyond loopback. Unauthenticated LAN access possible. Mitigate by enabling TLS & restricting binding. https://radar.offseq.com/threat/cve-2026-9142-cwe-306-missing-authentication-for-c-f718635a9d1e7a48 #OffSeq #NI #Vuln

NI grpc-device ≤2.17.0 hit by CRITICAL vuln (CVE-2026-9142, CVSS 9.1) 🛡️ Missing authentication when TLS isn't set & server exposed beyond loopback. Unauthenticated LAN access possible. Mitigate by enabling TLS & restricting binding. https://radar.offseq.com/threat/cve-2026-9142-cwe-306-missing-authentication-for-c-f718635a9d1e7a48 #OffSeq #NI #Vuln

🚨 CRITICAL: CVE-2026-48814 in Jovancoding Network-AI ≤5.7.1 lets unauthenticated users access all 22 MCP tools if default secret is unset. Patch to 5.7.2 now! Details: https://radar.offseq.com/threat/cve-2026-48814-cwe-306-missing-authentication-for--a37c283f4afc7554 #OffSeq #CVE202648814 #Nodejs #Infosec

CVE-2026-56141 - Critical account takeover in JetBrains Hub via predictable restore codes. CVSS 9.8. No patch available. Update to latest version immediately. #CVE #JetBrains #infosec

https://www.valtersit.com/cve/CVE-2026-56141/

CVE-2026-46461 - Dell Server Hardware Manager improper access control. Low-privileged local user can gain elevated privileges. CVSS 7.8. No patch yet. Restrict local access immediately. #CVE #Dell #infosec

https://www.valtersit.com/cve/CVE-2026-46461/

CVE-2026-8713: CRITICAL path traversal (CVSS 9.1) in Avada (Fusion) Builder ≤3.15.3. Unauthenticated file deletion possible; RCE risk if wp-config.php is removed. Restrict access, monitor usage, check vendor for fixes. https://radar.offseq.com/threat/cve-2026-8713-cwe-22-improper-limitation-of-a-path-82beab53eaced0fc #OffSeq #WordPress #Infosec

CVE-2026-7515 | CRITICAL LFI in BetterDocs Pro ≤3.8.0: Unauthenticated attackers can execute arbitrary PHP via doc_style, risking full server compromise. Patch status unknown — check vendor. https://radar.offseq.com/threat/cve-2026-7515-cwe-98-improper-control-of-filename--18dc28a9a40e8b75 #OffSeq #WordPress #Vulnerability #CVE20267515

CVE-2026-54414: Critical path traversal in FileRise <3.16.0 allows attackers with a valid shared-folder upload link to write files outside the intended dir — can lead to admin takeover & RCE. Patch to 3.16.0+ ASAP. https://radar.offseq.com/threat/cve-2026-54414-cwe-22-improper-limitation-of-a-pat-b161bf82d6c29f3c #OffSeq #vuln #FileRise

@cR0w just a high, https://db.gcve.eu/vuln/cve-2026-54104

https://db.gcve.eu/vuln/cve-2026-54103
https://db.gcve.eu/vuln/cve-2026-54104

:blobcatthinkingglare:

lol. lmao.

https://nvd.nist.gov/vuln/detail/CVE-2026-54103

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.

https://db.gcve.eu/vuln/cve-2026-54103
https://db.gcve.eu/vuln/cve-2026-54104

:blobcatthinkingglare:

CVE-2026-54103 (CRITICAL, CVSS 9.8): GAO EPDS & CBCA EDS lack authentication on password change API, enabling remote takeover. No patch yet. Restrict access, monitor logs. Details: https://radar.offseq.com/threat/cve-2026-54103-cwe-306-missing-authentication-for--c02db531e70d9ca2 #OffSeq #Vuln #CVE202654103 #GovSec

🟠 CVE-2026-12044 - High (8.8)

SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS ''`` for a user-supplied description field. The Jinja templates for Domains (and their constraints), Foreign Tables, Languages, and Event Triggers, plus the V...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40624 - Critical (9.8)

Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+
cameras may allow a remote, unauthenticated attacker to achieve
arbitrary code execution via a specially crafted web request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-12048 - Critical (9.3)

Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Rec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12048/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

[1/6]

Most Impactful Security Incidents & Vulnerabilities ( {date_limit}  → today)

Below is a curated list that follows the three‑tier priority you asked for. All entries are taken from the sources you supplied – no external knowledge has been added. Where a CVSS score was published in the source it is shown; otherwise “high” is used when the description (e.g., kernel‑level memory corruption, authentication bypass) makes the impact clear.

---

🎯 Priority 1 – Critical / High‑Severity Flaws :
CVE‑2026‑47065
• Apache MINA SSHD (ssh‑git bundle) – path‑traversal in `git‑upload‑pack` / `git‑receive‑pack`
• All versions that include the sshd‑git module; fixed in 2.18.0 (or 3.0.0‑M4 for upcoming major).
• 9.8
• Allows an authenticated SSH user to read/write files outside the repository root – full repo takeover.
• https://www.redpacketsecurity.com/cve-alert-cve-2026-56075-praisonai-praisonai/

CVE‑2026‑10840
• Red Hat OpenShift Pipelines (tekton‑scheduler‑rolebinding) – over‑privileged ClusterRoleBinding
• All OpenShift 4.x clusters with the Pipelines operator installed.
• 9.6
• Any authenticated user can modify Kueue / cert‑manager CRDs, disrupt scheduling or replace TLS secrets for the ingress controller.
• https://www.redpacketsecurity.com/cve-alert-cve-2026-56075-praisonai-praisonai/

CVE‑2026‑11332
• Ansible Core – `ansible‑galaxy role install` argument injection via malformed `src` field in `requirements.yml`
• All versions prior to the fix released on 2026‑06‑05.
• 7.8
• Remote code execution when a malicious role is installed from an untrusted source.
• https://www.redpacketsecurity.com/cve-alert-cve-2026-56075-praisonai-praisonai/

CVE‑2026‑10118
• Poppler (Splash backend) – integer overflow in `tilingPatternFill` → out‑of‑bounds write
• All Poppler versions shipped with major Linux distros before the 2026‑06‑01 fix.
• 7.8
• Crafted PDF can lead to arbitrary code execution or DoS in any viewer using Poppler (e.g., Chrome, Evince).
• https://www.redpacketsecurity.com/cve-alert-cve-2026-56075-praisonai-praisonai/

#infosecnews

Microsoft Cost Management is affected by CVE-2026-47633 (HIGH, CVSS 7.5) — remote attackers can access sensitive info with no auth or user interaction. Patch available: https://radar.offseq.com/threat/cve-2026-47633-cwe-200-exposure-of-sensitive-infor-9882c245b9fe08eb #OffSeq #Microsoft #CVE #BlueTeam

Microsoft 365 Copilot hit by CVE-2026-54130 (CRITICAL, CVSS 9.8): Missing authentication lets attackers disclose info over the network. Official fix deployed — verify your cloud service is updated. 📢 https://radar.offseq.com/threat/cve-2026-54130-cwe-306-missing-authentication-for--8486327e51e4c768 #OffSeq #Microsoft365 #CVE #CloudSecurity

CVE-2026-32174: HIGH severity improper authentication in Microsoft Azure AI Bot Service (CVSS 7.7). Privilege escalation possible for authorized users. Microsoft has issued a server-side fix. No active exploits. Details: https://radar.offseq.com/threat/cve-2026-32174-cwe-287-improper-authentication-in--3888a626d33fd2e5 #OffSeq #Azure #Vuln #CloudSec

CVE-2026-47647 (CRITICAL, CVSS 9.9) affects Microsoft Dynamics 365: improper access control lets authorized users escalate privileges over the network. Fix applied by Microsoft server-side — admins should confirm updates. Details: https://radar.offseq.com/threat/cve-2026-47647-cwe-284-improper-access-control-in--2000e43e6c3db613 #OffSeq #Microsoft #Infosec #CVE

2026-06-18, Version 22.23.0 'Jod' (LTS), @aduh95

This is a security release. Notable Changes (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High (CVE-2026-48937) deps: fix...

https://github.com/nodejs/node/releases/tag/v22.23.0

#nodejs #javascript

CVE-2026-47846 - Critical supply chain attack in Bitnami Cassandra containers. Default superuser cassandra:cassandra retained after custom admin setup. CVSS 9.8. Update all affected images immediately. #CVE #Bitnami #infosec

https://www.valtersit.com/cve/CVE-2026-47846/

Bitnami Cassandra container images (4.0.0, 4.1.0, 5.0.0) have a CRITICAL flaw (CVE-2026-47846): default cassandra:cassandra superuser may remain after custom admin setup. Update urgently! https://radar.offseq.com/threat/cve-2026-47846-cwe-798-use-of-hard-coded-credentia-ebcf63185c71b6d0 #OffSeq #Cassandra #Vuln #CloudSecurity

🟠 CVE-2026-53849 - High (8.1)

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can change ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53849/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-53853 - High (8.3)

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables on Linux and macOS systems. Attackers can bypass configured argPattern...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53853/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-53855 - High (8.1)

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional arguments to pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53855/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: CVE-2026-28573 targets Android 14 & 16 via missing permission check, enabling persistent local DoS — no user interaction or privileges needed. Patch status unknown. Stay updated: https://radar.offseq.com/threat/cve-2026-28573-denial-of-service-in-google-android-3a071465298b8ea9 #OffSeq #Android #InfoSec #CVE #Vuln

CRITICAL: CVE-2026-54390 in JTL Shop (5.2.0 – 5.7.1) enables unauthenticated template injection. Attackers can extract secrets; RCE possible in 5.4.0+. No patch yet — restrict access & monitor logs. https://radar.offseq.com/threat/cve-2026-54390-improper-neutralization-of-special--56e42e7fa37d20ee #OffSeq #CVE202654390 #infosec #websecurity

⚠️ CRITICAL: CISA: Splunk Enterprise flaw actively exploited, patch by Sunday

CVE-2026-20253 in Splunk Enterprise is actively exploited in the wild, allowing attackers to create or truncate arbitrary files on vulnerable systems. Federal agencies are mandated to patch by Sunday. Any organization running unpatched Splunk Enterprise is at immediate risk of file manipulation and…

https://threatnoir.com/focus

#infosec #cybersecurity

⚠️ CRITICAL: Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure

CVE-2026-20253 is a critical unauthenticated RCE in Splunk Enterprise being actively exploited in the wild. Attackers can create or truncate arbitrary files via the PostgreSQL sidecar service. All Splunk Enterprise instances are at risk and federal agencies have been mandated to patch by June 21st.

https://threatnoir.com/focus

#infosec #cybersecurity

🚨 Attention Splunk Users: The Threat is Still Active!

Despite security advisories, recent scans reveal that thousands of global Splunk systems remain unpatched against CVE-2026-20253. Threat actors are already actively scanning for this critical flaw.

This dangerous multi-stage exploit abuses the PostgreSQL sidecar service, allowing attackers to achieve full Pre-Auth RCE with zero authentication.
👉 https://denizhalil.com/2026/06/15/cve-2026-20253-splunk-unauthenticated-rce-analysis/

#Cybersecurity #Splunk #Vulnerability #RCE #Infosec #ThreatIntel

Splunk Enterprise PostgreSQL Sidecar Vulnerability Exploited in the Wild

A critical, actively exploited vulnerability (CVE-2026-20253) in Splunk Enterprise allows anyone on the network to bypass authentication and manipulate files, leading to potential system takeover. Patches are available in versions 10.4.0, 10.2.4, and 10.0.7.

**Check your versions and patch Splunk Enterprise to 10.4.0, 10.2.4, or 10.0.7 immediately. If you cannot patch today, mitigate the risk right now by disabling the PostgreSQL sidecar service. Finally, verify your network architecture: ensure Splunk Web (port 8000) and management ports are restricted by a firewall, placed on an isolated network segment, and only accessible remotely via a VPN.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/splunk-enterprise-postgresql-sidecar-vulnerability-exploited-in-the-wild-h-u-h-s-6/gD2P6Ple2L

Here's a summary of recent geopolitical, technology, and cybersecurity news:

Geopolitical: Western allies pledged $4B military aid to Ukraine (June 18). US-Iran talks stalled, and a Lebanon ceasefire was agreed. France emphasized tech sovereignty, ditching US vendors.

Technology: Anthropic's Fable 5 AI model returned with restricted access after a government-forced shutdown.

Cybersecurity: An unpatchable 'usbliter8' exploit impacts Apple A12/A13 chips. A critical Splunk Enterprise vulnerability (CVE-2026-20253) is actively exploited; CISA urged urgent patching (June 19).

#Cybersecurity #Geopolitics #TechNews

📰 Splunk Scrambles to Patch Critical 9.8 CVSS Flaw Allowing Unauthenticated RCE

🚨 CRITICAL Splunk Enterprise flaw (CVE-2026-20253) allows unauthenticated RCE! CVSS 9.8. Attackers can execute code via an insecure PostgreSQL endpoint. On-premise versions 10.0.x and 10.2.x are vulnerable. Patch now! #Splunk #RCE #CyberSecurity

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/critical-splunk-enterprise-flaw-cve-2026-20253-allows-unauthenticated-rce/?utm_s…

CVE-2026-20253 Splunk Vulnerability. Active exploitation is confirmed. CROs and Boards must prioritize this directive to secure enterprise assets and prevent privilege escalation. Review our latest C-SUITE intelligence brief now. https://thecybermind.co/xo4x

#CyberSecurity #Splunk #CISO #RiskManagement

⚠️ CRITICAL: CISA: Splunk Enterprise flaw actively exploited, patch by Sunday

CVE-2026-20253 in Splunk Enterprise is actively exploited in the wild, allowing attackers to create or truncate arbitrary files on vulnerable systems. Federal agencies are mandated to patch by Sunday. Any organization running unpatched Splunk Enterprise is at immediate risk of file manipulation and…

https://threatnoir.com/focus

#infosec #cybersecurity

⚠️ CRITICAL: Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure

CVE-2026-20253 is a critical unauthenticated RCE in Splunk Enterprise being actively exploited in the wild. Attackers can create or truncate arbitrary files via the PostgreSQL sidecar service. All Splunk Enterprise instances are at risk and federal agencies have been mandated to patch by June 21st.

https://threatnoir.com/focus

#infosec #cybersecurity

Splunk Enterprise PostgreSQL Sidecar Vulnerability Exploited in the Wild

A critical, actively exploited vulnerability (CVE-2026-20253) in Splunk Enterprise allows anyone on the network to bypass authentication and manipulate files, leading to potential system takeover. Patches are available in versions 10.4.0, 10.2.4, and 10.0.7.

**Check your versions and patch Splunk Enterprise to 10.4.0, 10.2.4, or 10.0.7 immediately. If you cannot patch today, mitigate the risk right now by disabling the PostgreSQL sidecar service. Finally, verify your network architecture: ensure Splunk Web (port 8000) and management ports are restricted by a firewall, placed on an isolated network segment, and only accessible remotely via a VPN.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/splunk-enterprise-postgresql-sidecar-vulnerability-exploited-in-the-wild-h-u-h-s-6/gD2P6Ple2L

Here's a summary of recent geopolitical, technology, and cybersecurity news:

Geopolitical: Western allies pledged $4B military aid to Ukraine (June 18). US-Iran talks stalled, and a Lebanon ceasefire was agreed. France emphasized tech sovereignty, ditching US vendors.

Technology: Anthropic's Fable 5 AI model returned with restricted access after a government-forced shutdown.

Cybersecurity: An unpatchable 'usbliter8' exploit impacts Apple A12/A13 chips. A critical Splunk Enterprise vulnerability (CVE-2026-20253) is actively exploited; CISA urged urgent patching (June 19).

#Cybersecurity #Geopolitics #TechNews

CVE-2026-20253 Splunk Vulnerability. Active exploitation is confirmed. CROs and Boards must prioritize this directive to secure enterprise assets and prevent privilege escalation. Review our latest C-SUITE intelligence brief now. https://thecybermind.co/xo4x

#CyberSecurity #Splunk #CISO #RiskManagement

Latest Geopolitical: An interim US-Iran agreement aims to de-escalate tensions and reopen the Strait of Hormuz, while Moscow endured its largest Ukrainian drone attack, hitting an oil refinery.

Technology: Anthropic's Claude Fable 5 AI is back online after a six-day shutdown, as Google makes Gemini 2.5 Flash its default model.

Cybersecurity: CISA issued alerts for an actively exploited Splunk vulnerability (CVE-2026-20253) and widespread Fortinet "FortiBleed" attacks. Accenture also acquired key OT security firms.

#AnonNews_irc #Cybersecurity #News

ACTIVE THREAT: CVE-2026-20253 Splunk Enterprise vulnerability is being exploited in the wild. Our latest TSUITE Brief provides a full SQL injection defense playbook, including n8n automation triggers for your SOC. Secure your infrastructure now. https://thecybermind.co/2yn5

#Cybersecurity #Splunk #CVE202620253

📢 CVE-2026-20253 : RCE pré-authentifiée dans Splunk Enterprise via le service PostgreSQL Sidecar
📝 ## 🔍 Contexte

Le 12 juin 2026, watchTowr Labs (Piotr Bazy...
📖 cyberveille : https://cyberveille.ch/posts/2026-06-18-cve-2026-20253-rce-pre-authentifiee-dans-splunk-enterprise-via-le-service-postgresql-sidecar/
🌐 source : https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce
#CVE_2026_20253 #IOC #Cyberveille

CVE ID: CVE-2026-20253
Vendor: Splunk
Product: Enterprise
Date Added: 2026-06-18
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-20253

🚨 [CISA-2026:0618] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0618)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-20253 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-20253)
- Name: Splunk Enterprise Missing Authentication for Critical Function Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Splunk
- Product: Enterprise
- Notes: https://advisory.splunk.com/advisories/SVD-2026-0603 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20253

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260618 #cisa20260618 #cve_2026_20253 #cve202620253

CISA has added one vulnerability to the KEV catalogue.

- CVE-2026-20253: Splunk Enterprise Missing Authentication for Critical Function Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-20253#CISA #infosec #vulnerability

Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE) https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/

:blobcat_thisisfine:

https://nvd.nist.gov/vuln/detail/CVE-2026-55203

sev:CRIT 9.0 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.

#OT #Advisory VDE-2026-051
iba: Deserialization vulnerability in ibaPDA and ibaDatCoordinator

Remote Code Execution (RCE) running under the service user account, thereby allowing privilege escalation.
#CVE CVE-2026-8024

https://certvde.com/en/advisories/vde-2026-051/
#oCSAF
#CSAF https://iba.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-051.json

New.

Tenable research advisories:

CRITICAL: CVE-2026-8024: iba ibaPDA / ibaDatCoordinator .NET Deserialization Remote Code Execution https://www.tenable.com/security/research/tra-2026-49 @tenable

Cisco:

CRITICAL: CVE-2026-20181 and CVE-2026-20190: Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities

Three others of medium-severity: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity

Broadcom:

Several critical and high-severity vulnerabilities. A login is needed for details https://support.broadcom.com/web/ecx/security-advisory

Dell:

Several advisories, one of them critical:

CRITICAL: Security Update for Dell Data Protection Central Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000478330/dsa-2026-284-security-update-for-dell-data-protection-central-multiple-third-party-component-vulnerabilities

More: https://www.dell.com/support/security/en-us

Google:

Chrome Beta for iOS Update https://chromereleases.googleblog.com/

Yesterday:

Microsoft:

CVE-2026-50656: Microsoft Defender Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656

Nvidia:

Security Bulletin addressing CVE-2026-24155, CVE-2026-24252, and CVE-2026-24228:

NVIDIA NeMo - June 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5839 #Nvidia #Dell #Cisco #infosec #vulnerability #threatresearch #Broadcom #Google #Chrome #Microsoft #Windows

⚡️ CRITICAL: CVE-2026-47103 in python-statemachine (3.0.0 – <3.2.0) lets attackers execute code remotely via unsanitized eval() in SCXML. Avoid untrusted SCXML until patch. Details: https://radar.offseq.com/threat/cve-2026-47103-improper-neutralization-of-directiv-73074fb6af41b907 #OffSeq #python #security #CVE202647103

🚨 CRITICAL: CVE-2026-55740 in Nur-Alam39 bus-ticket — unauthenticated SQL injection via busid in bus_info.php. Runs as MySQL root/no password! Restrict access & avoid use in production until fixed. Details: https://radar.offseq.com/threat/cve-2026-55740-cwe-89-improper-neutralization-of-s-40562f666d6be857 #OffSeq #SQLInjection #Vuln

🔥 CRITICAL: CVE-2026-12569 in PTC Windchill PDMLink (RCE, CVSS 9.3). Affects versions 11.2.1.0 — 13.1.3.0. No patch yet — restrict access & monitor advisories. Details: https://radar.offseq.com/threat/cve-2026-12569-cwe-20-improper-input-validation-in-d3c6b7768402d666 #OffSeq #CVE202612569 #Vuln #RCE

CVE-2026-11717: CRITICAL vuln in googleapis/mcp-toolbox v1.0.0. Improper auth check lets tokens without 'active' field bypass controls — unauthorized access risk. Patch unconfirmed, monitor advisories: https://radar.offseq.com/threat/cve-2026-11717-cwe-287-improper-authentication-in--13893f570bf80e27 #OffSeq #CVE202611717 #OAuth2 #CloudSecurity

🔒 CRITICAL: CVE-2026-12441 in Chrome <149.0.7827.155 on Linux — use-after-free in File Input. Remote attacker can trigger heap corruption via crafted HTML. Update Chrome ASAP! https://radar.offseq.com/threat/cve-2026-12441-use-after-free-in-google-chrome-643def61 #OffSeq #Chrome #Linux #Vuln

🟠 CVE-2026-53843 - High (8.8)

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53843/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Oracle's June 2026 CRITICAL update fixes 245 vulns (incl. CVE-2026-46850) in MySQL Shell, Router, NDB Cluster, Server (8.0.11-8.0.46, 8.4.0-8.4.9, 9.0.0-9.7.0, 2026.2.0+9.6.1). Patch promptly — no exploits yet. https://radar.offseq.com/threat/kwetsbaarheden-verholpen-in-oracle-mysql-producten-948cec13 #OffSeq #MySQL #Oracle #CVE202646850

📢 Cisco corrige une vulnérabilité critique d'exécution de commandes dans ISE (CVE-2026-20181)
📝 📰 Source : SecurityWeek, publié le 18 juin 2026 par Ionut Arghire.
📖 cyberveille : https://cyberveille.ch/posts/2026-06-19-cisco-corrige-une-vulnerabilite-critique-d-execution-de-commandes-dans-ise-cve-2026-20181/
🌐 source : https://www.securityweek.com/critical-command-execution-vulnerability-patched-in-cisco-ise
#CVE_2026_20181 #CVE_2026_20190 #Cyberveille

New advisory.

This relates to critical CVE-2026-20181 and CVE-2026-20190 vulnerabilities, published on the 17th.

Cisco: CRITICAL: Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv @TalosSecurity #Cisco #infosec #vulnerability

@cR0w

Cisco Patches Critical Root RCE and Credential Theft Flaws in ISE

Cisco patched a critical root RCE vulnerability (CVE-2026-20181) and a high-severity information disclosure flaw (CVE-2026-20190) in its Identity Services Engine. These vulnerabilities allow authenticated root access or theft of hashed credentials.

**Make sure your Cisco ISE and ISE-PIC systems are isolated from the internet and reachable only from trusted management networks. Apply the latest patches immediately (ISE 3.3 Patch 11, 3.4 Patch 6, or 3.5 Patch 3) and for the 3.5 command-execution fix, request the hotfix from Cisco TAC now. Don't wait for Patch 4 in August 2026.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/cisco-patches-critical-root-rce-and-credential-theft-flaws-in-ise-o-v-f-q-7/gD2P6Ple2L

CVE-2026-20181: Cisco ISE/ISE-PIC critical command execution vuln lets authenticated admins run arbitrary OS commands & escalate to root. Patch ISE 3.3/3.4/3.5 ASAP. No active exploitation reported. https://radar.offseq.com/threat/critical-command-execution-vulnerability-patched-i-a05f1533b3fe52d4 #OffSeq #Cisco #Vuln #Infosec

New.

Tenable research advisories:

CRITICAL: CVE-2026-8024: iba ibaPDA / ibaDatCoordinator .NET Deserialization Remote Code Execution https://www.tenable.com/security/research/tra-2026-49 @tenable

Cisco:

CRITICAL: CVE-2026-20181 and CVE-2026-20190: Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities

Three others of medium-severity: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity

Broadcom:

Several critical and high-severity vulnerabilities. A login is needed for details https://support.broadcom.com/web/ecx/security-advisory

Dell:

Several advisories, one of them critical:

CRITICAL: Security Update for Dell Data Protection Central Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000478330/dsa-2026-284-security-update-for-dell-data-protection-central-multiple-third-party-component-vulnerabilities

More: https://www.dell.com/support/security/en-us

Google:

Chrome Beta for iOS Update https://chromereleases.googleblog.com/

Yesterday:

Microsoft:

CVE-2026-50656: Microsoft Defender Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656

Nvidia:

Security Bulletin addressing CVE-2026-24155, CVE-2026-24252, and CVE-2026-24228:

NVIDIA NeMo - June 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5839 #Nvidia #Dell #Cisco #infosec #vulnerability #threatresearch #Broadcom #Google #Chrome #Microsoft #Windows

🚨 CRITICAL: CVE-2026-20181 in Cisco ISE (v3.1 – 3.5) allows authenticated attackers to run OS commands & escalate to root, risking DoS. Restrict admin access & monitor for patches. https://radar.offseq.com/threat/cve-2026-20181-improper-limitation-of-a-pathname-t-3c6d1c8d7d1de462 #OffSeq #Cisco #Vuln #BlueTeam

Oh my.

https://nvd.nist.gov/vuln/detail/CVE-2026-55200

sev:CRIT 9.2 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

🔍 CRITICAL: CVE-2026-2467 in RTI Connext Professional (v5.0.0 – 7.4.0) enables heap-based buffer overflow, risking RCE & DoS. No patch yet — monitor vendor updates. CVSS 9.2. Details: https://radar.offseq.com/threat/cve-2026-2467-cwe-122-heap-based-buffer-overflow-i-3103978a721b1a1c #OffSeq #Vuln #CVE20262467 #RTI #Infosec

New advisory.

This relates to critical CVE-2026-20181 and CVE-2026-20190 vulnerabilities, published on the 17th.

Cisco: CRITICAL: Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-G5WP8vv @TalosSecurity #Cisco #infosec #vulnerability

@cR0w

Cisco Patches Critical Root RCE and Credential Theft Flaws in ISE

Cisco patched a critical root RCE vulnerability (CVE-2026-20181) and a high-severity information disclosure flaw (CVE-2026-20190) in its Identity Services Engine. These vulnerabilities allow authenticated root access or theft of hashed credentials.

**Make sure your Cisco ISE and ISE-PIC systems are isolated from the internet and reachable only from trusted management networks. Apply the latest patches immediately (ISE 3.3 Patch 11, 3.4 Patch 6, or 3.5 Patch 3) and for the 3.5 command-execution fix, request the hotfix from Cisco TAC now. Don't wait for Patch 4 in August 2026.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/cisco-patches-critical-root-rce-and-credential-theft-flaws-in-ise-o-v-f-q-7/gD2P6Ple2L

New.

Tenable research advisories:

CRITICAL: CVE-2026-8024: iba ibaPDA / ibaDatCoordinator .NET Deserialization Remote Code Execution https://www.tenable.com/security/research/tra-2026-49 @tenable

Cisco:

CRITICAL: CVE-2026-20181 and CVE-2026-20190: Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities

Three others of medium-severity: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity

Broadcom:

Several critical and high-severity vulnerabilities. A login is needed for details https://support.broadcom.com/web/ecx/security-advisory

Dell:

Several advisories, one of them critical:

CRITICAL: Security Update for Dell Data Protection Central Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000478330/dsa-2026-284-security-update-for-dell-data-protection-central-multiple-third-party-component-vulnerabilities

More: https://www.dell.com/support/security/en-us

Google:

Chrome Beta for iOS Update https://chromereleases.googleblog.com/

Yesterday:

Microsoft:

CVE-2026-50656: Microsoft Defender Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656

Nvidia:

Security Bulletin addressing CVE-2026-24155, CVE-2026-24252, and CVE-2026-24228:

NVIDIA NeMo - June 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5839 #Nvidia #Dell #Cisco #infosec #vulnerability #threatresearch #Broadcom #Google #Chrome #Microsoft #Windows

⚠️ CRITICAL: nv-tlabs GEN3C has a remote code execution bug (CVE-2026-53805). Unauthenticated attackers can run code via /request-inference & /seed-model endpoints using pickle.loads(). No patch yet — restrict access! https://radar.offseq.com/threat/cve-2026-53805-deserialization-of-untrusted-data-i-8f7f573a4ff60cff #OffSeq #CVE202653805 #NVIDIA #infosec

🟠 CVE-2026-47747 - High (7.8)

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. In versions prior to master-584-0a7ae07, the pickle .ckpt parser in src/model.cpp contained a heap buf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47747/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Windows Defender Vulnerability Exposed as RoguePlanet PoC Spreads Online

A newly disclosed Windows Defender vulnerability, tracked as CVE-2026-50656 and dubbed RoguePlanet, has raised concerns across the cybersecurity...

🔗️ [Thecyberexpress] https://link.is.it/k5s4I4

New.

Tenable research advisories:

CRITICAL: CVE-2026-8024: iba ibaPDA / ibaDatCoordinator .NET Deserialization Remote Code Execution https://www.tenable.com/security/research/tra-2026-49 @tenable

Cisco:

CRITICAL: CVE-2026-20181 and CVE-2026-20190: Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities

Three others of medium-severity: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity

Broadcom:

Several critical and high-severity vulnerabilities. A login is needed for details https://support.broadcom.com/web/ecx/security-advisory

Dell:

Several advisories, one of them critical:

CRITICAL: Security Update for Dell Data Protection Central Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000478330/dsa-2026-284-security-update-for-dell-data-protection-central-multiple-third-party-component-vulnerabilities

More: https://www.dell.com/support/security/en-us

Google:

Chrome Beta for iOS Update https://chromereleases.googleblog.com/

Yesterday:

Microsoft:

CVE-2026-50656: Microsoft Defender Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656

Nvidia:

Security Bulletin addressing CVE-2026-24155, CVE-2026-24252, and CVE-2026-24228:

NVIDIA NeMo - June 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5839 #Nvidia #Dell #Cisco #infosec #vulnerability #threatresearch #Broadcom #Google #Chrome #Microsoft #Windows

🟠 CVE-2026-50656 - High (7.8)

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as &quot;RoguePlanet &quot;. We are working to provide a high quality security update that addresses this vulnera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-50656/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nightmare Eclipses RoguePlanet now has a CVE 🎉: https://nvd.nist.gov/vuln/detail/cve-2026-50656

Not any new detail in there & no fix yet (has only been a week, give them some time...).

Much less relevant but annoying me personally: It taking them a week to ... sorry, shit this out. Broken description in the CVE form & even in the MSRC page it's pretty obvious no one even proofread the non-description. Also empty Acknoledgement section despite link to the Github (not the first time btw)... at least they didn't have it taken down this time? 🙃

Use-after-free in the QPACK encoder of nginx HTTP/3 - CVE-2026-42530 https://cystack.net/vi/research/cve-2026-42530-nginx-en

@c0dec0dec0de RCEs this time, not DoS. CVE-2026-42530 & CVE-2026-42055

F5 Patches Critical Remote Code Execution Flaws in NGINX Open Source and Plus

F5 addressed two critical vulnerabilities (CVE-2026-42530 and CVE-2026-42055) in NGINX that allow unauthenticated remote code execution or denial-of-service. The flaws affect NGINX Open Source, NGINX Plus, and several related gateway and controller products.

**If you run NGINX (Open Source, Plus, Ingress Controller, Gateway Fabric, Instance Manager, or App Protect WAF), update immediately to the fixed versions F5 released: NGINX Open Source 1.31.2 or 1.30.3, and NGINX Plus 37.0.2.1 or R36 P6. If you can't patch right away, temporarily disable HTTP/3 by removing "quic" from all listen directives, and remove the "ignore_invalid_headers off" directive or shrink "large_client_header_buffers" to block these attacks until you update.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/f5-patches-critical-remote-code-execution-flaws-in-nginx-open-source-and-plus-q-l-g-f-a/gD2P6Ple2L

⚠️ CRITICAL: F5 Patches Critical, High-Severity NGINX Vulnerabilities

F5 released patches for critical unauthenticated RCE and DoS vulnerabilities in NGINX (CVE-2026-42530, CVE-2026-42055) affecting NGINX Plus, Controller, and related products. Attackers can exploit heap buffer overflows and use-after-free flaws without credentials to crash services or execute arbitr…

https://threatnoir.com/focus

#infosec #cybersecurity

CVE-2026-42530: Use after free in nginx HTTP/3 QUIC module https://lobste.rs/s/pbvqlz #security
https://www.cve.org/CVERecord?id=CVE-2026-42530

@c0dec0dec0de RCEs this time, not DoS. CVE-2026-42530 & CVE-2026-42055

F5 Patches Critical Remote Code Execution Flaws in NGINX Open Source and Plus

F5 addressed two critical vulnerabilities (CVE-2026-42530 and CVE-2026-42055) in NGINX that allow unauthenticated remote code execution or denial-of-service. The flaws affect NGINX Open Source, NGINX Plus, and several related gateway and controller products.

**If you run NGINX (Open Source, Plus, Ingress Controller, Gateway Fabric, Instance Manager, or App Protect WAF), update immediately to the fixed versions F5 released: NGINX Open Source 1.31.2 or 1.30.3, and NGINX Plus 37.0.2.1 or R36 P6. If you can't patch right away, temporarily disable HTTP/3 by removing "quic" from all listen directives, and remove the "ignore_invalid_headers off" directive or shrink "large_client_header_buffers" to block these attacks until you update.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/f5-patches-critical-remote-code-execution-flaws-in-nginx-open-source-and-plus-q-l-g-f-a/gD2P6Ple2L

⚠️ CRITICAL: F5 Patches Critical, High-Severity NGINX Vulnerabilities

F5 released patches for critical unauthenticated RCE and DoS vulnerabilities in NGINX (CVE-2026-42530, CVE-2026-42055) affecting NGINX Plus, Controller, and related products. Attackers can exploit heap buffer overflows and use-after-free flaws without credentials to crash services or execute arbitr…

https://threatnoir.com/focus

#infosec #cybersecurity

CVE-2026-5667: Unauthenticated Remote Control of Mitsubishi MAC-577IF-2E WiFi Adapters via Probe Request Reconnaissance https://innerfirez.github.io/posts/the-secret-life-of-probe-requests/

CVE-2026-3894 (CRITICAL, CVSS 9.2): Out-of-bounds read in RTI Connext Professional (versions 7.4.0, 7.0.0, 6.1.0, 6.0.0, 5.3.0, 5.0.0). Remote exploitation possible, no patch yet. Monitor vendor updates! https://radar.offseq.com/threat/cve-2026-3894-cwe-125-out-of-bounds-read-in-rti-co-970a787b05fc31ca #OffSeq #CVE20263894 #ICS #vuln

🚨 CRITICAL: CVE-2026-20266 in Splunk AI Toolkit 5.7 lets admins run arbitrary OS commands due to unsafe shell execution. Restrict admin roles & monitor for abuse until patched. Details: https://radar.offseq.com/threat/cve-2026-20266-the-software-constructs-all-or-part-32c0ef3d9fc0383c #OffSeq #Splunk #Vuln #CommandInjection

🚨 CRITICAL: CVE-2026-12440 in Chrome DigitalCredentials (Windows <149.0.7827.155) allows remote sandbox escape. Patch to 149.0.7827.155 ASAP! Exploitation risk is high. https://radar.offseq.com/threat/cve-2026-12440-use-after-free-in-google-chrome-c0fe93a4 #OffSeq #Chrome #InfoSec #Vulnerability

🔴 CRITICAL: CVE-2026-12442 — Chrome on Android <149.0.7827.155 has a use-after-free vuln in Passwords. Remote attackers can execute code via crafted HTML. Update Chrome now! https://radar.offseq.com/threat/cve-2026-12442-use-after-free-in-google-chrome-a5d127b6 #OffSeq #Chrome #Android #Vuln #InfoSec

🚩 CRITICAL: Chrome Web Authentication use-after-free (CVE-2026-12443) enables remote code execution in versions <149.0.7827.155. Patch immediately to stay secure. Vendor fix available. https://radar.offseq.com/threat/cve-2026-12443-use-after-free-in-google-chrome-564c6d01 #OffSeq #Chrome #InfoSec #Vuln

CVE-2026-48907 and LiteSpeed cPanel Plugin Flaws Come Under Active Attack

Attackers are exploiting CVE-2026-48907 in Joomla JCE and a LiteSpeed cPanel plugin flaw, enabling PHP code execution and privilege escalation.

🔗️ [Thecyberexpress] https://link.is.it/SGbmfn

⚠️ CRITICAL: Joomla, LiteSpeed Vulnerabilities Exploited in Attacks

Attackers are actively exploiting CVE-2026-48907 in Joomla Content Editor (JCE) to upload malicious PHP files and execute arbitrary code on all versions before 2.9.99.5. CVE-2026-54420 in LiteSpeed's cPanel plugin allows privilege escalation to root on shared hosting environments. Both vulnerabilit…

https://threatnoir.com/focus

#infosec #cybersecurity

Joomla Content Editor Flaw Allows Unauthenticated Remote Code Execution

A critical vulnerability in the Joomla Content Editor (JCE) extension (CVE-2026-48907) allows unauthenticated attackers to create rogue profiles and execute PHP code. CISA has confirmed active exploitation.

**If you run the JCE extension on your Joomla site, this is urgent. Attackers are actively taking over sites through this flaw. Update it to version 2.9.99.6 or later right away (or apply the free stopgap patch if you're on an older 2.7.x–2.9.x version). Patching alone won't remove malware already planted, so also check for rogue editor profiles and unexpected PHP files in your /images, /media, and /tmp folders, delete anything suspicious, run a full malware scan, and change all admin passwords and database credentials.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/joomla-content-editor-flaw-allows-unauthenticated-remote-code-execution-1-i-2-w-m/gD2P6Ple2L

Alert: CVE-2026-48907. A severe access control flaw in Widget Factory Joomla Content Editor allows unauthenticated PHP script execution. Lock down your CMS. Read our tactical engineering runbook for full IOCs and endpoint hardening steps. https://thecybermind.co/unjv

🛡️ #CyberSecurity #CVE #ThreatIntel

URGENT: CVE-2026-48907 is seeing active exploitation in Joomla! JCE extensions. This critical RCE flaw allows unauthenticated attackers to take full control. Read our executive remediation brief to harden your environment now.
https://thecybermind.co/ic6z
#CyberSecurity #Joomla #Infosec #KEV

⚠️ Vous administrez un site Joomla ?

Petit point sécurité : la faille CVE-2026-48907 touche l’extension **JCE / Joomla Content Editor **et elle est déjà exploitée automatiquement sur Internet.
👇 🩹
https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites

En clair : un site vulnérable peut être compromis même sans compte public ni inscription ouverte.

À faire dès que possible:
• mettre JCE à jour en 2.9.99.6 ou plus récent
• vérifier les profils/comptes suspects
• changer les mots de passe admin, base de données et hébergement
• lancer un scan serveur

(La mise à jour ferme la porte, mais ne nettoie pas forcément ce qui aurait déjà été déposé.)

🔍
⬇️
https://vulnerability.circl.lu/vuln/cve-2026-48907

#CyberVeille #Joomla

🚨 New critical improper access control vulnerability tagged CVE-2026-48907, affecting Widget Factory Joomla Content Editor is seeing active exploitation in the wild as reported by CISA.

Vulnerability detection script available below:
https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-48907.yaml

Patches and mitigations are available:
https://www.sentinelone.com/vulnerability-database/cve-2026-48907/

🚨 [CISA-2026:0616] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0616)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48907 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48907)
- Name: Widget Factory Joomla Content Editor Improper Access Control Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Widget Factory
- Product: Joomla Content Editor
- Notes: https://www.joomlacontenteditor.net/news/jce-security-update-and-a-free-patch-for-older-sites ; https://www.joomlacontenteditor.net/support/changelog/editor ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48907

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260616 #cisa20260616 #cve_2026_48907 #cve202648907

⚠️ CRITICAL: Joomla, LiteSpeed Vulnerabilities Exploited in Attacks

Attackers are actively exploiting CVE-2026-48907 in Joomla Content Editor (JCE) to upload malicious PHP files and execute arbitrary code on all versions before 2.9.99.5. CVE-2026-54420 in LiteSpeed's cPanel plugin allows privilege escalation to root on shared hosting environments. Both vulnerabilit…

https://threatnoir.com/focus

#infosec #cybersecurity

🟠 CVE-2026-49110 - High (7.5)

Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce &lt;= 3.1.4 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49110/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49068 - High (7.5)

Subscriber Sensitive Data Exposure in Coupon Affiliates &lt;= 7.8.1 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49068/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The Vim project shipped fixes for two code-injection flaws in plugins that come bundled with the editor. CVE-2026-47162 in netrw is fixed in 9.2.0495, and a PowerShell command injection in zip.vim, triggered by crafted archive entry names, is fixed in 9.2.0678. Because these plugins ship with stock Vim, simply opening a malicious archive could be the trigger. Do you treat your editor as part of your attack surface?
#Vim #security

CVE-2026-49287 - Supply chain risk in Statamic. Unaddressed incomplete fix from CVE-2026-41175. Sort param manipulation could delete content/assets. CVSS 7.4. No patch; review templates immediately. #CVE #Statamic #infosec

https://www.valtersit.com/cve/CVE-2026-49287/

CVE-2026-49287 - Supply chain risk in Statamic. Unaddressed incomplete fix from CVE-2026-41175. Sort param manipulation could delete content/assets. CVSS 7.4. No patch; review templates immediately. #CVE #Statamic #infosec

https://www.valtersit.com/cve/CVE-2026-49287/

@iamleot Of course, requests to add links were sent in the follow-up email regarding the publication. I noticed that the original links were missing for some CVE entries, but my process hasn't changed recently.
full-context:
https://www.cve.org/CVERecord?id=CVE-2025-60485
truncated:
https://www.cve.org/CVERecord?id=CVE-2025-55649

@iamleot Of course, requests to add links were sent in the follow-up email regarding the publication. I noticed that the original links were missing for some CVE entries, but my process hasn't changed recently.
full-context:
https://www.cve.org/CVERecord?id=CVE-2025-60485
truncated:
https://www.cve.org/CVERecord?id=CVE-2025-55649

🟠 CVE-2026-12317 - High (7.5)

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12317/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-12316 - Critical (9.1)

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12316/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-12314 - High (7.5)

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12314/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-12305 - High (7.5)

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12305/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Command injection and hardcoded creds in Radiflow iSAP Smart Collector. Nice.

https://www.cve.org/CVERecord?id=CVE-2026-22313

https://www.cve.org/CVERecord?id=CVE-2026-22312

🟠 CVE-2026-22312 - High (8.6)

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration
and execute some commands (e.g. system reboot).

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22312/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Command injection and hardcoded creds in Radiflow iSAP Smart Collector. Nice.

https://www.cve.org/CVERecord?id=CVE-2026-22313

https://www.cve.org/CVERecord?id=CVE-2026-22312

🔴 CVE-2026-22313 - Critical (9.1)

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send
arbitrary commands to the device that are executed with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22313/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47964 - High (7.8)

DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a vic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47964/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Who is affected by CVE-2026-12003? Anyone running CPython on Windows across 3.11.15, 3.12.13, 3.13.14, 3.14.6, 3.15.0b2 and earlier. Jake Yamaki of Bishop Fox showed that a low-privilege user can create a path CPython checks for in-tree builds and inject malicious library folders to escalate privileges. It is rated CVSSv4 5.3. With this many affected versions, how do you even inventory every CPython on a Windows fleet?

#Python #Security

Jake Yamaki of Bishop Fox disclosed CVE-2026-12003 in CPython. The interpreter's VPATH variable, combined with a Modules/setup.local landmark used to locate in-tree builds, lets a low-privilege Windows user create that path outside the install directory and inject malicious library folders, escalating privileges. Rated CVSSv4 5.3, it affects 3.11.15, 3.12.13, 3.13.14, 3.14.6, 3.15.0b2 and earlier. Should build-detection logic ever survive into a release binary?

#Python #Security

🟠 CVE-2026-12312 - High (7.5)

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12312/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-12310 - High (7.5)

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12310/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-12315 - Critical (9.1)

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12315/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10649 - High (8.6)

A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacke...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10649/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-12304 - Critical (9.1)

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12304/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-11832 - Critical (9.1)

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.

The default nonce was generated using an MD5 hash of the epoch time, which is predictable.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-11832/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-12087 - Critical (9.1)

Socket versions before 2.041 for Perl have an out-of-bounds heap read.

In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding mu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12087/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-12205 - Critical (9.1)

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery.

Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it.

The first sign() on a Key object p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12205/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-12161 - High (8.8)

Improper input validation in the SSH Elevate Shell feature in
Devolutions Remote Desktop Manager 2026.2.7 allows an authenticated user
with permission to create or modify a shared SSH entry to execute
arbitrary commands on a remote SSH host usi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12161/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New.

Tenable research advisories:

CRITICAL: CVE-2026-8024: iba ibaPDA / ibaDatCoordinator .NET Deserialization Remote Code Execution https://www.tenable.com/security/research/tra-2026-49 @tenable

Cisco:

CRITICAL: CVE-2026-20181 and CVE-2026-20190: Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities

Three others of medium-severity: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity

Broadcom:

Several critical and high-severity vulnerabilities. A login is needed for details https://support.broadcom.com/web/ecx/security-advisory

Dell:

Several advisories, one of them critical:

CRITICAL: Security Update for Dell Data Protection Central Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000478330/dsa-2026-284-security-update-for-dell-data-protection-central-multiple-third-party-component-vulnerabilities

More: https://www.dell.com/support/security/en-us

Google:

Chrome Beta for iOS Update https://chromereleases.googleblog.com/

Yesterday:

Microsoft:

CVE-2026-50656: Microsoft Defender Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656

Nvidia:

Security Bulletin addressing CVE-2026-24155, CVE-2026-24252, and CVE-2026-24228:

NVIDIA NeMo - June 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5839 #Nvidia #Dell #Cisco #infosec #vulnerability #threatresearch #Broadcom #Google #Chrome #Microsoft #Windows

New.

Tenable research advisories:

CRITICAL: CVE-2026-8024: iba ibaPDA / ibaDatCoordinator .NET Deserialization Remote Code Execution https://www.tenable.com/security/research/tra-2026-49 @tenable

Cisco:

CRITICAL: CVE-2026-20181 and CVE-2026-20190: Cisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities

Three others of medium-severity: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity

Broadcom:

Several critical and high-severity vulnerabilities. A login is needed for details https://support.broadcom.com/web/ecx/security-advisory

Dell:

Several advisories, one of them critical:

CRITICAL: Security Update for Dell Data Protection Central Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000478330/dsa-2026-284-security-update-for-dell-data-protection-central-multiple-third-party-component-vulnerabilities

More: https://www.dell.com/support/security/en-us

Google:

Chrome Beta for iOS Update https://chromereleases.googleblog.com/

Yesterday:

Microsoft:

CVE-2026-50656: Microsoft Defender Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50656

Nvidia:

Security Bulletin addressing CVE-2026-24155, CVE-2026-24252, and CVE-2026-24228:

NVIDIA NeMo - June 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5839 #Nvidia #Dell #Cisco #infosec #vulnerability #threatresearch #Broadcom #Google #Chrome #Microsoft #Windows

🟠 CVE-2026-8444 - High (8.8)

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] ra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8444/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49112 - High (7.5)

Unauthenticated Path Traversal in Shared Files &lt;= 1.7.64 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49112/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-49105 - Critical (9.8)

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms &lt;= 1.1.4 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-49067 - Critical (9.3)

Unauthenticated SQL Injection in Advanced 301 and 302 Redirect &lt;= 1.6.9 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49067/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-49106 - Critical (9.8)

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact &lt;= 1.1.6 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-49104 - Critical (9.8)

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms &lt;= 1.2.1 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49104/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49066 - High (7.5)

Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway &lt;= 6.0.0 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49066/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49065 - High (8.2)

Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce &lt;= 1.9.5 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49065/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49061 - High (7.5)

Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce &lt;= 3.2.1 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49061/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-49109 - Critical (9.8)

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms &lt;= 1.4.3 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49109/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-49085 - Critical (9.8)

Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms &lt;= 1.1.4 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49085/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📢 ~14 000 serveurs SimpleHelp exposés via un contournement d'authentification critique (CVE-2026-48558)
📝 📰 **Source** : CybersecurityNews.com — **Date de publication** : 16 juin 2026

...
📖 cyberveille : https://cyberveille.ch/posts/2026-06-18-14-000-serveurs-simplehelp-exposes-via-un-contournement-d-authentification-critique-cve-2026-48558/
🌐 source : https://cybersecuritynews.com/simplehelp-servers-exposed-authentication-bypass-disclosure/
#CVE_2026_48558 #IOC #Cyberveille

📢 CVE-2026-48558 : Contournement d'authentification critique dans SimpleHelp via OIDC
📝 ## 🔍 Contexte

Le 12 juin 2026, Horizon3.ai publie une divulgation technique concernant **CVE-2026-4855...
📖 cyberveille : https://cyberveille.ch/posts/2026-06-17-cve-2026-48558-contournement-d-authentification-critique-dans-simplehelp-via-oidc/
🌐 source : https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/
#CVE_2026_48558 #IOC #Cyberveille

Oracle Patches 245 Vulnerabilities Including Actively Exploited PeopleSoft Zero-Day

Oracle's June 2026 monthly Critical Security Patch Update delivers 245 patches across eleven product families, roughly 120 rated critical including eleven maximum-severity (CVSS 10.0) remotely exploitable unauthenticated flaws concentrated in Fusion Middleware (Coherence, WebCenter, WebLogic) plus Solaris, alongside the fix for a PeopleSoft code-injection vulnerability (CVE-2026-35273) that's reportedly exploited in the wild.

**If you are using Oracle products, review the advisory in detail. Prioritize the maximum-severity (CVSS 10.0) flaws in Fusion Middleware products like Coherence, WebCenter, and WebLogic, since these can be exploited remotely without any login. Pay urgent attention to the PeopleSoft fix (CVE-2026-35273), as attackers are already actively breaking into organizations. Use isolation from the internet and reduced user privileges only as a temporary fix until you can fully patch.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/oracle-patches-245-vulnerabilities-including-actively-exploited-peoplesoft-zero-day-1-m-q-9-5/gD2P6Ple2L

More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520) https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/

More Evidence That Words Don't Mean What We Thought They Meant (Ivanti Sentry Pre-Auth OS Command Injection CVE-2026-10520) https://labs.watchtowr.com/more-evidence-that-words-dont-mean-what-we-thought-they-meant-ivanti-sentry-pre-auth-os-command-injection-cve-2026-10520/

LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html

Marking Your Own Homework (Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751) https://labs.watchtowr.com/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751/

🐧 SIGINT // Ubuntu Watch — 2026-06-21

CVE-2026-23111 now has a public exploit enabling local root and container escape via a one-character nf_tables bug. If you run unpatched Ubuntu with containers, this is actively exploitable and needs immediate attention.

🔗 https://blog.openvpn.net/this-week-in-cybersecurity-microsofts-record-patch-tuesday-arch-linux-supply-chain-compromised-and-chinas-10-year-air-gap-breach

#Ubuntu #Linux #infosec

🚨 KTRYTYCZNA PODSTNOŚĆ WE WTYCZCE #WORDPRESS!
Jak podaje #Sekurak, we wtyczce #Kirki wykryto lukę, pozwalającą na przejęcie dowolnego konta, w tym administratora.
Jeśli masz to rozszerzenie, zaktualizuj je natychmiast do najnowszej wersji!

CVE-2026-8206
CVSS: 9.8

https://sekurak.pl/blad-w-popularnej-wtyczce-do-wordpressa-pozwala-na-przejecie-konta-administratora-cve-2026-8206-kirki/

🚨 CVE-2026-47717: Dive into my deep technical analysis of the FUXA SCADA API logic flaw that allows unauthenticated attackers to leak critical project configurations and operational data.

Read the full analysis here: 👇 https://denizhalil.com/2026/06/19/cve-2026-47717-fuxa-scada-data-disclosure/

#SCADA #infosec

the moment you visit cve.org you are loading 1.xMB of data. This includes everything except binary data (images etc) and CVE data itself.

You wanna learn more about the board? the DOM is built from that one script & populated from a json blob in that script. Well, a string which is then decoded

Wanna look up the contact method for NVIDIAs CNA? Every website on the path to get there is built from that script & already contained in that script as a json blob.

Want to know the geometry of Antarctica? You bet there is a couple of polygons in that script! (I don't know where they are used).

Every linked youtube video that explains something? It's in there!!

Or in other words: You are downloading 1.xMB of data (uncompressed: 4MB) that is probably not very cacheable data past the current session & of which you probably aren't gonna use much of anyway - you just clicked a link to see whats up with CVE-2026-42069 & now you downloaded 400kB of CNA data!

Plataforma Marimo sofre falha crítica que permite acesso a servidores sem credenciais. A vulnerabilidade CVE-2026-39987 foi ativamente explorada em menos de dez horas após divulgação pública 🔒

🔗 https://tugatech.com.pt/t85899-plataforma-marimo-sofre-falha-critica-que-permite-acesso-a-servidores-sem-credenciais

#falha #plataforma #sem 

Plataforma Marimo sofre falha crítica que permite acesso a servidores sem credenciais. A vulnerabilidade CVE-2026-39987 foi ativamente explorada em menos de dez horas após divulgação pública 🔒

🔗 https://tugatech.com.pt/t85899-plataforma-marimo-sofre-falha-critica-que-permite-acesso-a-servidores-sem-credenciais

#falha #plataforma #sem 

Q: Am I counting these?

('https://https:', {'https://https://docs.tenable.com/release-notes/Content/security-center/2026.htm', 'https://https://www.asustor.com/security/security_advisory_detail?id=55', 'https://https://www.tenable.com/security/tns-2026-07', 'https://https://talosintelligence.com/vulnerability_reports/', 'https://https://mail.python.org/archives/list/security-announce@python.org/thread/JIFOBO7UX3LY4VJKJUOKYJV62CFR2IRH/', 'https://https://www.geovision.com.tw/cyber_security.php', 'https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272', 'https://https://github.com/videolan/vlc-android/releases/tag/3.7.0', 'https://https://thewatch.centreon.com/latest-security-bulletins-64/cve-2026-2751-centreon-web-high-severity-5504'})

📰 Hackers Actively Exploit Gravity SMTP Flaw (CVE-2026-4020) to Steal API Keys from 100K WordPress Sites

📢 ATTENTION WordPress Admins: A flaw in the Gravity SMTP plugin (CVE-2026-4020) is being mass-exploited to steal API keys. 100K sites at risk. Update to v2.1.5 & rotate all email service credentials NOW! #WordPress #Vulnerability #CyberSecurity

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/gravity-smtp-wordpress-plugin-flaw-cve-2026-4020-activel…

Hackers are mass-exploiting a Gravity SMTP flaw to steal API keys from 100,000 WordPress sites
https://thenextweb.com/news/gravity-smtp-wordpress-plugin-vulnerability-cve-2026-4020-api-keys-exploit?utm_source=flipboard&utm_medium=activitypub

Posted into Cybersecurity Today @cybersecurity-today-rhudaur

Hackers are mass-exploiting a Gravity SMTP flaw to steal API keys from 100,000 WordPress sites
https://thenextweb.com/news/gravity-smtp-wordpress-plugin-vulnerability-cve-2026-4020-api-keys-exploit?utm_source=flipboard&utm_medium=activitypub

Posted into Sustainability @sustainability-thenextweb

Massive Data Leak Hits WordPress Sites via Gravity SMTP Plugin Flaw Exploited by Attackers Across Millions of Requests + Video

Critical Exposure Found in Popular Email Plugin Powering 100,000 WordPress Sites A recently patched vulnerability in the Gravity SMTP plugin, widely used across the WordPress ecosystem, has exposed tens of thousands of websites to serious information leakage risks. The flaw, tracked as CVE-2026-4020, allows unauthenticated attackers to quietly…

https://undercodenews.com/massive-data-leak-hits-wordpress-sites-via-gravity-smtp-plugin-flaw-exploited-by-attackers-across-millions-of-requests-video/?utm_source=mastodon&utm_medium=jetpack_social

Critical WordPress Security Alert: Gravity SMTP Vulnerability Could Expose API Keys and Email Credentials Across 100,000+ Websites, Dark Web Recent Claims + Video

Introduction: A New WordPress Threat Raises Concerns Across the Website Security Community A newly reported cybersecurity warning is drawing attention from researchers and website administrators after claims emerged that attackers are actively exploiting a vulnerability identified as CVE-2026-4020 in Gravity…

https://undercodenews.com/critical-wordpress-security-alert-gravity-smtp-vulnerability-could-expose-api-keys-and-email-credentials-across-100000-websites-dark-web-recent-claims-video/?utm_source=mastodon&utm_medium=jetpack_social

Hackers are mass-exploiting a Gravity SMTP flaw to steal API keys from 100,000 WordPress sites
https://thenextweb.com/news/gravity-smtp-wordpress-plugin-vulnerability-cve-2026-4020-api-keys-exploit?utm_source=flipboard&utm_medium=activitypub

Posted into Cybersecurity Today @cybersecurity-today-rhudaur

Hackers are mass-exploiting a Gravity SMTP flaw to steal API keys from 100,000 WordPress sites
https://thenextweb.com/news/gravity-smtp-wordpress-plugin-vulnerability-cve-2026-4020-api-keys-exploit?utm_source=flipboard&utm_medium=activitypub

Posted into Sustainability @sustainability-thenextweb

Solid breakdown by @honeylabs of the opportunistic activity against CVE-2026-4020

~560 IPs rotating through ~3,300 UAs

Rly important to heed the info further down in the article re: "attacking the CVE" vs "added yet-another-cred path to existing scans".

https://honeylabs.net/blog/the-cloud-fleet-behind-cve-2026-4020

Most of the CVE-2026-4020 attackers are the same client - https://honeylabs.net/blog/the-cloud-fleet-behind-cve-2026-4020

#hackernews

🤔 Ah, the classic "same client" saga with CVE-2026-4020—because who needs originality in #hacking when you have a Google Cloud fleet playing dress-up with 3,299 user agents? 🌍📬 Apparently, exploiting Gravity #SMTP is a team sport, but only if your team is a single IP address with a personality disorder. What a performance! 🎭💻
https://honeylabs.net/blog/the-cloud-fleet-behind-cve-2026-4020 #CVE20264020 #GoogleCloud #SecurityFlaw #Cybersecurity #HackerNews #ngated

Most of the CVE-2026-4020 attackers are the same client

https://honeylabs.net/blog/the-cloud-fleet-behind-cve-2026-4020

#HackerNews #CVE20264020 #cybersecurity #cloudfleet #attackers #analysis

Q: Am I counting these?

('https://https:', {'https://https://docs.tenable.com/release-notes/Content/security-center/2026.htm', 'https://https://www.asustor.com/security/security_advisory_detail?id=55', 'https://https://www.tenable.com/security/tns-2026-07', 'https://https://talosintelligence.com/vulnerability_reports/', 'https://https://mail.python.org/archives/list/security-announce@python.org/thread/JIFOBO7UX3LY4VJKJUOKYJV62CFR2IRH/', 'https://https://www.geovision.com.tw/cyber_security.php', 'https://https://nvd.nist.gov/vuln/detail/CVE-2026-4272', 'https://https://github.com/videolan/vlc-android/releases/tag/3.7.0', 'https://https://thewatch.centreon.com/latest-security-bulletins-64/cve-2026-2751-centreon-web-high-severity-5504'})

https://www.cve.org/CVERecord?id=CVE-2026-0843 - do I dare click that reference... :neocat_scream_scared: