📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

🟠 CVE-2026-32302 - High (8.1)

OpenClaw is a personal AI assistant. Prior to 2026.3.11, browser-originated WebSocket connections could bypass origin validation when gateway.auth.mode was set to trusted-proxy and the request arrived with proxy headers. A page served from an untr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32302/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32306 - Critical (9.9)

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32306/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32308 - High (7.6)

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer component renders Mermaid diagrams with securityLevel: "loose" and injects the SVG output via innerHTML. This configuration explicitly allow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32308/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32304 - Critical (9.8)

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32304/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-32304 in locutusjs (<3.0.14) enables unauthenticated remote code execution via create_function() and unsanitized inputs. Patch to 3.0.14+ now! Full details: https://radar.offseq.com/threat/cve-2026-32304-cwe-94-improper-control-of-generati-7207fd62 #OffSeq #Vuln #JavaScript #Infosec

🟠 CVE-2026-31882 - High (7.5)

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26954 - Critical (10)

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Fu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26954/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 CRITICAL: CVE-2026-26954 in SandboxJS (< 0.8.34) enables sandbox escape via Function & Object.fromEntries. Attackers can run arbitrary code remotely! Upgrade to v0.8.34+ now. Full details: https://radar.offseq.com/threat/cve-2026-26954-cwe-94-improper-control-of-generati-35790079 #OffSeq #CVE202626954 #infosec #sandbox

🟠 CVE-2026-32319 - High (7.5)

Ella Core is a 5G core designed for private networks. Prior to 1.5.1, Ella Core panics when processing a malformed integrity protected NGAP/NAS message with a length under 7 bytes. An attacker able to send crafted NAS messages to Ella Core can cra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32319/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31886 - Critical (9.1)

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any forma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31886/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL vuln: dagu <2.2.4 suffers from path traversal (CVE-2026-31886). Exploit allows deletion of /tmp, causing system-wide DoS. Upgrade to 2.2.4+ or enforce input validation now! https://radar.offseq.com/threat/cve-2026-31886-cwe-22-improper-limitation-of-a-pat-116cb11a #OffSeq #dagu #security #CVE2026_31886

🔴 CVE-2025-62319 - Critical (9.8)

Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the applica...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-62319/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-62319 - Critical (9.8)

Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the applica...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-62319/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4227 - High (8.8)

A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4227/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4227 - High (8.8)

A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4227/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4227 - High (8.8)

A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4227/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4227 - High (8.8)

A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4227/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4226 - High (8.8)

A weakness has been identified in LB-LINK BL-WR9000 2.4.9. The affected element is the function sub_44E8D0 of the file /goform/get_virtual_cfg. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4226 - High (8.8)

A weakness has been identified in LB-LINK BL-WR9000 2.4.9. The affected element is the function sub_44E8D0 of the file /goform/get_virtual_cfg. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4226 - High (8.8)

A weakness has been identified in LB-LINK BL-WR9000 2.4.9. The affected element is the function sub_44E8D0 of the file /goform/get_virtual_cfg. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4226 - High (8.8)

A weakness has been identified in LB-LINK BL-WR9000 2.4.9. The affected element is the function sub_44E8D0 of the file /goform/get_virtual_cfg. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4213 - High (8.8)

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4213 - High (8.8)

A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4211 - High (8.8)

A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4211 - High (8.8)

A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-4206: MEDIUM severity command injection in D-Link DNS-120 NAS (20260205). Remote, unauthenticated exploit possible — PoC public, patch ASAP or restrict access. Monitor for suspicious /cgi-bin/dsk_mgr.cgi activity. https://radar.offseq.com/threat/cve-2026-4206-command-injection-in-d-link-dns-120-65477eea #OffSeq #DLink #Vuln

CVE-2026-4206: MEDIUM severity command injection in D-Link DNS-120 NAS (20260205). Remote, unauthenticated exploit possible — PoC public, patch ASAP or restrict access. Monitor for suspicious /cgi-bin/dsk_mgr.cgi activity. https://radar.offseq.com/threat/cve-2026-4206-command-injection-in-d-link-dns-120-65477eea #OffSeq #DLink #Vuln

🟠 CVE-2026-4212 - High (8.8)

A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-4212 (HIGH, CVSS 8.7): D-Link DNS-120 NAS stack buffer overflow in /cgi-bin/download_mgr.cgi enables remote, unauthenticated compromise. Patch or restrict access now. https://radar.offseq.com/threat/cve-2026-4212-stack-based-buffer-overflow-in-d-lin-423aef88 #OffSeq #Vulnerability #DLink #BlueTeam

🟠 CVE-2026-4212 - High (8.8)

A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-4212 (HIGH, CVSS 8.7): D-Link DNS-120 NAS stack buffer overflow in /cgi-bin/download_mgr.cgi enables remote, unauthenticated compromise. Patch or restrict access now. https://radar.offseq.com/threat/cve-2026-4212-stack-based-buffer-overflow-in-d-lin-423aef88 #OffSeq #Vulnerability #DLink #BlueTeam

CVE-2026-4201 (MEDIUM, CVSS 6.9) in glowxq-oj allows remote, unauthenticated file uploads — risk of code execution. No patch, public exploit exists. Restrict upload access, validate files, monitor closely. https://radar.offseq.com/threat/cve-2026-4201-unrestricted-upload-in-glowxq-glowxq-224c8b75 #OffSeq #Vulnerability #CyberSecurity

CVE-2026-4201 (MEDIUM, CVSS 6.9) in glowxq-oj allows remote, unauthenticated file uploads — risk of code execution. No patch, public exploit exists. Restrict upload access, validate files, monitor closely. https://radar.offseq.com/threat/cve-2026-4201-unrestricted-upload-in-glowxq-glowxq-224c8b75 #OffSeq #Vulnerability #CyberSecurity

⚠️ CRITICAL: CVE-2026-4163 in Wavlink WL-WN579A3 (220323) enables remote unauthenticated command injection via /cgi-bin/wireless.cgi. Exploit is public — restrict remote admin, monitor logs, and patch ASAP. https://radar.offseq.com/threat/cve-2026-4163-command-injection-in-wavlink-wl-wn57-5fa0760b #OffSeq #Vuln #IoTSecurity

🚨 CVE-2026-4163 (CRITICAL): Wavlink WL-WN579A3 routers (v220323) have a command injection bug in /cgi-bin/wireless.cgi. Public exploit code available — restrict remote mgmt, monitor logs, and patch ASAP. https://radar.offseq.com/threat/cve-2026-4163-command-injection-in-wavlink-wl-wn57-5fa0760b #OffSeq #CVE20264163 #infosec #routersecurity

🚨 CRITICAL: CVE-2026-4163 in Wavlink WL-WN579A3 (220323) enables unauthenticated remote command injection via /cgi-bin/wireless.cgi. Exploit code is public — restrict remote admin & monitor traffic until patched! https://radar.offseq.com/threat/cve-2026-4163-command-injection-in-wavlink-wl-wn57-5fa0760b #OffSeq #CVE20264163 #Infosec

⚠️ MEDIUM severity: Tiandy Easy7 Integrated Management Platform 7.17.0 has a missing authentication bug (CVE-2026-4187) in Device Identifier Handler. Public exploit exists. No vendor fix yet — review exposure & restrict access. https://radar.offseq.com/threat/cve-2026-4187-missing-authentication-in-tiandy-eas-d0083b25 #OffSeq #Vuln #Tiandy #Cybersecurity

⚠️ MEDIUM severity: Tiandy Easy7 Integrated Management Platform 7.17.0 has a missing authentication bug (CVE-2026-4187) in Device Identifier Handler. Public exploit exists. No vendor fix yet — review exposure & restrict access. https://radar.offseq.com/threat/cve-2026-4187-missing-authentication-in-tiandy-eas-d0083b25 #OffSeq #Vuln #Tiandy #Cybersecurity

🚩 CVE-2026-4164 (CRITICAL): Wavlink WL-WN578W2 (221110) is vulnerable to remote command injection via POST to /cgi-bin/wireless.cgi. Public exploit is out. Restrict access, monitor logs, and upgrade ASAP. https://radar.offseq.com/threat/cve-2026-4164-command-injection-in-wavlink-wl-wn57-c028dcbd #OffSeq #CVE #RouterSecurity #IoTSecurity

🚨 CVE-2026-4164 (CRITICAL, CVSS 9.3) in Wavlink WL-WN578W2 (v221110): Unauth'd command injection via /cgi-bin/wireless.cgi. Public exploit released. Patch ASAP or restrict access! https://radar.offseq.com/threat/cve-2026-4164-command-injection-in-wavlink-wl-wn57-c028dcbd #OffSeq #CVE #RouterSecurity #Infosec

🚨 CVE-2026-4169: MEDIUM XSS in Tecnick TCExam (v16.0 – 16.6.0). Admins can inject JavaScript via XML export. Patch by upgrading to 16.6.1, restrict admin access, and monitor logs. Details: https://radar.offseq.com/threat/cve-2026-4169-cross-site-scripting-in-tecnick-tcex-fd1ffac8 #OffSeq #XSS #Vulnerability #AppSec

🔒 CVE-2026-31386 (HIGH): All LiteSpeed OpenLiteSpeed/LSWS Enterprise versions are vulnerable to OS command injection by admins. No exploits seen yet, but impact = full system compromise. Tighten admin controls & monitor! https://radar.offseq.com/threat/cve-2026-31386-improper-neutralization-of-special--9aa4ef0e #OffSeq #LiteSpeed #Infosec

🔒 CVE-2026-31386 (HIGH): All LiteSpeed OpenLiteSpeed/LSWS Enterprise versions are vulnerable to OS command injection by admins. No exploits seen yet, but impact = full system compromise. Tighten admin controls & monitor! https://radar.offseq.com/threat/cve-2026-31386-improper-neutralization-of-special--9aa4ef0e #OffSeq #LiteSpeed #Infosec

🚨 CVE-2026-1947: HIGH severity in NEX-Forms – Ultimate Forms Plugin for WordPress (all versions ≤9.1.9). Unauthenticated attackers can overwrite form entries via IDOR. Disable plugin or restrict access ASAP! https://radar.offseq.com/threat/cve-2026-1947-cwe-639-authorization-bypass-through-412339ff #OffSeq #WordPress #Vuln #InfoSec

🚨 CVE-2026-1947: HIGH severity in NEX-Forms – Ultimate Forms Plugin for WordPress (all versions ≤9.1.9). Unauthenticated attackers can overwrite form entries via IDOR. Disable plugin or restrict access ASAP! https://radar.offseq.com/threat/cve-2026-1947-cwe-639-authorization-bypass-through-412339ff #OffSeq #WordPress #Vuln #InfoSec

🔥 CVE-2026-1947 (HIGH, CVSS 7.5): NEX-Forms – Ultimate Forms Plugin for WordPress allows unauthenticated IDOR, enabling arbitrary form entry overwrite. No patch released. Disable plugin or restrict access ASAP. Details: https://radar.offseq.com/threat/cve-2026-1947-cwe-639-authorization-bypass-through-412339ff #OffSeq #WordPress #Vuln

🛡️ CVE-2026-3227: HIGH severity OS command injection in TP-Link TL-WR802N v4, TL-WR841N v14, TL-WR840N v6. Authenticated attackers can gain root via crafted config imports. No patch yet — restrict access & monitor uploads! https://radar.offseq.com/threat/cve-2026-3227-cwe-78-improper-neutralization-of-sp-ac440341 #OffSeq #TPLink #Vuln

🟠 CVE-2025-13779 - High (8.3)

Missing authentication for critical function vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13779/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0955 - High (7.8)

There is a memory corruption vulnerability due to an out-of-bounds read when loading a corrupted file in Digilent DASYLab.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0955/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22193 - High (8.1)

wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscrip...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22193/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-22193 in wpDiscuz <7.6.47 enables unauthenticated remote SQL injection. Attackers can access sensitive DB data. Patch ASAP or apply mitigations (WAF, access controls, log monitoring)! https://radar.offseq.com/threat/cve-2026-22193-improper-neutralization-of-special--3f166beb #OffSeq #WordPress #SQLInjection

🔴 CVE-2026-25823 - Critical (9.8)

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have a stack buffer overflow that leads to a Denial of Service, which can also be exploited to achieve Unauth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25823/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2890 - High (7.5)

The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2890/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31922 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Fox LMS fox-lms allows Blind SQL Injection.This issue affects Fox LMS: from n/a through &lt;= 1.0.6.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31922/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32301 - Critical (9.3)

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32301/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-32301: Centrifugo < 6.7.0 has a CRITICAL SSRF flaw — unauthenticated attackers can force outbound requests via dynamic JWKS URLs (e.g., using {{tenant}}). Upgrade ASAP & lock down configs! https://radar.offseq.com/threat/cve-2026-32301-cwe-918-server-side-request-forgery-6022b45c #OffSeq #SSRF #Centrifugo #Vuln

⚠️ CRITICAL: CVE-2026-32746 in GNU inetutils telnetd (<=2.7) enables remote buffer overflow — unauthenticated code execution or DoS possible. Disable telnet, restrict access, monitor for threats. No patch yet! https://radar.offseq.com/threat/cve-2026-32746-cwe-120-buffer-copy-without-checkin-0ceead78 #OffSeq #CVE202632746 #infosec

🔴 CVE-2026-32746 - Critical (9.8)

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32746/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32746 - Critical (9.8)

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32746/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32368 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight Geo to Lat geo-to-lat allows Blind SQL Injection.This issue affects Geo to Lat: from n/a through &lt;= 1.0.19.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32368/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32368 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight Geo to Lat geo-to-lat allows Blind SQL Injection.This issue affects Geo to Lat: from n/a through &lt;= 1.0.19.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32368/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32358 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injection.This issue affects Booking Calendar: from n/a through &lt;= 10.14.15.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32358/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32399 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a thr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3045 - High (7.5)

The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3045/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3045 - High (7.5)

The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3045/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32597 - High (7.5)

PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understan...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32597/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4181 - Critical (9.8)

A security flaw has been discovered in D-Link DIR-816 1.10CNB05. This affects an unknown function of the file /goform/form2RepeaterStep2.cgi of the component goahead. The manipulation of the argument key1/key2/key3/key4/pskValue results in stack-b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4181/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4181 - Critical (9.8)

A security flaw has been discovered in D-Link DIR-816 1.10CNB05. This affects an unknown function of the file /goform/form2RepeaterStep2.cgi of the component goahead. The manipulation of the argument key1/key2/key3/key4/pskValue results in stack-b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4181/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4181 - Critical (9.8)

A security flaw has been discovered in D-Link DIR-816 1.10CNB05. This affects an unknown function of the file /goform/form2RepeaterStep2.cgi of the component goahead. The manipulation of the argument key1/key2/key3/key4/pskValue results in stack-b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4181/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4181 - Critical (9.8)

A security flaw has been discovered in D-Link DIR-816 1.10CNB05. This affects an unknown function of the file /goform/form2RepeaterStep2.cgi of the component goahead. The manipulation of the argument key1/key2/key3/key4/pskValue results in stack-b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4181/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4183 - Critical (9.8)

A security vulnerability has been detected in D-Link DIR-816 1.10CNB05. Affected is an unknown function of the file /goform/form2WlanBasicSetup.cgi of the component goahead. Such manipulation of the argument pskValue leads to stack-based buffer ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4183/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4183 - Critical (9.8)

A security vulnerability has been detected in D-Link DIR-816 1.10CNB05. Affected is an unknown function of the file /goform/form2WlanBasicSetup.cgi of the component goahead. Such manipulation of the argument pskValue leads to stack-based buffer ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4183/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 CVE-2026-4183 (CRITICAL, CVSS 9.3): D-Link DIR-816 (v1.10CNB05) stack buffer overflow via /goform/form2WlanBasicSetup.cgi. Exploit code public, no patch. Replace or isolate devices ASAP! https://radar.offseq.com/threat/cve-2026-4183-stack-based-buffer-overflow-in-d-lin-2982ced2 #OffSeq #CVE20264183 #IoTSecurity

🔴 CVE-2026-4183 - Critical (9.8)

A security vulnerability has been detected in D-Link DIR-816 1.10CNB05. Affected is an unknown function of the file /goform/form2WlanBasicSetup.cgi of the component goahead. Such manipulation of the argument pskValue leads to stack-based buffer ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4183/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4183 - Critical (9.8)

A security vulnerability has been detected in D-Link DIR-816 1.10CNB05. Affected is an unknown function of the file /goform/form2WlanBasicSetup.cgi of the component goahead. Such manipulation of the argument pskValue leads to stack-based buffer ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4183/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 CVE-2026-4183 (CRITICAL, CVSS 9.3): D-Link DIR-816 (v1.10CNB05) stack buffer overflow via /goform/form2WlanBasicSetup.cgi. Exploit code public, no patch. Replace or isolate devices ASAP! https://radar.offseq.com/threat/cve-2026-4183-stack-based-buffer-overflow-in-d-lin-2982ced2 #OffSeq #CVE20264183 #IoTSecurity

🟠 CVE-2026-4188 - High (8.8)

A security flaw has been discovered in D-Link DIR-619L 2.06B01. The affected element is the function formSchedule of the file /goform/formSchedule of the component boa. Performing a manipulation of the argument curTime results in stack-based buffe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4188/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4188 - High (8.8)

A security flaw has been discovered in D-Link DIR-619L 2.06B01. The affected element is the function formSchedule of the file /goform/formSchedule of the component boa. Performing a manipulation of the argument curTime results in stack-based buffe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4188/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-4188: HIGH severity stack-based buffer overflow in D-Link DIR-619L (2.06B01). Allows remote, unauthenticated RCE. Device is unsupported — replace or strictly isolate! Exploit is public. More: https://radar.offseq.com/threat/cve-2026-4188-stack-based-buffer-overflow-in-d-lin-4643e6f2 #OffSeq #Vuln #DLink #InfoSec

🟠 CVE-2026-4188 - High (8.8)

A security flaw has been discovered in D-Link DIR-619L 2.06B01. The affected element is the function formSchedule of the file /goform/formSchedule of the component boa. Performing a manipulation of the argument curTime results in stack-based buffe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4188/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4188 - High (8.8)

A security flaw has been discovered in D-Link DIR-619L 2.06B01. The affected element is the function formSchedule of the file /goform/formSchedule of the component boa. Performing a manipulation of the argument curTime results in stack-based buffe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4188/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-4188: HIGH severity stack-based buffer overflow in D-Link DIR-619L (2.06B01). Allows remote, unauthenticated RCE. Device is unsupported — replace or strictly isolate! Exploit is public. More: https://radar.offseq.com/threat/cve-2026-4188-stack-based-buffer-overflow-in-d-lin-4643e6f2 #OffSeq #Vuln #DLink #InfoSec

🟠 CVE-2026-4167 - High (8.8)

A vulnerability was determined in Belkin F9K1122 1.00.33. This affects the function formReboot of the file /goform/formReboot. This manipulation of the argument webpage causes stack-based buffer overflow. The attack may be initiated remotely. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH-severity: CVE-2026-4167 stack overflow in Belkin F9K1122 v1.00.33. Remote attackers can exploit /goform/formReboot — no patch, public exploit out. Restrict access, monitor for attack attempts. https://radar.offseq.com/threat/cve-2026-4167-stack-based-buffer-overflow-in-belki-ac4818a6 #OffSeq #CVE20264167 #IoTSecurity

🟠 CVE-2026-4167 - High (8.8)

A vulnerability was determined in Belkin F9K1122 1.00.33. This affects the function formReboot of the file /goform/formReboot. This manipulation of the argument webpage causes stack-based buffer overflow. The attack may be initiated remotely. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH-severity: CVE-2026-4167 stack overflow in Belkin F9K1122 v1.00.33. Remote attackers can exploit /goform/formReboot — no patch, public exploit out. Restrict access, monitor for attack attempts. https://radar.offseq.com/threat/cve-2026-4167-stack-based-buffer-overflow-in-belki-ac4818a6 #OffSeq #CVE20264167 #IoTSecurity

🚨 HIGH severity: CVE-2026-4167 in Belkin F9K1122 (1.00.33) enables remote code execution via stack buffer overflow — no auth needed, no patch. Isolate, restrict, and monitor now! https://radar.offseq.com/threat/cve-2026-4167-stack-based-buffer-overflow-in-belki-ac4818a6 #OffSeq #infosec #routersecurity #CVE20264167

🔴 CVE-2026-4184 - Critical (9.8)

A vulnerability was detected in D-Link DIR-816 1.10CNB05. Affected by this vulnerability is an unknown functionality of the file /goform/form2Wl5BasicSetup.cgi of the component goahead. Performing a manipulation of the argument pskValue results in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4184/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: D-Link DIR-816 (1.10CNB05) stack-based buffer overflow via pskValue in /goform/form2Wl5BasicSetup.cgi. Exploit is public, remote code execution possible. Device is EOL — isolate or replace! CVE-2026-4184 https://radar.offseq.com/threat/cve-2026-4184-stack-based-buffer-overflow-in-d-lin-8b4d54d9 #OffSeq #DLink #Vuln

🔴 CVE-2026-4184 - Critical (9.8)

A vulnerability was detected in D-Link DIR-816 1.10CNB05. Affected by this vulnerability is an unknown functionality of the file /goform/form2Wl5BasicSetup.cgi of the component goahead. Performing a manipulation of the argument pskValue results in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4184/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: D-Link DIR-816 (1.10CNB05) stack-based buffer overflow via pskValue in /goform/form2Wl5BasicSetup.cgi. Exploit is public, remote code execution possible. Device is EOL — isolate or replace! CVE-2026-4184 https://radar.offseq.com/threat/cve-2026-4184-stack-based-buffer-overflow-in-d-lin-8b4d54d9 #OffSeq #DLink #Vuln

🔴 CVE-2026-4182 - Critical (9.8)

A weakness has been identified in D-Link DIR-816 1.10CNB05. This impacts an unknown function of the file /goform/form2Wl5RepeaterStep2.cgi of the component goahead. This manipulation of the argument key1/key2/key3/key4/pskValue causes stack-based ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4182/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-4182 in D-Link DIR-816 (v1.10CNB05) — stack buffer overflow in /goform/form2Wl5RepeaterStep2.cgi enables remote code execution. No patch, public exploit exists. Replace or isolate devices now! https://radar.offseq.com/threat/cve-2026-4182-stack-based-buffer-overflow-in-d-lin-4b5e9537 #OffSeq #DLink #IoTSecurity

🔴 CVE-2026-4182 - Critical (9.8)

A weakness has been identified in D-Link DIR-816 1.10CNB05. This impacts an unknown function of the file /goform/form2Wl5RepeaterStep2.cgi of the component goahead. This manipulation of the argument key1/key2/key3/key4/pskValue causes stack-based ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4182/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-4182 in D-Link DIR-816 (v1.10CNB05) — stack buffer overflow in /goform/form2Wl5RepeaterStep2.cgi enables remote code execution. No patch, public exploit exists. Replace or isolate devices now! https://radar.offseq.com/threat/cve-2026-4182-stack-based-buffer-overflow-in-d-lin-4b5e9537 #OffSeq #DLink #IoTSecurity

🟠 CVE-2026-4214 - High (8.8)

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 202602...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4214 - High (8.8)

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 202602...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4214 - High (8.8)

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 202602...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4214 - High (8.8)

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 202602...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ HIGH severity alert: CVE-2026-4255 in TR-VISION HOME (≤2.0.5) enables DLL hijacking; local attackers can escalate privileges via side-loading. Restrict write access & monitor for rogue DLLs. https://radar.offseq.com/threat/cve-2026-4255-cwe-829-inclusion-of-functionality-f-64ab002d #OffSeq #Infosec #CVE20264255 #Windows

🛡️ HIGH severity alert: CVE-2026-4255 in TR-VISION HOME (≤2.0.5) enables DLL hijacking; local attackers can escalate privileges via side-loading. Restrict write access & monitor for rogue DLLs. https://radar.offseq.com/threat/cve-2026-4255-cwe-829-inclusion-of-functionality-f-64ab002d #OffSeq #Infosec #CVE20264255 #Windows

🚩 HIGH severity: CVE-2026-4172 in TRENDnet TEW-632BRP (v1.010B32) — stack-based buffer overflow in /ping_response.cgi (ping_ipaddr). Public exploit, no patch. Isolate, restrict access, and monitor now! https://radar.offseq.com/threat/cve-2026-4172-stack-based-buffer-overflow-in-trend-df028a4c #OffSeq #Infosec #RouterVuln

🔴 CRITICAL: CVE-2026-4170 in Topsec TopACM 3.0 enables unauthenticated OS command injection via 'template_path' in /nmc_sync.php. No patch, public exploit out. Restrict access, deploy WAF/IDS, monitor logs urgently! https://radar.offseq.com/threat/cve-2026-4170-os-command-injection-in-topsec-topac-9e1efe11 #OffSeq #vuln #cybersecurity

CVE-2026-32720 (HIGH): ctfer-io monitoring <0.2.1 has improper access control, allowing lateral movement across Kubernetes namespaces — risks sensitive logs/metrics. Patch to 0.2.1+ ASAP! 🔒 https://radar.offseq.com/threat/cve-2026-32720-cwe-284-improper-access-control-in--c14eb5d2 #OffSeq #Kubernetes #CVE #CloudSecurity

🟠 CVE-2026-26794 - High (8.8)

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26794/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

🔴 CVE-2026-26792 - Critical (9.8)

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26792/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE ID: CVE-2025-47813
Vendor: Wing FTP Server
Product: Wing FTP Server
Date Added: 2026-03-16
Notes: https://www.wftpserver.com/serverhistory.htm ; https://nvd.nist.gov/vuln/detail/CVE-2025-47813
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-47813

CISA has updated the KEV catalogue.

- CVE-2025-47813: Wing FTP Server Information Disclosure Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-47813 #CISA #infosec #vulnerability

CVE ID: CVE-2025-47813
Vendor: Wing FTP Server
Product: Wing FTP Server
Date Added: 2026-03-16
Notes: https://www.wftpserver.com/serverhistory.htm ; https://nvd.nist.gov/vuln/detail/CVE-2025-47813
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-47813

CISA has updated the KEV catalogue.

- CVE-2025-47813: Wing FTP Server Information Disclosure Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-47813 #CISA #infosec #vulnerability

Google Chrome: Zero-Day Exploits 2 und 3 (2026)

Dritter Monat, dritte bereits angegriffene Zero-Day Schwachstelle in Chrome. Wenn wir das extrapolieren, müssten in diesem Jahr zwölf solcher Fälle auftreten. - Google hat gerade Notfall-Updates für Chrome veröffentlicht und das NIST hat die US-Behörden angewiesen, die Updates bis spätestens zum 27. März zu installieren. Beide Sicherheitslücken können bereits beim Besuch einer präparierten Website eine Infektion auslösen, die schlimmstenfalls zu einer vollständigen Übernahme des Systems durch den Angreifer führt.

Die Lücke CVE-2026-3909 steckt in der Grafik-Komponente von Chrome. Deshalb betrifft sie Chrome auf sämtlichen

https://www.pc-fluesterer.info/wordpress/2026/03/16/google-chrome-zero-day-exploits-2-und-3-2026/

#Empfehlung #Warnung #0day #browser #chrome #exploits #google #sicherheit #zeroday

Google Reports Chrome Zero-Day Vulnerabilities Exploited in the Wild

Google reports two actively exploited zero-day vulnerabilities (CVE-2026-3909 and CVE-2026-3910). One is patched and for the other patch is coming in a future release.

**Another urgent patch for Chrome - Google is patching an actively exploited flaw in Chrome. DONT DELAY! Update all your Chrome and Chromium browsers (Edge, Opera, Brave, Vivaldi...). Updating the browser is easy, all your tabs reopen after the patch.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/google-reports-chrome-zero-day-vulnerabilities-exploited-in-the-wild-u-9-s-o-5/gD2P6Ple2L

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

CISA still lists CVE-2026-3909 as a zero-day, even if Google removed it from its Chrome patch notes

So I presume it's still a zero-day, but patches are coming next week... instead of not being a zero-day in the first place

https://www.cisa.gov/news-events/alerts/2026/03/13/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html

Google Reports Chrome Zero-Day Vulnerabilities Exploited in the Wild

Google reports two actively exploited zero-day vulnerabilities (CVE-2026-3909 and CVE-2026-3910). One is patched and for the other patch is coming in a future release.

**Another urgent patch for Chrome - Google is patching an actively exploited flaw in Chrome. DONT DELAY! Update all your Chrome and Chromium browsers (Edge, Opera, Brave, Vivaldi...). Updating the browser is easy, all your tabs reopen after the patch.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/google-reports-chrome-zero-day-vulnerabilities-exploited-in-the-wild-u-9-s-o-5/gD2P6Ple2L

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

CISA still lists CVE-2026-3909 as a zero-day, even if Google removed it from its Chrome patch notes

So I presume it's still a zero-day, but patches are coming next week... instead of not being a zero-day in the first place

https://www.cisa.gov/news-events/alerts/2026/03/13/cisa-adds-two-known-exploited-vulnerabilities-catalog

https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html

Trivalent 146.0.7680.80 released: github.com/secureblue/T... CVE-2026-3909 was originally marked by Google as fixed in the previous upstream release. They have since revised those release notes and released for a third time this week, this time actually containing the fix for CVE-2026-3909.

Release 146.0.7680.80-443379 ·...

@vivaldiversiontracker This includes security fixes for CVE-2026-3909 & CVE-2026-3910 from Chromium 146.0.7680.80.

@browserversiontracker For the curious, this includes security fixes for CVE-2026-3909 & CVE-2026-3910 from Chromium 146.0.7680.80.

And yes, we somehow beat the Chrome team getting this out even though they did the fix. 😂

🟠 CVE-2026-3909 - High (8.8)

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3909/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:0313] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0313)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-3909 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- Name: Google Skia Out-of-Bounds Write Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Google
- Product: Skia
- Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html#:~:text=Google%20is%20aware ; https://nvd.nist.gov/vuln/detail/CVE-2026-3909

⚠️ CVE-2026-3910 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- Name: Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Google
- Product: Chromium V8
- Notes: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-3910

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260313 #cisa20260313 #cve_2026_3909 #cve_2026_3910 #cve20263909 #cve20263910

CVE ID: CVE-2026-3909
Vendor: Google
Product: Skia
Date Added: 2026-03-13
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html#:~:text=Google%20is%20aware ; https://nvd.nist.gov/vuln/detail/CVE-2026-3909
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-3909

CISA has updated the KEV catalogue.

- CVE-2026-3909: Google Skia Out-of-Bounds Write Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-3909

- CVE-2026-3910: Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-3910 #CISA #Google #infosec #vulnerability

Trivalent 145.0.7632.75-442755 released: github.com/secureblue/T... Google is aware that exploits for both CVE-2026-3909 & CVE-2026-3910 exist in the wild.

Release 146.0.7680.75-443342 ·...

🔴 CVE-2025-70245 - Critical (9.8)

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizardSelectMode.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70245/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

🔴 CVE-2026-26791 - Critical (9.8)

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26791/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26791 - Critical (9.8)

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26791/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

🔴 CVE-2026-26795 - Critical (9.8)

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26795/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-26795 - Critical (9.8)

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26795/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-66956 - Critical (9.9)

Insecure Access Control in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote attackers to access and execute attachments via a computable URL.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66956/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Google Reports Chrome Zero-Day Vulnerabilities Exploited in the Wild

Google reports two actively exploited zero-day vulnerabilities (CVE-2026-3909 and CVE-2026-3910). One is patched and for the other patch is coming in a future release.

**Another urgent patch for Chrome - Google is patching an actively exploited flaw in Chrome. DONT DELAY! Update all your Chrome and Chromium browsers (Edge, Opera, Brave, Vivaldi...). Updating the browser is easy, all your tabs reopen after the patch.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/google-reports-chrome-zero-day-vulnerabilities-exploited-in-the-wild-u-9-s-o-5/gD2P6Ple2L

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

Google Reports Chrome Zero-Day Vulnerabilities Exploited in the Wild

Google reports two actively exploited zero-day vulnerabilities (CVE-2026-3909 and CVE-2026-3910). One is patched and for the other patch is coming in a future release.

**Another urgent patch for Chrome - Google is patching an actively exploited flaw in Chrome. DONT DELAY! Update all your Chrome and Chromium browsers (Edge, Opera, Brave, Vivaldi...). Updating the browser is easy, all your tabs reopen after the patch.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/google-reports-chrome-zero-day-vulnerabilities-exploited-in-the-wild-u-9-s-o-5/gD2P6Ple2L

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39

Top EPSS Score:
- CVE-2025-14558 - 39.97 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558)
- CVE-2026-3909 - 27.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- CVE-2026-3910 - 21.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- CVE-2026-2413 - 11.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413)
- CVE-2026-26130 - 1.27 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26130)
- CVE-2026-4092 - 1.01 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-4092)
- CVE-2026-26791 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26791)
- CVE-2026-26792 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26792)
- CVE-2026-26793 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26793)
- CVE-2026-26795 - 0.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-26795)

@vivaldiversiontracker This includes security fixes for CVE-2026-3909 & CVE-2026-3910 from Chromium 146.0.7680.80.

@browserversiontracker For the curious, this includes security fixes for CVE-2026-3909 & CVE-2026-3910 from Chromium 146.0.7680.80.

And yes, we somehow beat the Chrome team getting this out even though they did the fix. 😂

🟠 CVE-2026-3910 - High (8.8)

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3910/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:0313] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0313)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-3909 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3909)
- Name: Google Skia Out-of-Bounds Write Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Google
- Product: Skia
- Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html#:~:text=Google%20is%20aware ; https://nvd.nist.gov/vuln/detail/CVE-2026-3909

⚠️ CVE-2026-3910 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-3910)
- Name: Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Google
- Product: Chromium V8
- Notes: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-3910

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260313 #cisa20260313 #cve_2026_3909 #cve_2026_3910 #cve20263909 #cve20263910

CVE ID: CVE-2026-3910
Vendor: Google
Product: Chromium V8
Date Added: 2026-03-13
Notes: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-3910
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-3910

CISA has updated the KEV catalogue.

- CVE-2026-3909: Google Skia Out-of-Bounds Write Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-3909

- CVE-2026-3910: Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-3910 #CISA #Google #infosec #vulnerability

Trivalent 145.0.7632.75-442755 released: github.com/secureblue/T... Google is aware that exploits for both CVE-2026-3909 & CVE-2026-3910 exist in the wild.

Release 146.0.7680.75-443342 ·...

🔴 CVE-2026-3891 - Critical (9.8)

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3891 - Critical (9.8)

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-3891 (CRITICAL, CVSS 9.8): Pix for WooCommerce plugin allows unauthenticated file uploads via missing checks, risking RCE. Disable/uninstall or apply mitigations now. Affects all versions. Full details: https://radar.offseq.com/threat/cve-2026-3891-cwe-434-unrestricted-upload-of-file--f5fb3cc6 #OffSeq #WordPress #WooCommerce #Vuln

🟠 CVE-2026-32458 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through &lt;= 1.0.8.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32458/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32426 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Medilazar Core medilazar-core allows PHP Local File Inclusion.This issue affects Medilazar Core: from n/a through &...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32426 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Medilazar Core medilazar-core allows PHP Local File Inclusion.This issue affects Medilazar Core: from n/a through &...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32426 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Medilazar Core medilazar-core allows PHP Local File Inclusion.This issue affects Medilazar Core: from n/a through &...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32422 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through &lt;= 5.8.13.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32422 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through &lt;= 5.8.13.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32422 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through &lt;= 5.8.13.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32418 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordy Meow Meow Gallery meow-gallery allows Blind SQL Injection.This issue affects Meow Gallery: from n/a through &lt;= 5.4.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32433 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-with-paypal allows Blind SQL Injection.This issue affects CP Contact Form with Paypal: fro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32433/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32459 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through &lt;= 2.2.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32459/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4111 - High (7.5)

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4111/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32366 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Categories collapsing-categories allows Blind SQL Injection.This issue affects Collapsing Categories: from n/a through &lt;= ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32400 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemetechMount Boldman boldman allows PHP Local File Inclusion.This issue affects Boldman: from n/a through &lt;= 7.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32400/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22202 - High (8.1)

wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GET request with a valid HMAC key. Attackers can embed the deletecomme...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22202/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25818 - Critical (9.1)

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for authentication cookies, allowing an attacker with a stolen session cookie to find the u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25818/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31917 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP erp allows SQL Injection.This issue affects WP ERP: from n/a through &lt;= 1.16.10.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31917/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0957 - High (7.8)

There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted file in Digilent DASYLab.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0957/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0956 - High (7.8)

There is a memory corruption vulnerability due to an out-of-bounds read when loading a corrupted file in Digilent DASYLab.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0956/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0954 - High (7.8)

There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted DSB file in Digilent DASYLab.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0954/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22182 - High (7.5)

wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22182/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25817 - High (8.8)

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have improper neutralization of special elements used in an OS command allowing remote code execution by atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25817/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25819 - High (7.5)

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 allows unauthenticated attackers to cause a Denial of Service by using a specially crafted HTTP request that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25819/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13777 - High (8.3)

Authentication bypass by capture-replay vulnerability in ABB AWIN GW100 rev.2, ABB AWIN GW120.This issue affects AWIN GW100 rev.2: 2.0-0, 2.0-1; AWIN GW120: 1.2-0, 1.2-1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13777/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-32621 in @Apollo federation-internals enables prototype pollution — risking code execution & data compromise. Affects versions <2.9.6, <2.10.5, <2.11.6, <2.12.3, <2.13.2. Patch now! https://radar.offseq.com/threat/cve-2026-32621-cwe-1321-improperly-controlled-modi-1de28d7f #OffSeq #CVE202632621 #GraphQL #Security

Microsoft Authenticator potrebbe divulgare i codici di accesso: se lo stai usando, aggiorna subito l'app

Una vulnerabilità in Microsoft Authenticator per iOS e Android ( CVE-2026-26123 ) potrebbe far trapelare i codici di accesso monouso o i deep link di autenticazione a un'app dannosa sullo stesso dispositivo.

https://www.malwarebytes.com/blog/news/2026/03/microsoft-authenticator-could-leak-login-codes-update-your-app-now

@informatica

🟠 CVE-2026-2229 - High (7.5)

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2229/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32133 - Critical (9.1)

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 6.1.0, a blind SSRF vulnerability exists in 2FAuth that allows authenticated users to make arbitrary HTTP requests from the server t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32133/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1528 - High (7.5)

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patche...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1528/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1526 - High (7.5)

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses inco...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1526/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32260 - High (8.1)

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerability exists in Deno's node:child_process polyfill (shell: true mode) that bypasses the fix for CVE-2026-27190. The two-stage argument san...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32260/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32141 - High (7.5)

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve circular references in deserialized JSON. When given a crafted payload with deeply nested or self-referential $ indices, the r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-28792 - Critical (9.6)

Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS configuration (Access-Control-Allow-Origin: *) with the path traversal vulnerability (previously reported) to enable a browser-bas...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28792/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31899 - High (7.5)

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31899/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3914 - High (8.8)

Integer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3913 - High (8.8)

Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3913/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Google Patches Critical WebML Vulnerability and 28 Other Flaws in Chrome 146

Google released Chrome 146 to patch 29 vulnerabilities, including a critical heap memory flaw in the WebML component (CVE-2026-3913) that allows remote code execution via malicious web pages.

**If you are using Google Chrome or other Chromium-based browsers (Edge, Brave, Vivaldi, Opera...) patch your browser ASAP. Google wouldn't push a new update so soon unless it's serious. Even if you want to debate the severity scoring, it's better to just update. Because while you debate, hackers will find a way to exploit them.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/google-patches-critical-webml-vulnerability-and-28-other-flaws-in-chrome-146-u-5-m-9-g/gD2P6Ple2L

🟠 CVE-2026-3931 - High (8.8)

Heap buffer overflow in Skia in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32137 - High (8.8)

Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32137/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-03-09 - 2026-03-16)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1301

Severity:
- Critical: 114
- High: 499
- Medium: 548
- Low: 44
- None: 96

Status:
- : 27
- Analyzed: 466
- Awaiting Analysis: 494
- Modified: 13
- Received: 245
- Rejected: 5
- Undergoing Analysis: 51

Top CNAs:
- GitHub, Inc.: 312
- Patchstack: 140
- VulDB: 88
- VulnCheck: 88
- Adobe Systems Incorporated: 85
- Microsoft Corporation: 78
- MITRE: 76
- Wordfence: 44
- Chrome: 31
- N/A: 27

Top Affected Products:
- UNKNOWN: 755
- Microsoft Windows 10 22h2: 42
- Microsoft Windows 10 21h2: 42
- Microsoft Windows Server 2022: 41
- Microsoft Windows 11 24h2: 40
- Microsoft Windows 11 23h2: 40
- Microsoft Windows 11 25h2: 40
- Microsoft Windows Server 2025: 39
- Microsoft Windows 11 26h1: 39
- Microsoft Windows Server 2019: 39