🟠 CVE-2026-3544 - High (8.8)

Heap buffer overflow in WebCodecs in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3544 - High (8.8)

Heap buffer overflow in WebCodecs in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-3437 (CRITICAL, CVSS 9.3): Portwell Engineering Toolkits 4.8.2 lets local users escalate privileges or trigger DoS via memory access in driver. No patch yet — restrict local access, audit users, monitor! https://radar.offseq.com/threat/cve-2026-3437-cwe-119-improper-restriction-of-oper-291f400a #OffSeq #Vulnerability #ICS #InfoSec

⚠️ CRITICAL vuln in ePower epower.ie (all versions): Unauthenticated OCPP WebSocket endpoints allow station impersonation & backend manipulation. Privilege escalation risk is HIGH — patch or mitigate now! CVE-2026-22552 https://radar.offseq.com/threat/cve-2026-22552-cwe-306-in-epower-epowerie-1e2e527e #OffSeq #Vulnerability #EVCharging

⚠️ CRITICAL vuln in ePower epower.ie (all versions): Unauthenticated OCPP WebSocket endpoints allow station impersonation & backend manipulation. Privilege escalation risk is HIGH — patch or mitigate now! CVE-2026-22552 https://radar.offseq.com/threat/cve-2026-22552-cwe-306-in-epower-epowerie-1e2e527e #OffSeq #Vulnerability #EVCharging

CISA warns of multiple vulnerabilities in ePower EV charging stations

CISA warns of multiple vulnerabilities in ePower charging stations, including a critical authentication bypass (CVE-2026-22552), that allow unauthenticated attackers to hijack EV infrastructure and disrupt services.

**Make sure your ePower charging station is isolated from the internet and behind a firewall or VPN. Since the vendor has not released a patch that's your only defense until the vendor does something or you replace these systems.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/cisa-warns-of-multiple-vulnerabilities-in-epower-ev-charging-stations-f-j-9-6-s/gD2P6Ple2L

⚠️ CVE-2026-21536 (CRITICAL, CVSS 9.8): RCE in Microsoft Devices Pricing Program via unrestricted file upload (CWE-434). No patch — restrict uploads, monitor endpoints. High risk for enterprise. https://radar.offseq.com/threat/cve-2026-21536-cwe-434-unrestricted-upload-of-file-3dbf1775 #OffSeq #Microsoft #Vuln #RCE

⚠️ CVE-2026-21536 (CRITICAL, CVSS 9.8): RCE in Microsoft Devices Pricing Program via unrestricted file upload (CWE-434). No patch — restrict uploads, monitor endpoints. High risk for enterprise. https://radar.offseq.com/threat/cve-2026-21536-cwe-434-unrestricted-upload-of-file-3dbf1775 #OffSeq #Microsoft #Vuln #RCE

🟠 CVE-2026-29054 - High (7.5)

Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29054/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29054 - High (7.5)

Traefik is an HTTP reverse proxy and load balancer. From version 2.11.9 to 2.11.37 and from version 3.1.3 to 3.6.8, there is a potential vulnerability in Traefik managing the Connection header with X-Forwarded headers. When Traefik processes HTTP/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29054/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26999 - High (7.5)

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadlin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26999 - High (7.5)

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadlin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26999 - High (7.5)

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadlin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26999 - High (7.5)

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadlin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26022 - High (8.7)

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI sche...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26022/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26022 - High (8.7)

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI sche...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26022/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-28474 in OpenClaw nextcloud-talk (pre-2026.2.6) lets attackers bypass allowlists by matching display names. No auth needed — patch now! Details: https://radar.offseq.com/threat/cve-2026-28474-incorrect-authorization-in-openclaw-da9baab9 #OffSeq #Vulnerability #Nextcloud #Security

⚠️ CRITICAL: CVE-2026-28474 in OpenClaw nextcloud-talk (pre-2026.2.6) lets attackers bypass allowlists by matching display names. No auth needed — patch now! Details: https://radar.offseq.com/threat/cve-2026-28474-incorrect-authorization-in-openclaw-da9baab9 #OffSeq #Vulnerability #Nextcloud #Security

🔴 CVE-2026-28289 - Critical (10)

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code E...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-28289 in FreeScout <1.8.207 allows RCE via file upload bypass (zero-width space in .htaccess). Authenticated users can compromise servers. Patch to 1.8.207+ ASAP! https://radar.offseq.com/threat/cve-2026-28289-cwe-434-unrestricted-upload-of-file-e2a6fd58 #OffSeq #FreeScout #Vuln #RCE

🔴 CVE-2026-3545 - Critical (9.6)

Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3545/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3545 - Critical (9.6)

Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3545/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3540 - High (8.8)

Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3540/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3540 - High (8.8)

Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3540/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-28115 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Blind SQL Injection.This issue affects...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28115/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-28115 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Blind SQL Injection.This issue affects...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28115/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24457 - Critical (9.1)

An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24457 - Critical (9.1)

An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3009 - High (8.1)

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3009/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3009 - High (8.1)

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3009/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3459 - High (8.1)

The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3459/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3459 - High (8.1)

The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'dnd_upload_cf7_upload' function in versions up to, and including, 1.3.7.3. This m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3459/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-40931 - Critical (9.1)

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.

Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() functio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-40931 - Critical (9.1)

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.

Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() functio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1605 - High (7.5)

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.

This happens becau...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1605/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-2835 in Cloudflare Pingora enables HTTP request smuggling via improper HTTP/1.0 and Transfer-Encoding handling. Impacts standalone Pingora. Upgrade to v0.8.0+ ASAP! https://radar.offseq.com/threat/cve-2026-2835-cwe-444-inconsistent-interpretation--a3f6db67 #OffSeq #Cloudflare #HTTPsmuggling #infosec

⚠️ CRITICAL: CVE-2026-2833 in Cloudflare Pingora enables HTTP request smuggling — attackers can bypass proxy ACLs/WAFs, poison caches, and hijack sessions. Upgrade to v0.8.0+ or filter Upgrade headers. More info: https://radar.offseq.com/threat/cve-2026-2833-cwe-444-inconsistent-interpretation--c3ebdcf0 #OffSeq #Pingora #Vuln

🟠 CVE-2026-25673 - High (7.5)

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.
`URLField.to_python()` in Django calls `urllib.parse.urlsplit()`, which performs NFKC normalization on Windows that is disproportionately slow for certain Unico...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3047 - High (8.8)

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Sin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3047/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3047 - High (8.8)

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Sin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3047/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:0305] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0305)

CISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2017-7921 (https://secdb.nttzen.cloud/cve/detail/CVE-2017-7921)
- Name: Hikvision Multiple Products Improper Authentication Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Hikvision
- Product: Multiple Products
- Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921

⚠️ CVE-2021-22681 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-22681)
- Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Rockwell
- Product: Multiple Products
- Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

⚠️ CVE-2021-30952 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-30952)
- Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952

⚠️ CVE-2023-41974 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-41974)
- Name: Apple iOS and iPadOS Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: iOS and iPadOS
- Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974

⚠️ CVE-2023-43000 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-43000)
- Name: Apple Multiple products Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260305 #cisa20260305 #cve_2017_7921 #cve_2021_22681 #cve_2021_30952 #cve_2023_41974 #cve_2023_43000 #cve20177921 #cve202122681 #cve202130952 #cve202341974 #cve202343000

CVE ID: CVE-2023-43000
Vendor: Apple
Product: Multiple Products
Date Added: 2026-03-05
Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-43000

CISA Adds Five Known Exploited Vulnerabilities to Catalog
03/05/2026 02:30 PM EST

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability
• CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
• CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
• CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability
• CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability

THREE Apple CVE's added to CISA KEV.

Patch your shit, people.

CISA has updated the KEV catalogue. Apple posted its security advisories yesterday: https://support.apple.com/en-us/100100

- CVE-2023-41974L Apple iOS and iPadOS Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-41974

- CVE-2021-30952L Apple Multiple Products Integer Overflow or Wraparound Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-30952

- CVE-2023-43000: Apple Multiple products Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-43000

Several industrial advisories: https://www.cisa.gov/ #CISA #vulnerability #infosec #Apple

🚨 [CISA-2026:0305] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0305)

CISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2017-7921 (https://secdb.nttzen.cloud/cve/detail/CVE-2017-7921)
- Name: Hikvision Multiple Products Improper Authentication Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Hikvision
- Product: Multiple Products
- Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921

⚠️ CVE-2021-22681 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-22681)
- Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Rockwell
- Product: Multiple Products
- Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

⚠️ CVE-2021-30952 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-30952)
- Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952

⚠️ CVE-2023-41974 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-41974)
- Name: Apple iOS and iPadOS Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: iOS and iPadOS
- Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974

⚠️ CVE-2023-43000 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-43000)
- Name: Apple Multiple products Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260305 #cisa20260305 #cve_2017_7921 #cve_2021_22681 #cve_2021_30952 #cve_2023_41974 #cve_2023_43000 #cve20177921 #cve202122681 #cve202130952 #cve202341974 #cve202343000

CVE ID: CVE-2023-43000
Vendor: Apple
Product: Multiple Products
Date Added: 2026-03-05
Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-43000

CISA Adds Five Known Exploited Vulnerabilities to Catalog
03/05/2026 02:30 PM EST

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability
• CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
• CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
• CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability
• CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability

THREE Apple CVE's added to CISA KEV.

Patch your shit, people.

CISA has updated the KEV catalogue. Apple posted its security advisories yesterday: https://support.apple.com/en-us/100100

- CVE-2023-41974L Apple iOS and iPadOS Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-41974

- CVE-2021-30952L Apple Multiple Products Integer Overflow or Wraparound Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-30952

- CVE-2023-43000: Apple Multiple products Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-43000

Several industrial advisories: https://www.cisa.gov/ #CISA #vulnerability #infosec #Apple

🚨 [CISA-2026:0305] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0305)

CISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2017-7921 (https://secdb.nttzen.cloud/cve/detail/CVE-2017-7921)
- Name: Hikvision Multiple Products Improper Authentication Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Hikvision
- Product: Multiple Products
- Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921

⚠️ CVE-2021-22681 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-22681)
- Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Rockwell
- Product: Multiple Products
- Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

⚠️ CVE-2021-30952 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-30952)
- Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952

⚠️ CVE-2023-41974 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-41974)
- Name: Apple iOS and iPadOS Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: iOS and iPadOS
- Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974

⚠️ CVE-2023-43000 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-43000)
- Name: Apple Multiple products Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260305 #cisa20260305 #cve_2017_7921 #cve_2021_22681 #cve_2021_30952 #cve_2023_41974 #cve_2023_43000 #cve20177921 #cve202122681 #cve202130952 #cve202341974 #cve202343000

CVE ID: CVE-2023-41974
Vendor: Apple
Product: iOS and iPadOS
Date Added: 2026-03-05
Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-41974

CISA Adds Five Known Exploited Vulnerabilities to Catalog
03/05/2026 02:30 PM EST

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability
• CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
• CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
• CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability
• CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability

THREE Apple CVE's added to CISA KEV.

Patch your shit, people.

CISA has updated the KEV catalogue. Apple posted its security advisories yesterday: https://support.apple.com/en-us/100100

- CVE-2023-41974L Apple iOS and iPadOS Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-41974

- CVE-2021-30952L Apple Multiple Products Integer Overflow or Wraparound Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-30952

- CVE-2023-43000: Apple Multiple products Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-43000

Several industrial advisories: https://www.cisa.gov/ #CISA #vulnerability #infosec #Apple

🚨 [CISA-2026:0305] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0305)

CISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2017-7921 (https://secdb.nttzen.cloud/cve/detail/CVE-2017-7921)
- Name: Hikvision Multiple Products Improper Authentication Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Hikvision
- Product: Multiple Products
- Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921

⚠️ CVE-2021-22681 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-22681)
- Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Rockwell
- Product: Multiple Products
- Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

⚠️ CVE-2021-30952 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-30952)
- Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952

⚠️ CVE-2023-41974 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-41974)
- Name: Apple iOS and iPadOS Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: iOS and iPadOS
- Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974

⚠️ CVE-2023-43000 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-43000)
- Name: Apple Multiple products Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260305 #cisa20260305 #cve_2017_7921 #cve_2021_22681 #cve_2021_30952 #cve_2023_41974 #cve_2023_43000 #cve20177921 #cve202122681 #cve202130952 #cve202341974 #cve202343000

CVE ID: CVE-2023-41974
Vendor: Apple
Product: iOS and iPadOS
Date Added: 2026-03-05
Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-41974

CISA Adds Five Known Exploited Vulnerabilities to Catalog
03/05/2026 02:30 PM EST

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability
• CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
• CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
• CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability
• CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability

THREE Apple CVE's added to CISA KEV.

Patch your shit, people.

CISA has updated the KEV catalogue. Apple posted its security advisories yesterday: https://support.apple.com/en-us/100100

- CVE-2023-41974L Apple iOS and iPadOS Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-41974

- CVE-2021-30952L Apple Multiple Products Integer Overflow or Wraparound Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-30952

- CVE-2023-43000: Apple Multiple products Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-43000

Several industrial advisories: https://www.cisa.gov/ #CISA #vulnerability #infosec #Apple

🚨 [CISA-2026:0305] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0305)

CISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2017-7921 (https://secdb.nttzen.cloud/cve/detail/CVE-2017-7921)
- Name: Hikvision Multiple Products Improper Authentication Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Hikvision
- Product: Multiple Products
- Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921

⚠️ CVE-2021-22681 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-22681)
- Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Rockwell
- Product: Multiple Products
- Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

⚠️ CVE-2021-30952 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-30952)
- Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952

⚠️ CVE-2023-41974 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-41974)
- Name: Apple iOS and iPadOS Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: iOS and iPadOS
- Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974

⚠️ CVE-2023-43000 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-43000)
- Name: Apple Multiple products Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260305 #cisa20260305 #cve_2017_7921 #cve_2021_22681 #cve_2021_30952 #cve_2023_41974 #cve_2023_43000 #cve20177921 #cve202122681 #cve202130952 #cve202341974 #cve202343000

CVE ID: CVE-2021-30952
Vendor: Apple
Product: Multiple Products
Date Added: 2026-03-05
Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2021-30952

CISA Adds Five Known Exploited Vulnerabilities to Catalog
03/05/2026 02:30 PM EST

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability
• CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
• CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
• CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability
• CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability

THREE Apple CVE's added to CISA KEV.

Patch your shit, people.

CISA has updated the KEV catalogue. Apple posted its security advisories yesterday: https://support.apple.com/en-us/100100

- CVE-2023-41974L Apple iOS and iPadOS Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-41974

- CVE-2021-30952L Apple Multiple Products Integer Overflow or Wraparound Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-30952

- CVE-2023-43000: Apple Multiple products Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-43000

Several industrial advisories: https://www.cisa.gov/ #CISA #vulnerability #infosec #Apple

🚨 [CISA-2026:0305] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0305)

CISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2017-7921 (https://secdb.nttzen.cloud/cve/detail/CVE-2017-7921)
- Name: Hikvision Multiple Products Improper Authentication Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Hikvision
- Product: Multiple Products
- Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921

⚠️ CVE-2021-22681 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-22681)
- Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Rockwell
- Product: Multiple Products
- Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

⚠️ CVE-2021-30952 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-30952)
- Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952

⚠️ CVE-2023-41974 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-41974)
- Name: Apple iOS and iPadOS Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: iOS and iPadOS
- Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974

⚠️ CVE-2023-43000 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-43000)
- Name: Apple Multiple products Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260305 #cisa20260305 #cve_2017_7921 #cve_2021_22681 #cve_2021_30952 #cve_2023_41974 #cve_2023_43000 #cve20177921 #cve202122681 #cve202130952 #cve202341974 #cve202343000

CVE ID: CVE-2021-30952
Vendor: Apple
Product: Multiple Products
Date Added: 2026-03-05
Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2021-30952

CISA Adds Five Known Exploited Vulnerabilities to Catalog
03/05/2026 02:30 PM EST

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability
• CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
• CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
• CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability
• CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability

THREE Apple CVE's added to CISA KEV.

Patch your shit, people.

CISA has updated the KEV catalogue. Apple posted its security advisories yesterday: https://support.apple.com/en-us/100100

- CVE-2023-41974L Apple iOS and iPadOS Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-41974

- CVE-2021-30952L Apple Multiple Products Integer Overflow or Wraparound Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-30952

- CVE-2023-43000: Apple Multiple products Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-43000

Several industrial advisories: https://www.cisa.gov/ #CISA #vulnerability #infosec #Apple

🚨 [CISA-2026:0305] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0305)

CISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2017-7921 (https://secdb.nttzen.cloud/cve/detail/CVE-2017-7921)
- Name: Hikvision Multiple Products Improper Authentication Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Hikvision
- Product: Multiple Products
- Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921

⚠️ CVE-2021-22681 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-22681)
- Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Rockwell
- Product: Multiple Products
- Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

⚠️ CVE-2021-30952 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-30952)
- Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952

⚠️ CVE-2023-41974 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-41974)
- Name: Apple iOS and iPadOS Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: iOS and iPadOS
- Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974

⚠️ CVE-2023-43000 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-43000)
- Name: Apple Multiple products Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260305 #cisa20260305 #cve_2017_7921 #cve_2021_22681 #cve_2021_30952 #cve_2023_41974 #cve_2023_43000 #cve20177921 #cve202122681 #cve202130952 #cve202341974 #cve202343000

CVE ID: CVE-2021-22681
Vendor: Rockwell
Product: Multiple Products
Date Added: 2026-03-05
Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2021-22681

CISA Adds Five Known Exploited Vulnerabilities to Catalog
03/05/2026 02:30 PM EST

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability
• CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
• CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
• CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability
• CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability

THREE Apple CVE's added to CISA KEV.

Patch your shit, people.

🚨 [CISA-2026:0305] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0305)

CISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2017-7921 (https://secdb.nttzen.cloud/cve/detail/CVE-2017-7921)
- Name: Hikvision Multiple Products Improper Authentication Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Hikvision
- Product: Multiple Products
- Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921

⚠️ CVE-2021-22681 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-22681)
- Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Rockwell
- Product: Multiple Products
- Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

⚠️ CVE-2021-30952 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-30952)
- Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952

⚠️ CVE-2023-41974 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-41974)
- Name: Apple iOS and iPadOS Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: iOS and iPadOS
- Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974

⚠️ CVE-2023-43000 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-43000)
- Name: Apple Multiple products Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260305 #cisa20260305 #cve_2017_7921 #cve_2021_22681 #cve_2021_30952 #cve_2023_41974 #cve_2023_43000 #cve20177921 #cve202122681 #cve202130952 #cve202341974 #cve202343000

CVE ID: CVE-2021-22681
Vendor: Rockwell
Product: Multiple Products
Date Added: 2026-03-05
Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2021-22681

CISA Adds Five Known Exploited Vulnerabilities to Catalog
03/05/2026 02:30 PM EST

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability
• CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
• CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
• CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability
• CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability

THREE Apple CVE's added to CISA KEV.

Patch your shit, people.

🚨 [CISA-2026:0305] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0305)

CISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2017-7921 (https://secdb.nttzen.cloud/cve/detail/CVE-2017-7921)
- Name: Hikvision Multiple Products Improper Authentication Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Hikvision
- Product: Multiple Products
- Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921

⚠️ CVE-2021-22681 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-22681)
- Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Rockwell
- Product: Multiple Products
- Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

⚠️ CVE-2021-30952 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-30952)
- Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952

⚠️ CVE-2023-41974 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-41974)
- Name: Apple iOS and iPadOS Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: iOS and iPadOS
- Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974

⚠️ CVE-2023-43000 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-43000)
- Name: Apple Multiple products Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260305 #cisa20260305 #cve_2017_7921 #cve_2021_22681 #cve_2021_30952 #cve_2023_41974 #cve_2023_43000 #cve20177921 #cve202122681 #cve202130952 #cve202341974 #cve202343000

CVE ID: CVE-2017-7921
Vendor: Hikvision
Product: Multiple Products
Date Added: 2026-03-05
Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2017-7921

CISA Adds Five Known Exploited Vulnerabilities to Catalog
03/05/2026 02:30 PM EST

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability
• CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
• CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
• CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability
• CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability

THREE Apple CVE's added to CISA KEV.

Patch your shit, people.

🚨 [CISA-2026:0305] CISA Adds 5 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0305)

CISA has added 5 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2017-7921 (https://secdb.nttzen.cloud/cve/detail/CVE-2017-7921)
- Name: Hikvision Multiple Products Improper Authentication Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Hikvision
- Product: Multiple Products
- Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921

⚠️ CVE-2021-22681 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-22681)
- Name: Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Rockwell
- Product: Multiple Products
- Notes: https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/~/cve-2021-22681%3A-authentication-bypass-vulnerability-found-in-logix-controllers- ; https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03 ; https://nvd.nist.gov/vuln/detail/CVE-2021-22681

⚠️ CVE-2021-30952 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-30952)
- Name: Apple Multiple Products Integer Overflow or Wraparound Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/HT212975 ; https://support.apple.com/en-us/HT212976 ; https://support.apple.com/en-us/HT212978 ; https://support.apple.com/en-us/HT212980 ; https://support.apple.com/en-us/HT212982 ; https://nvd.nist.gov/vuln/detail/CVE-2021-30952

⚠️ CVE-2023-41974 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-41974)
- Name: Apple iOS and iPadOS Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: iOS and iPadOS
- Notes: https://support.apple.com/en-us/HT213938 ; https://support.apple.com/kb/HT213938 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41974

⚠️ CVE-2023-43000 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-43000)
- Name: Apple Multiple products Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Apple
- Product: Multiple Products
- Notes: https://support.apple.com/en-us/120324 ; https://support.apple.com/en-us/120331 ; https://support.apple.com/en-us/120338 ; https://nvd.nist.gov/vuln/detail/CVE-2023-43000

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260305 #cisa20260305 #cve_2017_7921 #cve_2021_22681 #cve_2021_30952 #cve_2023_41974 #cve_2023_43000 #cve20177921 #cve202122681 #cve202130952 #cve202341974 #cve202343000

CVE ID: CVE-2017-7921
Vendor: Hikvision
Product: Multiple Products
Date Added: 2026-03-05
Notes: https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/ ; https://nvd.nist.gov/vuln/detail/CVE-2017-7921
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2017-7921

CISA Adds Five Known Exploited Vulnerabilities to Catalog
03/05/2026 02:30 PM EST

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

• CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability
• CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability
• CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability
• CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability
• CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability

THREE Apple CVE's added to CISA KEV.

Patch your shit, people.

🟠 New security advisory:

CVE-2026-20101 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://yazoul.net/advisory/cve/cve-2026-20101

#Cybersecurity #SecurityPatching #HackerNews

🟠 CVE-2026-20101 - High (8.6)

A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition.

...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70219 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the goform/formDeviceReboot.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70219/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70219 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the goform/formDeviceReboot.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70219/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 New security advisory:

CVE-2026-20103 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://yazoul.net/advisory/cve/cve-2026-20103

#Cybersecurity #SecurityPatching #HackerNews

🟠 CVE-2026-20103 - High (8.6)

A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20103/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Cisco Issues Emergency Patches for Critical Root-Level Firewall Management Flaws

Cisco patched two critical vulnerabilities (CVE-2026-20079 and CVE-2026-20131) in its Secure Firewall Management Center that allow unauthenticated remote attackers to gain root access and execute arbitrary code.

**If you are using Cisco FMC on premise, this is urgent and important. Make sure the web interface of the FMC is isolated and accessible only from trusted networks. Then apply a very quick patch, since even if isolated, a lot of attackers will be building tools to attack it after they do a successful phishing or endpoint compromise.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/cisco-issues-emergency-patches-for-critical-root-level-firewall-management-flaws-i-7-p-d-v/gD2P6Ple2L

💥 Cisco warns of max severity Secure FMC flaws giving root access

｢ Both vulnerabilities can be exploited remotely by unauthenticated attackers: the authentication bypass flaw (CVE-2026-20079) allows attackers to gain root access to the underlying operating system, while the remote code execution (RCE) vulnerability (CVE-2026-20131) lets them execute arbitrary Java code as root on unpatched devices ｣

#cisco #rce #cybersecurity
https://www.bleepingcomputer.com/news/security/cisco-warns-of-max-severity-secure-fmc-flaws-giving-root-access/

yikes.. 50 CVEs for Cisco today incl. two max severity CVE-2026-20131 & CVE-2026-20079 with auth bypass 🫡

https://hecate.pw/vulnerabilities?search=vendors%3A%22Cisco%22%20AND%20published%3A%3E%3D2026-03-04&mode=dql

🚬

#vulnerability #cve #cisco

🔴 CVE-2026-20131 - Critical (10)

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.

This vulnerability is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20131/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Second is CVE-2026-20131: remote code execution in the same product by way of, aww yiss, Java deserialization.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh

Oops.

A long list of Cisco vulnerabilities, two critical, several high-severity.

- Critical: CVE-2026-20079-CWE-288: Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-onprem-fmc-authbypass-5JPp45V2

- Critical: CVE-2026-20131-CWE-502: Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh

More. Grab a coffee https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #vulnerability #Cisco

@cR0w

🟠 CVE-2026-0847 - High (8.6)

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to prop...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0847/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70223 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70223/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20100 - High (7.7)

A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20100 - High (7.7)

A vulnerability in the LUA interperter of the Remote Access SSL VPN feature of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker with a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-40926 - Critical (9.8)

Plack::Middleware::Session::Simple versions through 0.04 for Perl generates session ids insecurely.

The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40926/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-40926 - Critical (9.8)

Plack::Middleware::Session::Simple versions through 0.04 for Perl generates session ids insecurely.

The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40926/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70222 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70222/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70222 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin,goform/getAuthCode.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70222/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-68553 - Critical (9.9)

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Lendiz lendiz allows Upload a Web Shell to a Web Server.This issue affects Lendiz: from n/a through &lt; 2.0.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-68553/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-68553 - Critical (9.9)

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Lendiz lendiz allows Upload a Web Shell to a Web Server.This issue affects Lendiz: from n/a through &lt; 2.0.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-68553/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-54001 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through &lt;= 2.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-54001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-54001 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through &lt;= 2.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-54001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69340 - High (7.5)

Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Ad...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69340/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69340 - High (7.5)

Missing Authorization vulnerability in BuddhaThemes WeDesignTech Ultimate Booking Addon wedesigntech-ultimate-booking-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Ultimate Booking Ad...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69340/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27803 - High (8.3)

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27803/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27803 - High (8.3)

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27803/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27802 - High (8.3)

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, there is a privilege escalation vulnerability via bulk permission update to unauthorized collections by Manager. Thi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27802/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25921 - Critical (9.3)

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue h...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25921/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25921 - Critical (9.3)

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue h...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25921/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27944 - Critical (9.8)

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response hea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27944/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New.

Tenable research advisories have added critical vulnerability CVE-2026-27944: Nginx UI - Unauthenticated Backup Download with Encryption Key Disclosure https://www.tenable.com/security/research/tra-2026-17 @tenable #infosec #vulnerability

🔴 CVE-2026-27944 - Critical (9.8)

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response hea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27944/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

New.

Tenable research advisories have added critical vulnerability CVE-2026-27944: Nginx UI - Unauthenticated Backup Download with Encryption Key Disclosure https://www.tenable.com/security/research/tra-2026-17 @tenable #infosec #vulnerability

🟠 CVE-2026-28119 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Nirvana nirvana allows PHP Local File Inclusion.This issue affects Nirvana: from n/a through &lt;= 2.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28119 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Nirvana nirvana allows PHP Local File Inclusion.This issue affects Nirvana: from n/a through &lt;= 2.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28124 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Notarius notarius allows PHP Local File Inclusion.This issue affects Notarius: from n/a through &lt;= 1.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28124 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Notarius notarius allows PHP Local File Inclusion.This issue affects Notarius: from n/a through &lt;= 1.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28129 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Little Birdies little-birdies allows PHP Local File Inclusion.This issue affects Little Birdies: from n/a through ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28129/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28129 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Little Birdies little-birdies allows PHP Local File Inclusion.This issue affects Little Birdies: from n/a through ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28129/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28128 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Verse verse allows PHP Local File Inclusion.This issue affects Verse: from n/a through &lt;= 1.7.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28128 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Verse verse allows PHP Local File Inclusion.This issue affects Verse: from n/a through &lt;= 1.7.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28125 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Midi midi allows PHP Local File Inclusion.This issue affects Midi: from n/a through &lt;= 1.14.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28125/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28125 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Midi midi allows PHP Local File Inclusion.This issue affects Midi: from n/a through &lt;= 1.14.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28125/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28134 - High (8.5)

Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through &lt;= 3.7.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28134/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28134 - High (8.5)

Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through &lt;= 3.7.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28134/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1720 - High (8.8)

The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the 'install_and_active_plugin' func...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1720 - High (8.8)

The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the 'install_and_active_plugin' func...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1720/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2599 - Critical (9.8)

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2599/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2599 - Critical (9.8)

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2599/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29053 - High (7.6)

Ghost is a Node.js content management system. From version 0.7.2 to 6.19.0, specifically crafted malicious themes can execute arbitrary code on the server running Ghost. This issue has been patched in version 6.19.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29053/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-1678 - Critical (9.4)

dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1678/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70226 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70226 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formEasySetupWizard.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70225 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70225/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70225 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curtime parameter to the goform/formEasySetupWWConfig component

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70225/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-66944 - Critical (9.8)

SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query parameter in the search API endpoint

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66944/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-66944 - Critical (9.8)

SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query parameter in the search API endpoint

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66944/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70218 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70218 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-46108 - Critical (9.8)

D-link Dir-513 A1FW110 is vulnerable to Buffer Overflow in the function formTcpipSetup.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-46108/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-46108 - Critical (9.8)

D-link Dir-513 A1FW110 is vulnerable to Buffer Overflow in the function formTcpipSetup.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-46108/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70221 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70221/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-70221 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formLogin.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70221/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-69338 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Riode Core riode-core allows Blind SQL Injection.This issue affects Riode Core: from n/a through &lt;= 1.6.26.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69338/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-69338 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Riode Core riode-core allows Blind SQL Injection.This issue affects Riode Core: from n/a through &lt;= 1.6.26.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69338/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-68555 - Critical (9.9)

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Nutrie nutrie allows Upload a Web Shell to a Web Server.This issue affects Nutrie: from n/a through &lt; 2.0.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-68555/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-68555 - Critical (9.9)

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Nutrie nutrie allows Upload a Web Shell to a Web Server.This issue affects Nutrie: from n/a through &lt; 2.0.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-68555/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28117 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes smart SEO smartSEO allows PHP Local File Inclusion.This issue affects smart SEO: from n/a through &lt;= 2.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28117/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28117 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes smart SEO smartSEO allows PHP Local File Inclusion.This issue affects smart SEO: from n/a through &lt;= 2.9.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28117/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22891 - Critical (9.8)

A heap-based buffer overflow vulnerability exists in the Intan CLP parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted Intan CLP file can lead to arbitrary code execution. An attacker can p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26478 - Critical (9.8)

A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a specially crafted UDP datagram and execute arbitrary shell code as the root account.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26478/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26673 - High (7.5)

An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission subsystem

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26673 - High (7.5)

An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission subsystem

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26673/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-27971: QwikDev qwik <1.19.1 has a CRITICAL RCE flaw via unsafe deserialization in server-side RPC. No auth needed — patch to 1.19.1+ now! Exploits are trivial if require() is exposed. https://radar.offseq.com/threat/cve-2026-27971-cwe-502-deserialization-of-untruste-b59de789 #OffSeq #CVE202627971 #RCE #JavaScript #InfoSec

🔴 CVE-2026-24113 - Critical (9.8)

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by controlling the value of `nptr`. When this value is passed into the `getMibPrefix` function and concatenated using `sprintf` without proper size va...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24113/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-59786 - Critical (9.8)

2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web application.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-59786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-59786 - Critical (9.8)

2N Access Commander version 3.4.2 and prior improperly invalidates session tokens, allowing multiple session cookies to remain active after logout in web application.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-59786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69411 - High (7.5)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus allows Path Traversal.This issue affects ionCube tester plus: from n/a through &lt;= 1.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69411 - High (7.5)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Robert Seyfriedsberger ionCube tester plus ioncube-tester-plus allows Path Traversal.This issue affects ionCube tester plus: from n/a through &lt;= 1.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28121 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Anderson andersonclinic allows PHP Local File Inclusion.This issue affects Anderson: from n/a through &lt;= 1.4.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28121/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack