CVE-2026-90919: ModelTC LightLLM <=1.2.0 faces CRITICAL RCE risk. Unauthenticated /visual_register WebSocket lets attackers send malicious pickle data, leading to code execution. Patch or restrict access fast. https://radar.offseq.com/threat/cve-2026-90919-deserialization-of-untrusted-data-in-modeltc-lightllm-99a91583cd9500c2 #OffSeq #CVE202690919 #RCE #LightLLM

CVE-2026-90919: ModelTC LightLLM <=1.2.0 faces CRITICAL RCE risk. Unauthenticated /visual_register WebSocket lets attackers send malicious pickle data, leading to code execution. Patch or restrict access fast. https://radar.offseq.com/threat/cve-2026-90919-deserialization-of-untrusted-data-in-modeltc-lightllm-99a91583cd9500c2 #OffSeq #CVE202690919 #RCE #LightLLM

VLC Media Player Flaws Allow Heap Corruption and Sensitive Data Disclosure

VideoLAN reports two vulnerabilities in VLC Media Player (CVE-2026-56711 and CVE-2026-73324) that allow attackers to corrupt heap memory or leak sensitive data via crafted PNG files and RTSP streams.

**If you use VLC Media Player (any version from 3.0.0 to 3.0.23), update it to the latest patched version as soon as VideoLAN releases it. Until you've updated, don't open media files, playlists, or RTSP streaming links that come from people or websites you don't know and trust.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/vlc-media-player-flaws-allow-heap-corruption-and-sensitive-data-disclosure-6-k-q-2-9/gD2P6Ple2L

VLC Media Player hit by two critical security flaws: heap corruption and memory disclosure putting millions at risk

https://thecybersecguru.com/news/vlc-media-player-vulnerabilities-cve-2026-56711-cve-2026-73324/

VLC Media Player Flaws Allow Heap Corruption and Sensitive Data Disclosure

VideoLAN reports two vulnerabilities in VLC Media Player (CVE-2026-56711 and CVE-2026-73324) that allow attackers to corrupt heap memory or leak sensitive data via crafted PNG files and RTSP streams.

**If you use VLC Media Player (any version from 3.0.0 to 3.0.23), update it to the latest patched version as soon as VideoLAN releases it. Until you've updated, don't open media files, playlists, or RTSP streaming links that come from people or websites you don't know and trust.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/vlc-media-player-flaws-allow-heap-corruption-and-sensitive-data-disclosure-6-k-q-2-9/gD2P6Ple2L

VLC Media Player hit by two critical security flaws: heap corruption and memory disclosure putting millions at risk

https://thecybersecguru.com/news/vlc-media-player-vulnerabilities-cve-2026-56711-cve-2026-73324/

🚨 Two VLC Media Player flaws can allow code execution and leak sensitive memory

Security researchers have disclosed two vulnerabilities affecting VLC Media Player versions 3.0.0 through 3.0.23.
⠀
CVE-2026-56711, rated 8.6, is a heap out-of-bounds write caused by an integer overflow in VLC's picture buffer allocation.

An attacker can craft a malicious PNG with manipulated dimensions that causes VLC to allocate an undersized memory buffer before writing beyond its boundaries.

The flaw can potentially lead to arbitrary code execution when the malicious image is opened directly or loaded through a playlist.
⠀
CVE-2026-73324, rated 6.9, affects VLC's RealRTSP handling.

A malicious RTSP server can send an oversized response that causes VLC to read beyond an allocated buffer and return adjacent heap memory to the attacker, potentially exposing sensitive information.
⠀
The vulnerable RealRTSP component is enabled in official VideoLAN builds, although some Linux distribution packages may compile VLC without it.
⠀
As of September 11, VLC 3.0.23 remains the current stable desktop release listed by VideoLAN and is affected by both vulnerabilities.

Users should avoid opening untrusted image files or RealRTSP playlist links until an updated release addressing the flaws becomes available.

Source: https://securityonline.info/vlc-media-player-vulnerabilities/

CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
#CVE_2026_85706
https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild/

GitLab Faces a Critical Security Emergency as CVE-2026-85706 Enters the CISA Exploited Vulnerabilities List + Video

Introduction: A GitLab Warning That Administrators Cannot Afford to Ignore A maximum-severity vulnerability in self-hosted GitLab installations has moved from a serious security concern to an urgent patching priority after researchers detected apparent exploitation attempts in the wild. The flaw, tracked as CVE-2026-85706, can allow an unauthenticated…

https://undercodenews.com/gitlab-faces-a-critical-security-emergency-as-cve-2026-85706-enters-the-cisa-exploited-vulnerabilities-list-video/?utm_source=mastodon&utm_medium=jetpack_social

Recent reports confirm a critical GitLab zero-day (CVE-2026-85706) exploited within 24 hours, alongside new EU Cyber Resilience Act mandates for 24-hour vulnerability reporting. Operational technology (OT) sectors face emerging ransomware threats. Meanwhile, leading AI developers advocate for a slowdown in development due to safety concerns, prompting market shifts. Geopolitically, the BRICS summit addressed rising global tensions and the "weaponization of technology."

#Cybersecurity #TechNews #Geopolitics

GitLab Flaw Exploited in Wild, Prompting Urgent Patch Push

A critical GitLab bug, CVE-2026-85706, is under active exploitation, putting sensitive files at risk of exposure due to a path traversal vulnerability that allows unauthenticated users to access arbitrary files. GitLab has urgently pushed a patch to fix the flaw, affecting versions CE/EE 18.7 to 19.3.2.

https://osintsights.com/gitlab-flaw-exploited-in-wild-prompting-urgent-patch-push?utm_source=mastodon&utm_medium=social

#Gitlab #Cve202685706 #PathTraversal #VulnerabilityExploitation #EmergingThreats

📢 [VULN] GitLab : mise à jour de sécurité critique CVE-2026-85706

GitLab a publié le 10 septembre des mises à jour de sécurité. Ce patch critique concerne les versions enterprise et communautaire. Les versions 19.3.2, 19.2.8 et 19.1.8 corrigent un important bug et plusieurs failles de sécurité. GitLab recommande la mise à jour.

🔗 https://www.programmez.com/actualites/gitlab-mise-jour-de-securite-critique-40109
💬 discussion : https://infosec.pub/post/52275402
#CVE #Cyberveille

CVE-2026-85706 GitLab CE/EE: unauthenticated arbitrary file read via commits API, CVSS 10. Affects 18.7 up to 19.1.8, 19.2.6, 19.3.2. No patch confirmed yet, restrict access now. https://www.valtersit.com/cve/CVE-2026-85706/ #CVE #GitLab #infosec

Hackers Exploit GitLab Flaw in Active Attacks

Hackers are actively exploiting a critical GitLab flaw, CVE-2026-85706, that allows them to read sensitive information like credentials and secrets with just a single HTTP request. This vulnerability enables attackers to access arbitrary files, potentially exposing long-lived secrets and confidential data.

https://osintsights.com/hackers-exploit-gitlab-flaw-in-active-attacks?utm_source=mastodon&utm_medium=social

#Gitlab #Cve202685706 #PathTraversal #VulnerabilityExploitation #EmergingThreats

📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability

GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow

🔗 https://cyber.netsecops.io/articles/gitlab-urges-patching-of-critical-cvss-10-path-traversal-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

GitLab CVE-2026-85706: Critical CVSS 100 Flaw Is Already Being Probed in the Wild + Video

GitLab CVE-2026-85706: Critical CVSS 10.0 Path Traversal Flaw Puts Sensitive Files at Risk A Maximum-Severity Warning for GitLab Administrators A dangerous new GitLab vulnerability has moved from disclosure to real-world reconnaissance with remarkable speed. Tracked as CVE-2026-85706, the flaw carries the maximum CVSS score of 10.0 and affects the repository commits API in…

https://undercodenews.com/gitlab-cve-2026-85706-critical-cvss-100-flaw-is-already-being-probed-in-the-wild-video/?utm_source=mastodon&utm_medium=jetpack_social

2026-W37 — Weekly Threat Roundup

🤖 AI is no longer just a defender's tool: state-sponsored groups and criminals weaponized Claude, ChatGPT, and OpenAI agents to automate exploitation, rebuild malware, and generate one million personalized phishing emails in three days.
🔓 GitLab's CVSS 10.0 path traversal flaw (CVE-2026-85706) wa…

https://threatnoir.com/weekly/2026-w37

#infosec #cybersecurity #threatintel

🤖 AI generated summary

GitLab CVE-2026-85706 is a maximum-severity path traversal in the repository commits API enabling unauthenticated arbitrary file read on self-managed servers. CISA added it to KEV with a three-day deadline, signaling active exploitation risk. Patch immediately and review for anomalous access to credentials and secrets. #GitLab #CisaKev #InfoSec

https://cyberworldops.eu/en/gitlab-path-traversal-flaw-enters-cisa-kev-with-three-day-patch

That is a faster turnaround than most people's pizza delivery.

Patch GitLab immediately to remediate CVE-2026-85706 — your self-managed server is the featured product in someone else's highlight reel.

Reward: Complimentary sponsorship credit from Deferred Maintenance Inc. Your inaction keeps them in business.

https://www.securityweek.com/gitlab-vulnerability-exploited-one-day-after-disclosure/

#GitLab #CyberSecurity #ZeroDay #PathTraversal #CVE #PatchedOrPerish (2/2)

🏆 New Achievement! Speed-Run Sponsored by Your Unpatched GitLab!

This achievement is brought to you by Deferred Maintenance Inc. — when you absolutely, positively need unauthenticated strangers reading every file on your server within a single HTTP request. CVE-2026-85706 scored a perfect ten out of ten on the CVSS scale, because some bugs don't do half measures. GitLab dropped patches on a Thursday. By Friday, WatchTowr was already watching wild exploitation probes roll in. One day. (1/2)

GitLab CVSS 100 Vulnerability Reportedly Exploited Within 24 Hours, Leaving Self-Managed Servers Under Immediate Threat + Video

A Critical GitLab Warning for Defenders A critical security vulnerability in GitLab has reportedly moved from public disclosure to active exploitation in roughly a single day. Tracked as CVE-2026-85706, the flaw carries the highest possible CVSS score of 10.0, making it one of the most urgent vulnerabilities facing organizations operating…

https://undercodenews.com/gitlab-cvss-100-vulnerability-reportedly-exploited-within-24-hours-leaving-self-managed-servers-under-immediate-threat-video/?utm_source=mastodon&utm_medium=jetpack_social

🔵 THREAT INTELLIGENCE

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

Vulnerability | CRITICAL
CVEs: CVE-2026-85706

GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes...

Full analysis:
https://www.yazoul.net/news/article/gitlab-cvss-10-file-read-flaw-draws-in-the-wild-probes-after-disclosure

by Yazoul AI

#CyberSecurity #CVE #SecurityOps

📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability

GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow

🔗 https://cyber.netsecops.io/articles/gitlab-urges-patching-of-critical-cvss-10-path-traversal-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

🚨 Detection for the actively exploited GitLab vulnerability tagged as CVE-2026-85706 (CVSS 10.0) available here:
https://github.com/projectdiscovery/nuclei-templates/pull/17231/changes

CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
#CVE_2026_85706
https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild/

Recent reports confirm a critical GitLab zero-day (CVE-2026-85706) exploited within 24 hours, alongside new EU Cyber Resilience Act mandates for 24-hour vulnerability reporting. Operational technology (OT) sectors face emerging ransomware threats. Meanwhile, leading AI developers advocate for a slowdown in development due to safety concerns, prompting market shifts. Geopolitically, the BRICS summit addressed rising global tensions and the "weaponization of technology."

#Cybersecurity #TechNews #Geopolitics

2026-W37 — Weekly Threat Roundup

🤖 AI is no longer just a defender's tool: state-sponsored groups and criminals weaponized Claude, ChatGPT, and OpenAI agents to automate exploitation, rebuild malware, and generate one million personalized phishing emails in three days.
🔓 GitLab's CVSS 10.0 path traversal flaw (CVE-2026-85706) wa…

https://threatnoir.com/weekly/2026-w37

#infosec #cybersecurity #threatintel

🤖 AI generated summary

GitLab CVE-2026-85706 is a maximum-severity path traversal in the repository commits API enabling unauthenticated arbitrary file read on self-managed servers. CISA added it to KEV with a three-day deadline, signaling active exploitation risk. Patch immediately and review for anomalous access to credentials and secrets. #GitLab #CisaKev #InfoSec

https://cyberworldops.eu/en/gitlab-path-traversal-flaw-enters-cisa-kev-with-three-day-patch

That is a faster turnaround than most people's pizza delivery.

Patch GitLab immediately to remediate CVE-2026-85706 — your self-managed server is the featured product in someone else's highlight reel.

Reward: Complimentary sponsorship credit from Deferred Maintenance Inc. Your inaction keeps them in business.

https://www.securityweek.com/gitlab-vulnerability-exploited-one-day-after-disclosure/

#GitLab #CyberSecurity #ZeroDay #PathTraversal #CVE #PatchedOrPerish (2/2)

🏆 New Achievement! Speed-Run Sponsored by Your Unpatched GitLab!

This achievement is brought to you by Deferred Maintenance Inc. — when you absolutely, positively need unauthenticated strangers reading every file on your server within a single HTTP request. CVE-2026-85706 scored a perfect ten out of ten on the CVSS scale, because some bugs don't do half measures. GitLab dropped patches on a Thursday. By Friday, WatchTowr was already watching wild exploitation probes roll in. One day. (1/2)

📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability

GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow

🔗 https://cyber.netsecops.io/articles/gitlab-urges-patching-of-critical-cvss-10-path-traversal-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

🚨 Detection for the actively exploited GitLab vulnerability tagged as CVE-2026-85706 (CVSS 10.0) available here:
https://github.com/projectdiscovery/nuclei-templates/pull/17231/changes

PoC for unauthenticated arbitrary file read on Gitlab https://github.com/guneykabel/cve-2026-85706

GitLab Patches Critical Path Traversal Flaw Under Active Exploitation

GitLab released emergency patches for 18 vulnerabilities, including a CVSS 10.0 path traversal flaw (CVE-2026-85706) that allows unauthenticated attackers to read sensitive server files and is currently seeing active probes.

**If you run a self-hosted GitLab instance, update it now to version 19.3.2, 19.2.6, or 19.1.8. One of these flaws is already being exploited and lets anyone read files off your server without logging in. All it takes is one public project to exist on the instance. If you can't patch right away, take the instance off the public internet and check your logs for POST requests to the repository commits API containing a "file.path" parameter to see if you've already been probed.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/gitlab-patches-critical-path-traversal-flaw-under-active-exploitation-5-n-t-j-9/gD2P6Ple2L

GitLab path-traversal CVE-2026-85706 (CVSS 10.0) is being exploited in the wild one day after disclosure. It allows unauthenticated arbitrary file read with a single HTTP request, exposing secrets and enabling further compromise. Prioritize immediate patching and review logs. #GitLab #PathTraversal #ThreatIntel

https://cyberworldops.eu/en/critical-gitlab-file-read-flaw-exploited-within-a-day-of-patch

🔴 CVE-2026-85706 - Critical (10)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab serve...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85706/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab patched a CVSS 10.0 unauthenticated file-read vulnerability (CVE-2026-85706) in the repository commits API that allows attackers to read arbitrary files from affected servers. In-the-wild probes are already active. Attackers can extract credentials, SSH keys, and other sensitive data without…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

🚨 [CISA-2026:0911] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0911)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-42016 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-42016)
- Name: JFrog Artifactory Incorrect Authorization Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-42016

⚠️ CVE-2026-42018 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-42018)
- Name: JFrog Artifactory Improper Authentication Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: JFrog
- Product: Artifactory
- Notes: https://docs.jfrog.com/releases/docs/jfrog-security-advisories ; https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-42018

⚠️ CVE-2026-84869 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-84869)
- Name: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ConnectWise
- Product: ScreenConnect
- Notes: https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-84869

⚠️ CVE-2026-85706 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-85706)
- Name: GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: GitLab
- Product: Community Edition and Enterprise Edition
- Notes: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85706

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260911 #cisa20260911 #cve_2026_42016 #cve_2026_42018 #cve_2026_84869 #cve_2026_85706 #cve202642016 #cve202642018 #cve202684869 #cve202685706

@cR0w no mention of exploitation from CNA GitLab

CVE-2026-85706 - Path Traversal issue in repository commits API impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Impacted Versions: GitLab CE/EE: all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

Thanks s3ntago for reporting this vulnerability through our HackerOne bug bounty program.

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/

CVE ID: CVE-2026-85706
Vendor: GitLab
Product: Community Edition and Enterprise Edition
Date Added: 2026-09-11
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-85706

CVE-2026-85706 is now in the KEV but the CVE still isn't published. LMAO. Go hack and patch more GitLab shit.

🚨 CVE-2026-85706: An unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7–19.1.7; 19.2.0–19.2.5; 19.3.0–19.3.1

PoC: https://github.com/guneykabel/cve-2026-85706

🚨 GitLab CVSS 10 vulnerability exploited just one day after disclosure

Threat actors have begun exploiting CVE-2026-85706, a critical path traversal vulnerability affecting self-hosted GitLab Community and Enterprise Edition instances.
⠀
The flaw allows an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server using a single HTTP request.

Affected versions include:

• GitLab 18.7 through versions before 19.1.8
• GitLab 19.2 through versions before 19.2.6
• GitLab 19.3 through versions before 19.3.2
⠀
GitLab disclosed and patched the vulnerability on September 10.

Just one day later, watchTowr began observing in-the-wild exploitation attempts and warns that mass exploitation is likely to follow.
⠀
Administrators should upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or a newer supported release.

GitLab.com is already patched.

Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/

GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/

D-Link DWR-M921 v1.1.52 is vulnerable to CRITICAL OS command injection (CVE-2026-90703, CVSS 9.4). No patch yet, public exploit out. Restrict access & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-90703-os-command-injection-in-d-link-dwr-m921-f9739a3ef4495656 #OffSeq #CVE #RouterSecurity #Infosec

D-Link DWR-M921 v1.1.52 is vulnerable to CRITICAL OS command injection (CVE-2026-90703, CVSS 9.4). No patch yet, public exploit out. Restrict access & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-90703-os-command-injection-in-d-link-dwr-m921-f9739a3ef4495656 #OffSeq #CVE #RouterSecurity #Infosec

🔴 CVE-2026-90680 - Critical (9.9)

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings of the component HNAP1. The manipulation of the argument PAddress/SubnetMask/Gateway re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-90680 - Critical (9.9)

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings of the component HNAP1. The manipulation of the argument PAddress/SubnetMask/Gateway re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23789 - High (7.8)

An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23789 - High (7.8)

An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33963 - High (7.5)

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffer overflow occurs when a malformed message is sent to the camera driver, causing a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33963/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33963 - High (7.5)

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffer overflow occurs when a malformed message is sent to the camera driver, causing a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33963/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31278 - High (7.7)

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31278 - High (7.7)

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-90608 - Critical (9.9)

A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manipulation of the argument service_type causes buffer overflow. It is possible...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90608/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-90608: Totolink A3002MU routers have a CRITICAL buffer overflow (CVSS 9.4) in /boafrm/formPortFw. Exploit code is public; RCE possible. No patch — restrict external access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-90608-buffer-overflow-in-totolink-a3002mu-43328ea907451224 #OffSeq #CVE202690608 #RouterSecurity

🔴 CVE-2026-90608 - Critical (9.9)

A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manipulation of the argument service_type causes buffer overflow. It is possible...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90608/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-90608: Totolink A3002MU routers have a CRITICAL buffer overflow (CVSS 9.4) in /boafrm/formPortFw. Exploit code is public; RCE possible. No patch — restrict external access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-90608-buffer-overflow-in-totolink-a3002mu-43328ea907451224 #OffSeq #CVE202690608 #RouterSecurity

🔴 CVE-2026-90607 - Critical (9.9)

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90607/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Totolink A3002MU routers hit by CRITICAL (CVSS 9.4) buffer overflow (CVE-2026-90607) in formNewSchedule. Public exploit code available. Restrict remote access & monitor systems until a patch is released. https://radar.offseq.com/threat/cve-2026-90607-buffer-overflow-in-totolink-a3002mu-f5be31acbfac3e1f #OffSeq #CVE202690607 #RouterSecurity #Infosec

🔴 CVE-2026-90607 - Critical (9.9)

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90607/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Totolink A3002MU routers hit by CRITICAL (CVSS 9.4) buffer overflow (CVE-2026-90607) in formNewSchedule. Public exploit code available. Restrict remote access & monitor systems until a patch is released. https://radar.offseq.com/threat/cve-2026-90607-buffer-overflow-in-totolink-a3002mu-f5be31acbfac3e1f #OffSeq #CVE202690607 #RouterSecurity #Infosec

CVE-2026-90606: HIGH-severity buffer overflow in Totolink A3002MU Hh-B20211125.1046 (boa/formIpv6Setup). Public exploit disclosed. RCE or DoS possible. Restrict access & monitor IPv6 setup. No patch yet. https://radar.offseq.com/threat/a-security-vulnerability-has-been-detected-in-totolink-a3002mu-hh-b202111251046-cve-2026-90606-6a6dad4a128a1845 #OffSeq #Vuln #IoTSecurity #BufferOverflow

🔴 CVE-2026-90606 - Critical (9.9)

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument static_ipv6 leads to buffer ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90606/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-90606: CRITICAL buffer overflow in Totolink A3002MU (Hh-B20211125.1046). Remote attackers can exploit static_ipv6 in /boafrm/formIpv6Setup. Exploit is public — review device exposure now. https://radar.offseq.com/threat/cve-2026-90606-buffer-overflow-in-totolink-a3002mu-ff1e560ec5dedad6 #OffSeq #CVE202690606 #RouterSecurity #NetSec

CVE-2026-90606: HIGH-severity buffer overflow in Totolink A3002MU Hh-B20211125.1046 (boa/formIpv6Setup). Public exploit disclosed. RCE or DoS possible. Restrict access & monitor IPv6 setup. No patch yet. https://radar.offseq.com/threat/a-security-vulnerability-has-been-detected-in-totolink-a3002mu-hh-b202111251046-cve-2026-90606-6a6dad4a128a1845 #OffSeq #Vuln #IoTSecurity #BufferOverflow

🔴 CVE-2026-90606 - Critical (9.9)

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument static_ipv6 leads to buffer ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90606/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-90606: CRITICAL buffer overflow in Totolink A3002MU (Hh-B20211125.1046). Remote attackers can exploit static_ipv6 in /boafrm/formIpv6Setup. Exploit is public — review device exposure now. https://radar.offseq.com/threat/cve-2026-90606-buffer-overflow-in-totolink-a3002mu-ff1e560ec5dedad6 #OffSeq #CVE202690606 #RouterSecurity #NetSec

🔴 CVE-2026-90605 - Critical (9.9)

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90605/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-90605 - Critical (9.9)

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90605/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

PaperCut Attacker (Russian Linked) Uses AI Agents to Compromise 440 Instances

러시아어권으로 추정되는 공격자가 PaperCut NG/MF의 인증 우회·RCE 체인(CVE-2026-81578, CVE-2026-82078)을 악용해 48개국 395개 조직의 최소 440개 인스턴스를 침해한 것으로 보고됐다. 공격자는 OpenAI Codex, DeepSeek 모델, Hindsight의 지속 메모리, AionUi 멀티 에이전트 작업 공간을 결합해 취약점 분석부터 익스플로잇 수정, 표적 분류, 재시도, AD 정찰까지 자동화했으며, 실제 공격 개시 후 2...

https://www.swapupdate.in/papercut-attacker-uses-hundreds-of-ai-agents-to-compromise-440-instances/

PaperCut Attacker (Russian Linked) Uses AI Agents to Compromise 440 Instances

러시아어권으로 추정되는 공격자가 PaperCut NG/MF의 인증 우회·RCE 체인(CVE-2026-81578, CVE-2026-82078)을 악용해 48개국 395개 조직의 최소 440개 인스턴스를 침해한 것으로 보고됐다. 공격자는 OpenAI Codex, DeepSeek 모델, Hindsight의 지속 메모리, AionUi 멀티 에이전트 작업 공간을 결합해 취약점 분석부터 익스플로잇 수정, 표적 분류, 재시도, AD 정찰까지 자동화했으며, 실제 공격 개시 후 2...

https://www.swapupdate.in/papercut-attacker-uses-hundreds-of-ai-agents-to-compromise-440-instances/

🟠 CVE-2026-15891 - High (7.5)

The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded the result....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-15891 - High (7.5)

The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS_SLIST_PEEK_HEAD_CONTAINER(&client->gateways, gw, next) but discarded the result....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88793 - High (8.8)

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88793 - High (8.8)

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88802 - High (7.5)

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88802/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88802 - High (7.5)

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88802/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85129 - High (8.8)

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85129/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85129 - High (8.8)

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85129/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-81648 - Critical (10)

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-81648 - Critical (10)

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-74933 - High (8.8)

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-74933/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-74933 - High (8.8)

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-74933/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-37008 - High (8.1)

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete obj...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-37008/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-37008 - High (8.1)

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete obj...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-37008/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29811 - High (7.7)

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29811/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29811 - High (7.7)

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29811/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90783 - High (7.8)

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an unde...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90783/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90783 - High (7.8)

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an unde...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90783/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90778 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag para...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90778 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag para...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90777 - High (8.8)

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deseri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90777/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90777 - High (8.8)

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deseri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90777/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90774 - High (7.5)

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90774/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90774 - High (7.5)

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90774/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90770 - High (8.8)

Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90770/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90770 - High (8.8)

Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90770/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90768 - High (8.1)

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90768 - High (8.1)

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Strapi 4.x – 4.26.2 & 5.x<5.48.1: CRITICAL stored XSS (CVE-2026-90561, CVSS 8.7) in WYSIWYG preview lets Author roles execute malicious scripts in higher-privileged sessions. Restrict roles & monitor vendor updates. https://radar.offseq.com/threat/strapi-versions-4x-through-4262-and-5x-before-5481-contain-a-stored-cross-site-scripting-vulnerability-e05bee9fce842336 #OffSeq #Strapi #XSS #Infosec

🟠 CVE-2026-90561 - High (8.7)

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90561/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Strapi 4.x – 4.26.2 & 5.x<5.48.1: CRITICAL stored XSS (CVE-2026-90561, CVSS 8.7) in WYSIWYG preview lets Author roles execute malicious scripts in higher-privileged sessions. Restrict roles & monitor vendor updates. https://radar.offseq.com/threat/strapi-versions-4x-through-4262-and-5x-before-5481-contain-a-stored-cross-site-scripting-vulnerability-e05bee9fce842336 #OffSeq #Strapi #XSS #Infosec

🟠 CVE-2026-90561 - High (8.7)

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90561/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90562 - High (8.1)

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through con...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

LangBot <4.10.11 is affected by CRITICAL CVE-2026-90562: password reset keys generated with only 24 bits of entropy & no rate limiting let attackers brute-force admin resets. Upgrade to 4.10.11+! https://radar.offseq.com/threat/cve-2026-90562-insufficient-entropy-in-langbot-app-langbot-e9a2899a1e2d1fa5 #OffSeq #CVE202690562 #infosec #AppSec

🟠 CVE-2026-90562 - High (8.1)

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through con...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

LangBot <4.10.11 is affected by CRITICAL CVE-2026-90562: password reset keys generated with only 24 bits of entropy & no rate limiting let attackers brute-force admin resets. Upgrade to 4.10.11+! https://radar.offseq.com/threat/cve-2026-90562-insufficient-entropy-in-langbot-app-langbot-e9a2899a1e2d1fa5 #OffSeq #CVE202690562 #infosec #AppSec

🟠 CVE-2026-86406 - High (7.5)

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86406/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86406 - High (7.5)

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86406/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90780 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90780/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90780 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90780/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90779 - High (7.5)

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90779/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90779 - High (7.5)

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90779/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90776 - High (7.5)

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90776/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90776 - High (7.5)

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90776/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-90775: HIGH severity vuln in PostGIS address_standardizer (≤3.7.0) allows out-of-bounds read via unvalidated Weight parameter, crashing PostgreSQL backend (DoS). Patch status pending — monitor vendor updates. https://radar.offseq.com/threat/cve-2026-90775-out-of-bounds-read-in-postgis-addressstandardizer-b09887107f7082c5 #OffSeq #PostGIS #Vuln

CVE-2026-90775: HIGH severity vuln in PostGIS address_standardizer (≤3.7.0) allows out-of-bounds read via unvalidated Weight parameter, crashing PostgreSQL backend (DoS). Patch status pending — monitor vendor updates. https://radar.offseq.com/threat/cve-2026-90775-out-of-bounds-read-in-postgis-addressstandardizer-b09887107f7082c5 #OffSeq #PostGIS #Vuln

🟠 CVE-2026-90772 - High (7.6)

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90772/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90772 - High (7.6)

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90772/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90769 - High (7.7)

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90769 - High (7.7)

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90510 - High (8.3)

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/drom...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90510 - High (8.3)

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/drom...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89080 - High (7.5)

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the sec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89080 - High (7.5)

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows the account's password to bypass the sec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89690 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: defer vfree of compound ops to fix rpc_status UAF

The rpc_status netlink dumpit walks every in-flight svc_rqst under
rcu_read_lock and, for NFSv4 requests, reads opnums ou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89690/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89690 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: defer vfree of compound ops to fix rpc_status UAF

The rpc_status netlink dumpit walks every in-flight svc_rqst under
rcu_read_lock and, for NFSv4 requests, reads opnums ou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89690/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89696 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return
success with fh_dentry and fh_export bo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89696/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89696 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return
success with fh_dentry and fh_export bo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89696/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89612 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

ntfs: reject invalid MFT LCNs from boot sector

The NTFS boot sector stores the MFT and MFTMirr locations as unsigned
64-bit LCNs, but parse_ntfs_boot_sector() decoded them into ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89612/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89612 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

ntfs: reject invalid MFT LCNs from boot sector

The NTFS boot sector stores the MFT and MFTMirr locations as unsigned
64-bit LCNs, but parse_ntfs_boot_sector() decoded them into ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89612/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89611 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate non-resident attribute offsets

ntfs_attr_update_meta() shifts the attribute name when converting between
non-sparse and sparse attributes. Converting to sparse al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89611/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89611 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

ntfs: validate non-resident attribute offsets

ntfs_attr_update_meta() shifts the attribute name when converting between
non-sparse and sparse attributes. Converting to sparse al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89611/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89697 - Critical (9.1)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()
can inspect the dentry. This ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89697 - Critical (9.1)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()
can inspect the dentry. This ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-80981: Linux kernel net/smc HIGH severity use-after-free in smc_llc_srv_add_link(). Risk of memory corruption & escalation. Patch when available! Details: https://radar.offseq.com/threat/in-the-linux-kernel-the-following-vulnerability-has-been-resolved-netsmc-fix-use-after-free-of-the-llc-1751a25f120aa002 #OffSeq #Linux #Infosec #Vulnerability

🟠 CVE-2026-89750 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing/user_events: Clear copied tracing state before fork duplication

dup_task_struct() copies user_event_mm from the parent into the child,
without grabbing a reference to it...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89750 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing/user_events: Clear copied tracing state before fork duplication

dup_task_struct() copies user_event_mm from the parent into the child,
without grabbing a reference to it...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89744 - High (8.4)

In the Linux kernel, the following vulnerability has been resolved:

device property: fix infinite loop in fwnode_for_each_child_node()

When iterate over children of a fwnode that has a secondary fwnode,
fwnode_get_next_child_node() can enter an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89744 - High (8.4)

In the Linux kernel, the following vulnerability has been resolved:

device property: fix infinite loop in fwnode_for_each_child_node()

When iterate over children of a fwnode that has a secondary fwnode,
fwnode_get_next_child_node() can enter an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89758 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: skip non-present PMDs when queueing folios

Patch series "mm: handle device-private PMDs in walk callbacks", v3.

Since commit 368076f52ebe ("mm/huge_memory: add de...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89758/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89758 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: skip non-present PMDs when queueing folios

Patch series "mm: handle device-private PMDs in walk callbacks", v3.

Since commit 368076f52ebe ("mm/huge_memory: add de...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89758/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89754 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/pagewalk: fix stale walk->action escaping walk_pmd_range()

If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is
retried. The PMD entry may be cleared a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89754/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89754 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/pagewalk: fix stale walk->action escaping walk_pmd_range()

If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is
retried. The PMD entry may be cleared a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89754/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89762 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix cred UAF caused by begin_current_label_crit_section()

AppArmor's begin_current_label_crit_section() is a scary function called
from lots of LSM hooks (in particula...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89762/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89762 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix cred UAF caused by begin_current_label_crit_section()

AppArmor's begin_current_label_crit_section() is a scary function called
from lots of LSM hooks (in particula...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89762/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89761 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix out-of-bounds write when null terminating a label vec

aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE
is passed. If the components are all...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89761/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89761 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix out-of-bounds write when null terminating a label vec

aa_vec_unique() null terminates at vec[n - dups] when VEC_FLAG_TERMINATE
is passed. If the components are all...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89761/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89736 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_audio: Fix use-after-free on sound card disconnect

g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
card teardown and immediately frees the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89736/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89736 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_audio: Fix use-after-free on sound card disconnect

g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
card teardown and immediately frees the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89736/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89685 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix clock domain mismatch in clients_still_reclaiming()

clients_still_reclaiming() computes a deadline from nn->boot_time
(CLOCK_REALTIME, ~1.7 billion) but compares it ag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89685/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89685 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix clock domain mismatch in clients_still_reclaiming()

clients_still_reclaiming() computes a deadline from nn->boot_time
(CLOCK_REALTIME, ~1.7 billion) but compares it ag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89685/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89771 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix subbuf resize race with ring buffer readers

trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and
ring_buffer_read_start(), while it can simu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89771/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89771 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix subbuf resize race with ring buffer readers

trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and
ring_buffer_read_start(), while it can simu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89771/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89767 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix double end_creating() on the casefold-mismatch path

ovl_create_real() releases the new dentry twice when the casefold
consistency check fails. The S_IFDIR branch calls...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89767/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89767 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix double end_creating() on the casefold-mismatch path

ovl_create_real() releases the new dentry twice when the casefold
consistency check fails. The S_IFDIR branch calls...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89767/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89764 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

rust: devres: fix race between concurrent revokers

There is a potential race condition when two paths try to revoke a
Devres concurrently.

The driver core's devres_release_all(...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89764/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89764 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

rust: devres: fix race between concurrent revokers

There is a potential race condition when two paths try to revoke a
Devres concurrently.

The driver core's devres_release_all(...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89764/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89763 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix TPM teardown ordering

trusted_tpm_exit() drops the TPM chip reference and frees the digest
array before unregistering the trusted key type. key_type_lookup()
...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89763/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89763 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix TPM teardown ordering

trusted_tpm_exit() drops the TPM chip reference and frees the digest
array before unregistering the trusted key type. key_type_lookup()
...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89763/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89760 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm, swap: don't free a hibernation slot that is in the swap cache

A slot with a folio in the swap cache is freed when the folio leaves the
cache, not when its count drops. swap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89760/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89760 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm, swap: don't free a hibernation slot that is in the swap cache

A slot with a folio in the swap cache is freed when the folio leaves the
cache, not when its count drops. swap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89760/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89755 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate_device: clear stale mapping after freeing swapcache

__migrate_device_pages() reads the folio mapping before calling
folio_free_swap(). When folio_free_swap() succeed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89755 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/migrate_device: clear stale mapping after freeing swapcache

__migrate_device_pages() reads the folio mapping before calling
folio_free_swap(). When folio_free_swap() succeed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89755/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89748 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix retry exhaustion in simple ring buffer reader swap

simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
post-decrements it only after a failed link ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89748 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix retry exhaustion in simple ring buffer reader swap

simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
post-decrements it only after a failed link ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89747 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(),
which frees every sub-buffer of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89747/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89747 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(),
which frees every sub-buffer of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89747/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89746 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free with same-name named triggers

When two hist triggers on different events are registered with the same
name=, the second one reuses the first as named...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89746/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89746 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free with same-name named triggers

When two hist triggers on different events are registered with the same
name=, the second one reuses the first as named...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89746/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89706 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Reset write verifier when async COPY writeback fails

Async COPY captures nn->writeverf at request time and reports it to
the client via CB_OFFLOAD after the worker kthread...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89706/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89706 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Reset write verifier when async COPY writeback fails

Async COPY captures nn->writeverf at request time and reports it to
the client via CB_OFFLOAD after the worker kthread...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89706/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89704 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: sample writeback error cursor before async COPY loop

_nfsd_copy_file_range() samples dst->f_wb_err into "since"
after the copy loop, then uses it to detect writeback error...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89704 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: sample writeback error cursor before async COPY loop

_nfsd_copy_file_range() samples dst->f_wb_err into "since"
after the copy loop, then uses it to detect writeback error...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89695 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: cap decoded POSIX ACL count to bound sort cost

nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes
it straight to posix_acl_alloc() and sort_pacl_range...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89695/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89695 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: cap decoded POSIX ACL count to bound sort cost

nfsd4_decode_posixacl() reads a u32 entry count off the wire and passes
it straight to posix_acl_alloc() and sort_pacl_range...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89695/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89692 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

nfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit
at entry to serialize recall work, then ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89692/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89692 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear CALLBACK_RUNNING on failed delegation recall queue

nfsd_break_one_deleg() sets NFSD4_CALLBACK_RUNNING via test_and_set_bit
at entry to serialize recall work, then ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89692/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89689 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: don't free session slots that are still in use

nfsd4_sequence() can free the very slot it is currently processing.
When the session shrinker has reduced se_target_maxslots...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89689/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89689 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: don't free session slots that are still in use

nfsd4_sequence() can free the very slot it is currently processing.
When the session shrinker has reduced se_target_maxslots...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89689/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89688 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

In nfs4_preprocess_seqid_op() the stateid is obtained from
nfsd4_lookup_stateid(), which holds a reference o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89688/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89688 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

In nfs4_preprocess_seqid_op() the stateid is obtained from
nfsd4_lookup_stateid(), which holds a reference o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89688/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89687 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file

->atomic_open is permitted to return success without actually opening
the file. It indicates this by calling ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89687/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89687 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file

->atomic_open is permitted to return success without actually opening
the file. It indicates this by calling ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89687/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89686 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding
fi_lock when the parent stateid is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89686 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke

nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding
fi_lock when the parent stateid is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89684 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix cpntf publish race in nfs4_init_cp_state

nfs4_alloc_init_cpntf_state() published the new cpntf entry into the
s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89684/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89684 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix cpntf publish race in nfs4_init_cp_state

nfs4_alloc_init_cpntf_state() published the new cpntf entry into the
s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89684/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89682 - High (8.1)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads
via a per-net freeme queue, preventi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89682/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89682 - High (8.1)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net

nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads
via a per-net freeme queue, preventi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89682/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89613 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

ntfs: reject invalid empty mapping pairs

Reject an attribute with empty mapping pairs if it has inconsistent
highest VCN and size.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89613/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89613 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

ntfs: reject invalid empty mapping pairs

Reject an attribute with empty mapping pairs if it has inconsistent
highest VCN and size.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89613/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-81000: Linux kernel TUN driver HIGH severity vulnerability fixed. Flaw in skb headroom calculation could trigger memory corruption. Update to patched kernel ASAP. 🐧 https://radar.offseq.com/threat/in-the-linux-kernel-the-following-vulnerability-has-been-resolved-net-tun-bound-receive-headroom-683cedae073ef3c4 #OffSeq #Linux #Vulnerability #BlueTeam

CVE-2026-80995: HIGH severity use-after-free in Linux kernel MCTP code lets unprivileged users trigger memory corruption or DoS. Fix: update to patched kernel when released. Details: https://radar.offseq.com/threat/in-the-linux-kernel-the-following-vulnerability-has-been-resolved-net-mctp-hold-a-reference-to-the-146ae7a2eb30ef4b #OffSeq #Linux #Infosec #CVE #Vulnerability

CVE-2026-80980 Linux kernel net/smc bitfield race - killed, freed, out_of_sync share one byte without a common lock, a data race that can corrupt connection state. CVSS N/A, patch status unknown/unpatched. Audit https://www.valtersit.com/cve/CVE-2026-80980/ #CVE #Linux #infosec

🟠 CVE-2026-90678 - High (7.5)

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90678/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90678 - High (7.5)

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90678/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The UnrealIRCd security issue from yesterday was assigned CVE-2026-90668. Admins on older versions could apply a hot-patch to fix the issue without restart.

We have been doing that at UnrealIRCd for more than 20 years now, so I wrote a story on my personal blog about how effective it is, and the times it did not work: https://www.vulnscan.org/why-hot-patching-is-awesome/

#IRC #infosec

🟠 CVE-2026-90668 - High (7.5)

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90668 - High (7.5)

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90493 - High (8.8)

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90493/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Tonec Internet Download Manager <=6.42.63 hit by CRITICAL vuln (CVE-2026-90493) in idmwfp.sys — improper access controls enable local privilege escalation. Public exploit code, no patch yet. Restrict local access & monitor. https://radar.offseq.com/threat/cve-2026-90493-improper-access-controls-in-tonec-internet-download-manager-a788ce95502ef3ad #OffSeq #CVE202690493 #Vuln #Cybersecurity

🟠 CVE-2026-90493 - High (8.8)

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90493/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Tonec Internet Download Manager <=6.42.63 hit by CRITICAL vuln (CVE-2026-90493) in idmwfp.sys — improper access controls enable local privilege escalation. Public exploit code, no patch yet. Restrict local access & monitor. https://radar.offseq.com/threat/cve-2026-90493-improper-access-controls-in-tonec-internet-download-manager-a788ce95502ef3ad #OffSeq #CVE202690493 #Vuln #Cybersecurity

CVE-2026-90648: HIGH severity vuln in wasm2c (WebAssembly wabt <=1.0.41). Unchecked calloc() return enables sandbox escape & code exec if allocation fails — mainly on 32-bit/memory-limited systems. Patch status pending. https://radar.offseq.com/threat/cve-2026-90648-cwe-252-unchecked-return-value-in-webassembly-wabt-365471fbebafc772 #OffSeq #WebAssembly #CVE202690648

CVE-2026-90648: HIGH severity vuln in wasm2c (WebAssembly wabt <=1.0.41). Unchecked calloc() return enables sandbox escape & code exec if allocation fails — mainly on 32-bit/memory-limited systems. Patch status pending. https://radar.offseq.com/threat/cve-2026-90648-cwe-252-unchecked-return-value-in-webassembly-wabt-365471fbebafc772 #OffSeq #WebAssembly #CVE202690648

CVE-2026-90651 | HIGH severity in Socket Socket Firewall <2.0.0: TLS certs not validated by default — MITM risk. Set api_ssl_verify and upstream_ssl_verify to true & patch configs or upgrade to 2.0.0+. https://radar.offseq.com/threat/cve-2026-90651-cwe-295-improper-certificate-validation-in-socket-socket-firewall-a5dfe1c95649d9c6 #OffSeq #vuln #infosec #supplychain

🟠 CVE-2026-90651 - High (8.1)

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90651/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack