CVE-2026-15481 (HIGH, CVSS 8.7) affects Trendnet TEW-635BRM <=1.00.03: Remote command injection via IPoA WAN setup. Exploit is public. Devices are EOL — replace hardware ASAP. https://radar.offseq.com/threat/cve-2026-15481-command-injection-in-trendnet-tew-6-0618f5678477012c #OffSeq #Vulnerability #Infosec #IoTSecurity

CVE-2026-15481 (HIGH, CVSS 8.7) affects Trendnet TEW-635BRM <=1.00.03: Remote command injection via IPoA WAN setup. Exploit is public. Devices are EOL — replace hardware ASAP. https://radar.offseq.com/threat/cve-2026-15481-command-injection-in-trendnet-tew-6-0618f5678477012c #OffSeq #Vulnerability #Infosec #IoTSecurity

HIGH severity CVE-2026-58281 in Microsoft Edge (Chromium-based) v1.0.0.0 lets attackers execute code remotely via deserialization of untrusted data. Patch from Microsoft is available. Full details: https://radar.offseq.com/threat/cve-2026-58281-cwe-502-deserialization-of-untruste-514c156fa174f1ed #OffSeq #Vuln #MicrosoftEdge #InfoSec

🟠 CVE-2026-58281 - High (8.3)

Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

HIGH severity CVE-2026-58281 in Microsoft Edge (Chromium-based) v1.0.0.0 lets attackers execute code remotely via deserialization of untrusted data. Patch from Microsoft is available. Full details: https://radar.offseq.com/threat/cve-2026-58281-cwe-502-deserialization-of-untruste-514c156fa174f1ed #OffSeq #Vuln #MicrosoftEdge #InfoSec

🟠 CVE-2026-58281 - High (8.3)

Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56303 - High (7.5)

Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable by the anon role. Unauthenticated attackers can call this function via the /rest/v1/rpc/f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56303/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56303 - High (7.5)

Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable by the anon role. Unauthenticated attackers can call this function via the /rest/v1/rpc/f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56303/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61426 - High (8.6)

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61426 - High (8.6)

PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-61447: CRITICAL RCE in MervinPraison PraisonAI (<1.6.78). Unauthenticated attackers can exploit prompt injection to run arbitrary Python, risking system compromise & secret leaks. No patch yet — restrict exposure & monitor use. https://radar.offseq.com/threat/cve-2026-61447-improper-control-of-generation-of-c-51bde3fa75b4e680 #OffSeq #CVE202661447 #infosec #RCE

🔴 CVE-2026-61447 - Critical (10)

PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-61447: CRITICAL RCE in MervinPraison PraisonAI (<1.6.78). Unauthenticated attackers can exploit prompt injection to run arbitrary Python, risking system compromise & secret leaks. No patch yet — restrict exposure & monitor use. https://radar.offseq.com/threat/cve-2026-61447-improper-control-of-generation-of-c-51bde3fa75b4e680 #OffSeq #CVE202661447 #infosec #RCE

🔴 CVE-2026-61447 - Critical (10)

PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-61445 (CRITICAL, CVSS 9.4): PraisonAI <4.6.78 suffers path traversal & command injection via AICoder chat. Attackers gain root, write files anywhere. Restrict access & monitor — no patch yet. https://radar.offseq.com/threat/cve-2026-61445-improper-limitation-of-a-pathname-t-188171a28e18ac5b #OffSeq #CVE202661445 #AIsecurity #infosec

🔴 CVE-2026-61445 - Critical (9.9)

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61445/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-61445 (CRITICAL, CVSS 9.4): PraisonAI <4.6.78 suffers path traversal & command injection via AICoder chat. Attackers gain root, write files anywhere. Restrict access & monitor — no patch yet. https://radar.offseq.com/threat/cve-2026-61445-improper-limitation-of-a-pathname-t-188171a28e18ac5b #OffSeq #CVE202661445 #AIsecurity #infosec

🔴 CVE-2026-61445 - Critical (9.9)

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61445/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61439 - High (7.5)

PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injectio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61439/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61439 - High (7.5)

PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injectio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61439/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61429 - High (8.5)

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that res...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61429/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61429 - High (8.5)

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that res...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61429/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-60090: PraisonAI <4.6.78 suffers CRITICAL SQL injection (CVSS 9.3). Unauthenticated attackers can drop tables or run arbitrary SQL/CQL via create_collection(). Restrict access & upgrade ASAP. https://radar.offseq.com/threat/cve-2026-60090-improper-neutralization-of-special--a49ea84d7839ded1 #OffSeq #infosec #SQLInjection #vuln

🔴 CVE-2026-60090 - Critical (9.8)

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-60090/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-60090: PraisonAI <4.6.78 suffers CRITICAL SQL injection (CVSS 9.3). Unauthenticated attackers can drop tables or run arbitrary SQL/CQL via create_collection(). Restrict access & upgrade ASAP. https://radar.offseq.com/threat/cve-2026-60090-improper-neutralization-of-special--a49ea84d7839ded1 #OffSeq #infosec #SQLInjection #vuln

🔴 CVE-2026-60090 - Critical (9.8)

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-60090/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Phoca Download for Joomla (v1.0 – 6.1.2) suffers a CRITICAL vuln (CVE-2026-57828): Authenticated users can upload/execute malicious files (RCE risk). No official patch — limit upload access & monitor for updates. https://radar.offseq.com/threat/cve-2026-57828-cwe-434-unrestricted-upload-of-file-ad4cf46e851b4cfe #OffSeq #Joomla #Infosec #CVE202657828

Phoca Download for Joomla (v1.0 – 6.1.2) suffers a CRITICAL vuln (CVE-2026-57828): Authenticated users can upload/execute malicious files (RCE risk). No official patch — limit upload access & monitor for updates. https://radar.offseq.com/threat/cve-2026-57828-cwe-434-unrestricted-upload-of-file-ad4cf46e851b4cfe #OffSeq #Joomla #Infosec #CVE202657828

CVE-2026-57827 (CRITICAL): RSFiles for Joomla v1.0 – 1.17.11 lets unauthenticated attackers upload & execute arbitrary files (RCE, CWE-434). No patch — restrict/disable the extension & monitor for updates. https://radar.offseq.com/threat/cve-2026-57827-cwe-434-unrestricted-upload-of-file-a1f2af3a6bb6ec32 #OffSeq #Joomla #RCE #Vuln

CVE-2026-57827 (CRITICAL): RSFiles for Joomla v1.0 – 1.17.11 lets unauthenticated attackers upload & execute arbitrary files (RCE, CWE-434). No patch — restrict/disable the extension & monitor for updates. https://radar.offseq.com/threat/cve-2026-57827-cwe-434-unrestricted-upload-of-file-a1f2af3a6bb6ec32 #OffSeq #Joomla #RCE #Vuln

🟠 CVE-2026-1359 - High (8.8)

The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the genolve_setOpt() function in all versions up to, and including, 5.0.5. This makes it poss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-1359: Genolve AI Business Graphics & Images plugin ≤5.0.5 (HIGH, CVSS 8.8) allows Contributor+ users to escalate privileges by altering WP options via flawed auth checks. Restrict permissions & monitor for patches. https://radar.offseq.com/threat/cve-2026-1359-cwe-863-incorrect-authorization-in-g-66f7bcdc4d2312b3 #OffSeq #WordPress #Vuln #Infosec

🟠 CVE-2026-1359 - High (8.8)

The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the genolve_setOpt() function in all versions up to, and including, 5.0.5. This makes it poss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-1359: Genolve AI Business Graphics & Images plugin ≤5.0.5 (HIGH, CVSS 8.8) allows Contributor+ users to escalate privileges by altering WP options via flawed auth checks. Restrict permissions & monitor for patches. https://radar.offseq.com/threat/cve-2026-1359-cwe-863-incorrect-authorization-in-g-66f7bcdc4d2312b3 #OffSeq #WordPress #Vuln #Infosec

🟠 CVE-2026-9282 - High (7.5)

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-9282: HIGH severity Path Traversal in boldgrid W3 Total Cache ≤2.9.4. Unauthenticated file read possible if manual minify is enabled and misconfigured. Review configs & monitor for abuse. https://radar.offseq.com/threat/cve-2026-9282-cwe-22-improper-limitation-of-a-path-7d4df905dce7a5ae #OffSeq #WordPress #Vuln #Cybersecurity

🟠 CVE-2026-9282 - High (7.5)

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-9282: HIGH severity Path Traversal in boldgrid W3 Total Cache ≤2.9.4. Unauthenticated file read possible if manual minify is enabled and misconfigured. Review configs & monitor for abuse. https://radar.offseq.com/threat/cve-2026-9282-cwe-22-improper-limitation-of-a-path-7d4df905dce7a5ae #OffSeq #WordPress #Vuln #Cybersecurity

🟠 CVE-2025-6784 - High (8.8)

The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-6784/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-6784 - High (8.8)

The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-6784/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4661 - High (7.5)

The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4661/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4661 - High (7.5)

The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4661/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-15155 - High (8.8)

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-15155 - High (8.8)

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14262 - High (8.8)

The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation in all versions up to, and including, 3.6.6 via the `payload` parameter. The vulnerability exists...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14262/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14262 - High (8.8)

The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation in all versions up to, and including, 3.6.6 via the `payload` parameter. The vulnerability exists...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14262/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2354 - High (8.8)

The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2354/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2354 - High (8.8)

The Swiss Toolkit For WP plugin for WordPress is vulnerable to arbitrary file upload due to a flawed file type validation bypass in the `upload_extension_files()` function in all versions up to, and including, 1.4.6. The `upload_extension_files()`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2354/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Motors – Car Dealership & Classified Listings Plugin (≤1.4.112) hit by HIGH severity stored XSS (CVE-2026-13114). Unauthenticated attackers can inject JS via comments/biographical fields. Patch pending; restrict inputs. https://radar.offseq.com/threat/cve-2026-13114-cwe-79-improper-neutralization-of-i-07a2a4c5849ec829 #OffSeq #WordPress #XSS 🛡️

Motors – Car Dealership & Classified Listings Plugin (≤1.4.112) hit by HIGH severity stored XSS (CVE-2026-13114). Unauthenticated attackers can inject JS via comments/biographical fields. Patch pending; restrict inputs. https://radar.offseq.com/threat/cve-2026-13114-cwe-79-improper-neutralization-of-i-07a2a4c5849ec829 #OffSeq #WordPress #XSS 🛡️

🟠 CVE-2026-7655 - High (8.1)

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email du...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7655/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-7655 | HIGH severity in SureCart WordPress plugin (≤4.2.3): Unauthenticated attackers can hijack accounts, including admins, by exploiting weak email validation in webhook sync. Restrict webhook access, monitor activity. https://radar.offseq.com/threat/cve-2026-7655-cwe-640-weak-password-recovery-mecha-a10bd5499dcec0f1 #OffSeq #WordPress #Infosec #Vuln

🟠 CVE-2026-7655 - High (8.1)

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email du...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7655/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-7655 | HIGH severity in SureCart WordPress plugin (≤4.2.3): Unauthenticated attackers can hijack accounts, including admins, by exploiting weak email validation in webhook sync. Restrict webhook access, monitor activity. https://radar.offseq.com/threat/cve-2026-7655-cwe-640-weak-password-recovery-mecha-a10bd5499dcec0f1 #OffSeq #WordPress #Infosec #Vuln

CVE-2026-13378 - Stored XSS in Form Vibes WordPress plugin. Unauthenticated attackers can inject scripts via Contact Form 7 fields. CVSS 7.2. No patch available. Disable or replace immediately. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-13378/

CVE-2026-15335 - SQLi in Booking Package for WordPress. Unauthenticated attackers can extract sensitive DB info. CVSS 7.5. No patch available. Disable or replace immediately. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-15335/

🟠 CVE-2026-15335 - High (7.5)

The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15335/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-15335 - High (7.5)

The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form) in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15335/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-15338 - High (7.5)

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type_template function. This makes it possible for authenticated attackers, with contributor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15338/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-15338 - High (7.5)

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type_template function. This makes it possible for authenticated attackers, with contributor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15338/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-13353 - High (8.8)

The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capabi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13353/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-13353 - High (8.8)

The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capabi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13353/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-13756 - Privilege Escalation in WP Grid Builder plugin. Subscriber+ can become Admin via REST API flaw. CVSS 8.8. No patch available. Disable or restrict access immediately. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-13756/

🟠 CVE-2026-13756 - High (8.8)

The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the `update()` handler for the `/wp-json/wpgb/v2/metadata` ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13756/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-13756 - High (8.8)

The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the `update()` handler for the `/wp-json/wpgb/v2/metadata` ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13756/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42952 - High (7.5)

Previously, there was no throttling on repeated authentication attempts
to the charging station backend, which could allow an attacker to
execute a denial-of-service attack.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42952/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42952 - High (7.5)

Previously, there was no throttling on repeated authentication attempts
to the charging station backend, which could allow an attacker to
execute a denial-of-service attack.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42952/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55175 - High (7.5)

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55175/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55175 - High (7.5)

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55175/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44383 - High (7.5)

Multiple connections to the backend using the same charging station ID
are allowed, which could allow an attacker to deploy multiple instances
of malicious OCPP clients to overwhelm the backend.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44383/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44383 - High (7.5)

Multiple connections to the backend using the same charging station ID
are allowed, which could allow an attacker to deploy multiple instances
of malicious OCPP clients to overwhelm the backend.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44383/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-20744 - Critical (9.8)

The charging station websocket endpoint accepts connections without
proper authentication, which could lead to privilege escalation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-20744 (CRITICAL, CVSS 9.8): Hydro-Québec Le Circuit Electrique backend websocket lacks auth, allowing privilege escalation. No patch available. Restrict access & monitor connections. https://radar.offseq.com/threat/cve-2026-20744-cwe-284-in-hydro-qubec-le-circuit-e-bd15f6a4c1c3953e #OffSeq #CVE202620744 #ICS #Vulnerability

🔴 CVE-2026-20744 - Critical (9.8)

The charging station websocket endpoint accepts connections without
proper authentication, which could lead to privilege escalation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-20744 (CRITICAL, CVSS 9.8): Hydro-Québec Le Circuit Electrique backend websocket lacks auth, allowing privilege escalation. No patch available. Restrict access & monitor connections. https://radar.offseq.com/threat/cve-2026-20744-cwe-284-in-hydro-qubec-le-circuit-e-bd15f6a4c1c3953e #OffSeq #CVE202620744 #ICS #Vulnerability

🔴 CVE-2026-14480 - Critical (9.9)

OpenPLC Runtime v3 contains an authenticated arbitrary file write
vulnerability in the legacy web UI program‑upload workflow. The
application stores an attacker‑supplied filename (prog_file) directly
into the Programs.File database field an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-14480 - Critical (9.9)

OpenPLC Runtime v3 contains an authenticated arbitrary file write
vulnerability in the legacy web UI program‑upload workflow. The
application stores an attacker‑supplied filename (prog_file) directly
into the Programs.File database field an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-55884: tilt-dev tilt (0.20.8 – 0.37.3) has a CRITICAL auth bypass. Exposes dev resources & session tokens if HUD is bound to non-loopback. Upgrade to 0.37.4 ASAP. https://radar.offseq.com/threat/cve-2026-55884-cwe-306-missing-authentication-for--2fea89f00bf19b8f #OffSeq #Vulnerability #Kubernetes #Infosec

CVE-2026-55884: tilt-dev tilt (0.20.8 – 0.37.3) has a CRITICAL auth bypass. Exposes dev resources & session tokens if HUD is bound to non-loopback. Upgrade to 0.37.4 ASAP. https://radar.offseq.com/threat/cve-2026-55884-cwe-306-missing-authentication-for--2fea89f00bf19b8f #OffSeq #Vulnerability #Kubernetes #Infosec

🟠 CVE-2026-44795 - High (8.8)

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44795/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44795 - High (8.8)

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44795/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-57807 | CRITICAL auth bypass in miniOrange OAuth SSO (<=38.5.8). Exploit via password recovery threatens full compromise. No patch yet — monitor for vendor updates. https://radar.offseq.com/threat/cve-2026-57807-cwe-288-authentication-bypass-using-85e6dbb16ac48da8 #OffSeq #CVE202657807 #OAuth #Security

CVE-2026-57807 | CRITICAL auth bypass in miniOrange OAuth SSO (<=38.5.8). Exploit via password recovery threatens full compromise. No patch yet — monitor for vendor updates. https://radar.offseq.com/threat/cve-2026-57807-cwe-288-authentication-bypass-using-85e6dbb16ac48da8 #OffSeq #CVE202657807 #OAuth #Security

🔴 CVE-2026-57807 - Critical (9.8)

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation.

This issue affects OAuth Single Sign On - SSO (OAuth ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-61459 - Critical (9.8)

MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get, kubectl_describe, kubectl_delete) that allows attackers to bypass the assertNoDangerousFlags security check by supplying resourceType...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61459/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5801 - Critical (9.8)

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM-PMP allows Command Line Execution through SQL Injection.

This issue affects SEM-PMP: t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5801/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-30007 - High (8.8)

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attacke...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-30007/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-30007 - High (8.8)

HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attacke...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-30007/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-61444 - Critical (9.1)

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61444/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-61444 - Critical (9.1)

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61444/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-58122 (CRITICAL): Hermes WebUI <0.51.307 lets remote attackers bypass local IP restrictions via spoofed X-Forwarded-For — enabling SSRF, config overwrite, and OAuth token theft. Restrict header spoofing & monitor access. https://radar.offseq.com/threat/cve-2026-58122-use-of-less-trusted-source-in-nesqu-c1a99cec42d28f9e #OffSeq #CVE202658122 #infosec #SSRF

🔴 CVE-2026-58122 - Critical (9.1)

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopb...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58122/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-57220 - DoS in RabbitMQ. Unauthenticated remote client can consume broker memory via oversized stream frames. CVSS 7.5. Update to 4.2.6 now. #CVE #RabbitMQ #infosec

https://www.valtersit.com/cve/CVE-2026-57220/

🟠 CVE-2026-57220 - High (7.5)

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57220/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55827 - High (7.5)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.1, FreeRDP clients launched with the non-default /cache:codec:rfx option pass desktop stride and height to RemoteFX decoding for Cache Bitmap V3 data while allocating b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55827/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55659 - High (7.7)

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55659/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55233 - High (7.5)

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55233/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-55233 - DoS via OOB write in OpenResty PROXY protocol v2. CVSS 7.5. Workers crash when sending PROXY headers. Update to 1.29.2.5 immediately. #CVE #OpenResty #infosec

https://www.valtersit.com/cve/CVE-2026-55233/

🟠 CVE-2026-55233 - High (7.5)

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55233/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55213 - High (7.5)

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-12761 - Critical (9.8)

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12761/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-12761 - Critical (9.8)

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12761/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6212 - High (8.8)

Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc. TeraMIS allows Privilege Abuse.

This issue affects TeraMIS: from V03.26.01.14 through 30.04.2026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6212 - High (8.8)

Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc. TeraMIS allows Privilege Abuse.

This issue affects TeraMIS: from V03.26.01.14 through 30.04.2026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61461 - High (8.8)

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or param...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61461/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61461 - High (8.8)

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or param...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61461/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61460 - High (8.8)

Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete rec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61460/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57850 - High (8.3)

RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55604 - High (8.6)

DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55604/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-59151 - Critical (9.6)

Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/ap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-59151 - Critical (9.6)

Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/ap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33655 - High (7.7)

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection configuration did not apply IP filtering to hostnames; with ApplyIPFilterForDomain disabl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33655/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59723 - High (8.8)

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the O...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59723/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-54063 - High (7.5)

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled XML attribute value directly as the length argument to m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54063/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-54063 - High (7.5)

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled XML attribute value directly as the length argument to m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54063/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-51119 - Critical (9.1)

An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-51119 - Critical (9.1)

An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39244 - High (7.5)

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39244/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39244 - High (7.5)

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39244/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70796 - High (7.5)

An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.) version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal seque...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70796/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-70796 - High (7.5)

An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.) version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal seque...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70796/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-53657 - High (8.2)

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-53657 - High (8.2)

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-59792 - Critical (9.6)

In JetBrains IntelliJ IDEA before 2026.1.4,
2026.2 code execution via path traversal in project workspace ID handling was possible

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59792/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-59792 - Critical (9.6)

In JetBrains IntelliJ IDEA before 2026.1.4,
2026.2 code execution via path traversal in project workspace ID handling was possible

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59792/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59793 - High (8.8)

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59793 - High (8.8)

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-60105 - High (8.6)

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP() function, which fails to detect embedded IPv4 addresses within IPv4-mapped ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-60105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-12685 | EscortWP ≤3.6.2: CRITICAL backdoor (CWE-912) enables unauthenticated data wipe & exfiltrates site/admin info via hard-coded key. No patch available — replace theme & monitor vendor. https://radar.offseq.com/threat/cve-2026-12685-cwe-912-hidden-functionality-in-esc-2444ba57a4fc890e #OffSeq #WordPress #Infosec #CVE2026_12685

CVE-2025-45422: Proximus b-box UPnP Persistence & Access Control Bypass https://github.com/Cedrico03/CVE-2025-45422---Bbox

🔴 New security advisory:

CVE-2026-56291 affects Balbooa Forms.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-56291-balbooa-forms-unauthenticated-rce-exploited

#InfoSec #VulnerabilityManagement #CyberSec

🚨 [CISA-2026:0710] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0710)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48939 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48939)
- Name: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: iCagenda
- Product: iCagenda
- Notes: https://www.icagenda.com/#download ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48939

⚠️ CVE-2026-56291 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56291)
- Name: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Balbooa
- Product: Forms
- Notes: https://www.balbooa.com/joomla-forms ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56291

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260710 #cisa20260710 #cve_2026_48939 #cve_2026_56291 #cve202648939 #cve202656291

CVE ID: CVE-2026-56291
Vendor: Balbooa
Product: Forms
Date Added: 2026-07-10
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56291

CISA has added two vulnerabilities to the KEV catalogue.

- CVE-2026-48939: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48939

- CVE-2026-56291: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-56291 #CISA #infosec #vulnerability

CVE-2026-56291 | CRITICAL: Balbooa Forms for Joomla (v1.0 – 2.4.0) allows unauthenticated RCE via arbitrary file upload (CWE-434). No patch yet. Disable or restrict access until fixed. https://radar.offseq.com/threat/cve-2026-56291-cwe-434-unrestricted-upload-of-file-aa89baa3213ad239 #OffSeq #Joomla #RCE #Vuln

🔴 CVE-2026-2397 - Critical (9.8)

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection.

This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2397/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2397 - Critical (9.8)

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection.

This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2397/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:0710] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0710)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-48939 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48939)
- Name: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: iCagenda
- Product: iCagenda
- Notes: https://www.icagenda.com/#download ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48939

⚠️ CVE-2026-56291 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56291)
- Name: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Balbooa
- Product: Forms
- Notes: https://www.balbooa.com/joomla-forms ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-56291

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260710 #cisa20260710 #cve_2026_48939 #cve_2026_56291 #cve202648939 #cve202656291

CVE ID: CVE-2026-48939
Vendor: iCagenda
Product: iCagenda
Date Added: 2026-07-10
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48939

CISA has added two vulnerabilities to the KEV catalogue.

- CVE-2026-48939: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48939

- CVE-2026-56291: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-56291 #CISA #infosec #vulnerability

🟠 CVE-2026-2398 - High (8.8)

Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation.

This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this di...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2398 - High (8.8)

Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation.

This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this di...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59796 - High (8.1)

In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59796/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59796 - High (8.1)

In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59796/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59795 - High (8.1)

In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59795/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59795 - High (8.1)

In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59795/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33382 - High (7.5)

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33382/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-15143 - Critical (9.3)

A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to ser...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15143/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-15143 - Critical (9.3)

A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions. This can lead to ser...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15143/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

https://access.redhat.com/security/cve/cve-2026-15143

A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restrictions.

:neobot_giggle:

(there is more, actually, lol https://access.redhat.com/security/cve/cve-2026-15378 )

Red Hat OpenShift AI hit by CRITICAL SSRF (CVE-2026-15378): guardrails-detectors flaw allows remote attackers to access cloud metadata, K8s API, and secrets via crafted XSD. Monitor for exploitation & restrict egress. https://radar.offseq.com/threat/cve-2026-15378-server-side-request-forgery-ssrf-in-6764a44d8dfc74c1 #OffSeq #CVE202615378 #RedHat #Infosec

🟠 CVE-2026-57026 - High (7.5)

An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks Junos OS on MX Series with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).If the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57026/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61437 - High (7.8)

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string ou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61437/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61437 - High (7.8)

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string ou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61437/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61434 - High (8.8)

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61434/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61434 - High (8.8)

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61434/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Dell PowerFlex Manager <5.1.0.1 faces CRITICAL OS command injection (CVE-2026-56688, CVSS 9.1). High-priv attackers can execute root commands — full compromise risk. No patch yet. Limit admin remote access & monitor activity. https://radar.offseq.com/threat/cve-2026-56688-cwe-78-improper-neutralization-of-s-de5ccc00f15b9022 #OffSeq #Dell #Vuln #Infosec

OpenBSD has a use-after-free allowing local privilege escalation to root

https://nvd.nist.gov/vuln/detail/cve-2026-57589

OpenBSD has a use-after-free allowing local privilege escalation to root

Link: https://nvd.nist.gov/vuln/detail/cve-2026-57589
Discussion: https://news.ycombinator.com/item?id=48831658

OpenBSD has a use-after-free allowing local privilege escalation to root
Link: https://nvd.nist.gov/vuln/detail/cve-2026-57589
Comments: https://news.ycombinator.com/item?id=48831658

OpenBSD has a use-after-free allowing local privilege escalation to root

Link: https://nvd.nist.gov/vuln/detail/cve-2026-57589
Discussion: https://news.ycombinator.com/item?id=48831658

OpenBSD has a use-after-free allowing local privilege escalation to root - https://nvd.nist.gov/vuln/detail/cve-2026-57589

#hackernews

Oh, joy! 😒 A riveting tale of OpenBSD's latest "oopsie-daisy" moment, where users can magically escalate privileges—because who doesn't love a good #security blunder? Meanwhile, the article itself is a masterpiece of accessibility: blocked by Cloudflare like a bouncer at a club for nerds. 🕵️‍♂️🔒
https://nvd.nist.gov/vuln/detail/cve-2026-57589 #OpenBSD #Blunder #Accessibility #Issues #HackerNews #PrivilegeEscalation #HackerNews #ngated

OpenBSD has a use-after-free allowing local privilege escalation to root

https://nvd.nist.gov/vuln/detail/cve-2026-57589

Comments: https://news.ycombinator.com/item?id=48831658

#HackerNews #OpenBSD #UseAfterFree #PrivilegeEscalation #Cybersecurity #Vulnerability #CVE-2026-57589

OpenBSD has a use-after-free allowing local privilege escalation to root

https://nvd.nist.gov/vuln/detail/cve-2026-57589

#gov #openbsd

🟠 CVE-2026-12597 - High (8.1)

The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via the GitHub OAuth callback in versions up to, and including, 6.2.3. The vulnerability exists in the loginpress_on_github_login() function, which blindly trusts the f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12597/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-54003 (CRITICAL, CVSS 9.1): getkirby Kirby CMS sites w/o users & behind certain reverse proxies risk remote admin creation via trusted IP headers. Upgrade to 4.9.4/5.4.4+ ASAP. More: https://radar.offseq.com/threat/cve-2026-54003-cwe-454-external-initialization-of--015a5d4d7df10357 #OffSeq #Vulnerability #KirbyCMS #InfoSec

🟠 CVE-2026-54771 - High (8.1)

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools ar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54771/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-54769 - Critical (10)

Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. Whe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

A PAN-OS buffer overflow, CVE-2026-0288, enables arbitrary code execution on Palo Alto firewalls. Patch now.

#PANOS #PaloAltoNetworks #BufferOverflow #ArbitraryCodeExecution #CVE #FirewallSecurity #PatchNow #InfoSec

https://securityonline.info/pan-os-cve-2026-0288/?utm_source=mastodon&utm_medium=jetpack_social

Broadcom has a long list of advisories today, addressing at least two critical vulnerabilities https://support.broadcom.com/web/ecx/security-advisory

Palo Alto:

CRITICAL: CVE-2026-0288 PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent https://security.paloaltonetworks.com/CVE-2026-0288

Dell: Security Update for Dell Networking Products for Multiple Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000362452/dsa-2025-250-security-update-for-dell-networking-products-for-multiple-vulnerabilities #Broascom #infosec #vulnerability #Dell #Intel

🔴 CVE-2026-14894 - Critical (9.8)

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14894/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-14894 (CRITICAL, CVSS 9.8): Arbitrary file upload in Super Forms – Drag & Drop Form Builder <=6.3.313 enables unauthenticated RCE. Restrict plugin use & monitor for uploads. Await vendor patch. https://radar.offseq.com/threat/cve-2026-14894-cwe-434-unrestricted-upload-of-file-eb119ea8c0c00613 #OffSeq #WordPress #Infosec #Vulnerability

CVE-2026-41880 | CRITICAL OS Command Injection in R-SOFT SERWIS DMS OCR module. Authenticated users can execute root commands via crafted uploads. Patched in v3.19-2862/3.17-2580. Upgrade now: https://radar.offseq.com/threat/cve-2026-41880-cwe-78-improper-neutralization-of-s-9acc4d130ed96ca2 #OffSeq #infosec #vulnerability #CVE202641880

🟠 CVE-2026-54423 - High (8.2)

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54423/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SQL Injection vuln (CRITICAL, CVE-2026-15300) in GEO my WP <=4.5.4 lets attackers exploit 'distance', 'lat', 'lng' via query string. Upgrade to 4.5.5 for numeric validation & input casting. https://radar.offseq.com/threat/cve-2026-15300-cwe-89-improper-neutralization-of-s-9618cb6f0d2ba913 #OffSeq #WordPress #Security #CVE202615300

🟠 CVE-2026-15070 - High (8.8)

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This is due to missing or incorrect nonce validation on the setCustomText function. This mak...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15070/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-54782 - Critical (10)

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54782/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Public PoC and write-up detail a Linux kernel privilege escalation flaw (CVE-2026-46215) in DRM GEM. A local user gets root in ~99% of runs.

#Linux #KernelSecurity #CVE202646215 #PrivilegeEscalation #DRM

https://securityonline.info/linux-kernel-privilege-escalation-cve-2026-46215/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-15112: CRITICAL use-after-free in Chrome Ozone (<150.0.7871.115). Remote attackers could trigger heap corruption via crafted HTML. No exploits seen yet. Check vendor guidance: https://radar.offseq.com/threat/cve-2026-15112-use-after-free-in-google-chrome-74d88a97c05d80e2 #OffSeq #Chrome #Vuln #AppSec

🟠 CVE-2026-12598 - High (8.1)

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpress_on_spotify_login() function trusting the unverified 'email' fiel...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12598/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-58123 | CRITICAL RCE in nesquena hermes-webui <0.51.788: Unauthenticated attackers can execute arbitrary shell commands via terminal API in 4 HTTP requests. Restrict endpoint access until patch confirmed. https://radar.offseq.com/threat/cve-2026-58123-missing-authentication-for-critical-9dba2eca75059736 #OffSeq #RCE #infosec #CVE

🔴 CVE-2026-58123 - Critical (9.8)

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can creat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-12595 - High (8.1)

The LoginPress Pro plugin for WordPress is vulnerable to Authentication Bypass via Unverified OAuth Email in all versions up to and including 6.2.3. The vulnerability exists in the loginpress_on_discord_login() Discord OAuth callback handler, whic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12595/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57023 - High (7.5)

An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57023/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58143 - High (8.8)

Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the adm...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58143/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

💥 CVE-2026-44825: A scanner for Apache Solr instances that may be affected by CVE-2026-44825, related to Velocity Template Remote Code Execution (RCE) conditions.

GitHub: https://github.com/gagaltotal/CVE-2026-44825-Apache-Solr-Scanner

🔴 CVE-2026-47646 - Critical (9.3)

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47646/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58525 - High (8.2)

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58525/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

OpenSSH 10.4 ships eight security fixes, including a client use-after-free (CVE-2026-60002) plus SFTP and SCP path bugs. Update now.

#OpenSSH #SSH #UseAfterFree #CVE #InfoSec #CyberSecurity

https://securityonline.info/openssh-10-4-security-fixes/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-14245: CRITICAL vuln in miniOrange OTP Login ≤5.5.1. Auth bypass allows admin takeover if Ultimate Member Password Reset Form is enabled. Disable that integration or enforce phone-only reset until patched. https://radar.offseq.com/threat/cve-2026-14245-cwe-862-missing-authorization-in-cy-f05bec899fe71393 #OffSeq #WordPress #Infosec #Vuln

v4.01 of our Windows client is at https://cryptostorm.is/windows#widget

See attached for client-side fixes.

Servers were updated to OpenVPN 2.7.5 on the 2nd, and v4.01 bundles 2.7.5, so we're good on CVE-2026-12996, CVE-2026-13117, CVE-2026-12932, and CVE-2026-13698.

CVE-2026-15128 (HIGH): Google Chrome <150.0.7871.115 vulnerable to remote UXSS via crafted HTML. Patch available — update now to block script injection. Details: https://radar.offseq.com/threat/cve-2026-15128-inappropriate-implementation-in-goo-a214c2dee3b7e04b #OffSeq #Chrome #Vuln #PatchTuesday #InfoSec

CVE-2026-15130 (HIGH): Chrome <150.0.7871.115 has an insufficient policy enforcement bug, letting remote attackers bypass site isolation with crafted HTML. No exploits reported. Check https://radar.offseq.com/threat/cve-2026-15130-insufficient-policy-enforcement-in--933c1db80d107c58 for updates. #OffSeq #Chrome #BrowserSecurity #Vulnerability

Google Chrome <150.0.7871.115 impacted by CRITICAL CVE-2026-15129 (use-after-free in Views). Remote code execution possible via malicious HTML. Patch status not confirmed — monitor advisory: https://radar.offseq.com/threat/cve-2026-15129-use-after-free-in-google-chrome-aca2929fc0214ef5 #OffSeq #Chrome #Infosec #CVE202615129

CVE-2026-9253: WP Cost Estimation & Payment Forms Builder ≤10.5.97 has a HIGH severity stored XSS via 'customerInfos'. Unauthenticated attackers can inject scripts. Patch status unconfirmed — restrict plugin use for now. https://radar.offseq.com/threat/cve-2026-9253-cwe-79-improper-neutralization-of-in-2f00c010407cb3e3 #OffSeq #WordPress #Vuln #XSS

Here's your weekly batch of Linux local privilege escalation vulnerabilities:

CVE-2026-43499 "GhostLock"
https://nebusec.ai/research/ionstack-part-2/

CVE-2026-46242 "Bad Epoll"
https://github.com/J-jaeyoung/bad-epoll

Enjoy! ✌️

📰 New 'Bad Epoll' Linux Kernel Zero-Day (CVE-2026-46242) Grants Full Root Access

🚨 CRITICAL ZERO-DAY: 'Bad Epoll' (CVE-2026-46242) in Linux Kernel allows any local user to gain full root access. The use-after-free bug affects servers, desktops & Android. PoC exists. Patch immediately! 🐧💥 #Linux #CyberSecurity #ZeroDay #Infosec

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/bad-epoll-linux-kernel-zero-day-allows-root-access/?utm_source=mastodon&utm…

📢 GhostLock (CVE-2026-43499) : stack-UAF dans le noyau Linux depuis 15 ans, exploit stable à 97%
📝 ## 🔍 Contexte

Publié le 7 juillet 2026 par Nebula Security (nebusec.ai), cet article de recherche détaille **GhostLock (CVE-2026-43499)...
📖 cyberveille : https://cyberveille.ch/posts/2026-07-11-ghostlock-cve-2026-43499-stack-uaf-dans-le-noyau-linux-depuis-15-ans-exploit-stable-a-97/
🌐 source : https://nebusec.ai/research/ionstack-part-2/
#CVE_2026_43499 #GhostLock #Cyberveille

Postei no BR-Linux to avisando, e é sobre bug novo/velho.

VULNERABILIDADE GHOSTLOCK PERMITE QUE USUÁRIOS LOCAIS VIREM ROOT

A vulnerabilidade CVE-2026-43499, batizada de GhostLock, é um bug de sincronização divulgado esta semana, que ficou oculto por 15 anos no kernel Linux, e expõe a acesso root por usuários locais.

https://br-linux.org/2026/01/vulnerabilidade-ghostlock-permite-que-usuarios-locais-virem-root.html

Aber linux ist doch sicherer als windohs

Eine seit 2011 bestehende Schwachstelle im Linux-Kernel sorgt gerade für Aufsehen: CVE-2026-43499, von Sicherheitsforschern »GhostLock« getauft, steckt im rtmutex/futex-Subsystem und lässt sich mit hoher Zuverlässigkeit zur Rechteausweitung missbrauchen […] Der Bug betrifft praktisch jede Linux-Distribution der letzten 15 Jahre, ein funktionierender Root-Exploit mit rund 97 % Erfolgsquote kursiert bereits, und ein Proof-of-Concept ist öffentlich auf GitHub einsehbar. Zusätzlich lässt sich damit auch aus Containern ausbrechen – für Docker- und Kubernetes-Hosts also doppelt relevant

Huj, fuffzehn jahre alt. Der kleine verkacker im kernel ist ja fast volljährig geworden, bis ihn mal jemand bemerkt hat… und etwas im kontäjhner laufenzulassen, ist auch kein schutz.

Spielt eure sicherheitsaktualisierungen ein!

15-Year-Old Linux Kernel GhostLock Flaw Lets Local Users Gain Root

CVE-2026-43499, dubbed GhostLock by Nebula Security, exposes a long-standing Linux kernel futex bug that can lead to local root access.

#kernel #linux-&-open-source-news #software #vulnerability
https://linuxiac.com/15-year-old-linux-kernel-ghostlock-flaw-lets-local-users-gain-root/

GhostLock (CVE-2026-43499): a fifteen-year-old rtmutex bug just handed root to anyone with a shell

https://thecybersecguru.com/news/ghostlock-cve-2026-43499-linux-kernel-0day/

Here's your weekly batch of Linux local privilege escalation vulnerabilities:

CVE-2026-43499 "GhostLock"
https://nebusec.ai/research/ionstack-part-2/

CVE-2026-46242 "Bad Epoll"
https://github.com/J-jaeyoung/bad-epoll

Enjoy! ✌️

The GitLab patch release fixes 8 flaws, including a high-severity cross-site scripting bug (CVE-2026-6896). Update to 19.1.2 now.

#GitLab #GitLabSecurity #XSS #CrossSiteScripting #CVE #DevSecOps #PatchNow #InfoSec

https://securityonline.info/gitlab-patch-release-19-1-2/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-6896 - High (8.7)

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6896/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📢 Backdoor d'authentification cachée dans plusieurs firmwares Tenda (CVE-2026-11405)
📝 ## 🔍 Contexte

Le CERT/CC (Carnegie Mellon University) a publié le 6 juillet 2026 la note de vulnérabilité **VU#213560** concernant la découverte d'une **backdoor d'authent...
📖 cyberveille : https://cyberveille.ch/posts/2026-07-11-backdoor-d-authentification-cachee-dans-plusieurs-firmwares-tenda-cve-2026-11405/
🌐 source : https://kb.cert.org/vuls/id/213560
#CVE_2026_11405 #IOC #Cyberveille

📢 Backdoor d'authentification cachée dans plusieurs firmwares Tenda (CVE-2026-11405)
📝 ## 🔍 Contexte

Le CERT/CC (Carnegie Mellon University) a publié le 6 juillet 2026 la note de vulnérabilité **VU#213560** concernant la découverte d'une **backdoor d'authent...
📖 cyberveille : https://cyberveille.ch/posts/2026-07-11-backdoor-d-authentification-cachee-dans-plusieurs-firmwares-tenda-cve-2026-11405/
🌐 source : https://kb.cert.org/vuls/id/213560
#CVE_2026_11405 #IOC #Cyberveille

Tenda Routers Contain Undocumented Authentication Backdoor

Tenda routers contain a hardcoded authentication backdoor (CVE-2026-11405) that allows attackers to gain full administrative control by bypassing standard login credentials. The vulnerability is not patched, and the vendor has not yet responded to the disclosure.

**If you use Tenda routers check your firmware version. If it's one of FH1201, W15E, AC10, AC5, AC6, immediately disable remote web management interface or at least isolate it from the internet. Only manage the device from your trusted local network. Since this backdoor is built into the firmware and Tenda has not released a fix, if there is no patch plan to replace these routers soon. As an extra step, change LAN IP address from the default to make them harder for attackers to find.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/tenda-routers-contain-undocumented-authentication-backdoor-x-7-n-s-6/gD2P6Ple2L

CERT/CC Warns of Unpatched Admin Backdoor in Tenda Router Firmware

CERT/CC warned that several Tenda firmware versions contain an undocumented authentication backdoor that can give attackers administrative access to affected devices. The flaw, tracked as CVE-2026-11405, remains unpatched and could allow attackers to modify device settings, disable security features, or take full control of the device.

**Check your network for affected Tenda devices and reduce exposure immediately. No patch is available, so disable remote web management, block untrusted access to the router’s web interface, and change the default LAN IP address to reduce discovery by automated scanners.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/cert-cc-warns-of-unpatched-admin-backdoor-in-tenda-router-firmware-q-b-l-n-g/gD2P6Ple2L

Hidden backdoor in Tenda routers goes unpatched as company ignores warnings from cybersecurity researchers — Chinese company's firmware allows admin access without a password

CERT/CC has disclosed a critical authentication backdoor affecting multiple Tenda router firmware versions. Tracked as CVE-2026-11405, the flaw grants full administrator access without valid credentials, and no vendor patch is currently available after CERT failed to reach Tenda.
#hardware
https://www.tomshardware.com/tech-industry/cyber-security/hidden-backdoor-found-in-tenda-routers-goes-unpatched-despite-warnings-from-cybersecurity-researchers-affected-firmware-allows-admin-access-without-a-password

Progress patched three MOVEit Transfer flaws, including a stored XSS bug (CVE-2026-11903). No exploitation is confirmed. Update now.

#MOVEit #MOVEitTransfer #StoredXSS #XSS #CVE #ProgressSoftware #PatchNow #InfoSec

https://securityonline.info/moveit-transfer-stored-xss/?utm_source=mastodon&utm_medium=jetpack_social