🔒 New CSAF advisory published

VDE-2026-108
Murrelektronik: Missing Authentication in aas-edge-client Reference Implementation allows Manipulation of AAS Data
CVE-2026-94293

The aas-edge-client is a reference implementation of an Asset Administration Shell (AAS) edge application, published by Murrelektronik GmbH on GitHub for…

HTML: https://certvde.com/en/advisories/vde-2026-108/
CSAF JSON: https://murrelektronik.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-108.json

#OT #Advisory

🔒 New CSAF advisory published

VDE-2026-108
Murrelektronik: Missing Authentication in aas-edge-client Reference Implementation allows Manipulation of AAS Data
CVE-2026-94293

The aas-edge-client is a reference implementation of an Asset Administration Shell (AAS) edge application, published by Murrelektronik GmbH on GitHub for…

HTML: https://certvde.com/en/advisories/vde-2026-108/
CSAF JSON: https://murrelektronik.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-108.json

#OT #Advisory

CVE-2026-105778: CRITICAL stack-based buffer overflow in Tenda AC5 (v02.03.01.111_multi). Remote attackers can execute code via the /goform/setWifi endpoint. No patch yet — restrict remote access & monitor for exploits. https://radar.offseq.com/threat/cve-2026-105778-stack-based-buffer-overflow-in-tenda-ac5-d56799a413fc396a #OffSeq #CVE #Infosec #IoT

CVE-2026-105778: CRITICAL stack-based buffer overflow in Tenda AC5 (v02.03.01.111_multi). Remote attackers can execute code via the /goform/setWifi endpoint. No patch yet — restrict remote access & monitor for exploits. https://radar.offseq.com/threat/cve-2026-105778-stack-based-buffer-overflow-in-tenda-ac5-d56799a413fc396a #OffSeq #CVE #Infosec #IoT

CVE-2026-75962: HIGH severity stored XSS in Post SMTP WordPress plugin (<=4.0.1). Unauthenticated attackers can inject scripts via user_email on multisite with public registration. Patch or restrict registration. https://radar.offseq.com/threat/cve-2026-75962-cwe-79-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-4d025f1757070abe #OffSeq #WordPress #XSS #Infosec

CVE-2026-75962: HIGH severity stored XSS in Post SMTP WordPress plugin (<=4.0.1). Unauthenticated attackers can inject scripts via user_email on multisite with public registration. Patch or restrict registration. https://radar.offseq.com/threat/cve-2026-75962-cwe-79-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-4d025f1757070abe #OffSeq #WordPress #XSS #Infosec

🟠 CVE-2026-92931 - High (8.8)

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Yet another perfect 10 this morning. This one from a company that knows its way around perfect 10s. 🥳

https://www.cve.org/CVERecord?id=CVE-2026-92931

sev:CRIT 10.0 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information.

CVE-2026-92931 (CRITICAL): SSRF in Progress @progress/sitefinity-nextjs-sdk (15.1.8326 – 15.4.8637). Remote attackers may access internal resources. Monitor for patches & restrict egress where possible. https://radar.offseq.com/threat/cve-2026-92931-cwe-918-server-side-request-forgery-in-progress-software-progresssitefinity-nextjs-sdk-6c11605d160820a3 #OffSeq #CVE #SSRF #Vuln

🟠 CVE-2026-58859 - High (7.8)

In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58859/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58841 - High (7.8)

In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58841/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58841 - High (7.8)

In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58841/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55280 - High (8.8)

In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55280/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55270 - High (7.8)

In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55270/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55269 - High (7.8)

In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55269/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55269 - High (7.8)

In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55269/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49937 - High (7.8)

In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49937/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49937 - High (7.8)

In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49937/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49933 - High (7.8)

In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49933/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49933 - High (7.8)

In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitialized pointer dereference. This could lead to local escalation of privilege with no additional execution pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49933/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

MediaTek security bulletin for October 2026 fixes 31 flaws, including critical MediaTek modem vulnerability CVE-2026-20519. Update now.

#MediaTek #Android #ModemSecurity #CVE202620519 #CVE202620520 #MobileSecurity #PatchTuesday #Vulnerability

https://securityonline.info/mediatek-security-bulletin-october-2026/?utm_source=mastodon&utm_medium=jetpack_social

TOTOLINK X6000R (9.4.0cu.652_B20230116) hit by CRITICAL OS command injection (CVE-2026-105484). Remote, unauthenticated attackers can gain full control. Restrict interface access & monitor /cgi-bin/cstecgi.cgi. Details: https://radar.offseq.com/threat/cve-2026-105484-os-command-injection-in-totolink-x6000r-ffaed0dcf0c90a02 #OffSeq #CVE #IoTSecurity

TOTOLINK X6000R (9.4.0cu.652_B20230116) hit by CRITICAL OS command injection (CVE-2026-105484). Remote, unauthenticated attackers can gain full control. Restrict interface access & monitor /cgi-bin/cstecgi.cgi. Details: https://radar.offseq.com/threat/cve-2026-105484-os-command-injection-in-totolink-x6000r-ffaed0dcf0c90a02 #OffSeq #CVE #IoTSecurity

Critical Capacitor Flaw Allows Malicious Links to Hijack Mobile App Data and Native Features

Capacitor patched a critical vulnerability (CVE-2026-103922) that allows malicious links to load attacker-controlled content within a mobile app's trusted origin. This flaw enables unauthorized access to sensitive user data, authentication tokens, and native device features through Capacitor plugins.

**If you build mobile apps with Capacitor, update to a patched version (6.2.2, 7.6.9, 8.3.5, 8.4.3 or 8.5.1), then rebuild your Android and iOS apps and push the new versions to users. Updating the package alone doesn't protect anyone. If you can't update, block navigation to the internal interceptor path with a custom plugin, and rebuild the apps. Prioritize apps that show chat messages, feeds or other user content first.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-capacitor-flaw-allows-malicious-links-to-hijack-mobile-app-data-and-native-features-g-8-t-k-g/gD2P6Ple2L

CVE-2026-91107: CRITICAL auth bypass in openSIS-Classic 9.3 🛑. Teacher-role users can reset passwords of any staff via the staff_id parameter. No patch yet — restrict permissions & monitor password changes. https://radar.offseq.com/threat/cve-2026-91107-cwe-639-authorization-bypass-through-user-controlled-key-in-os4ed-opensis-classic-f7eb55a7a5a0f52d #OffSeq #Vulnerability #openSIS #CVE202691107

CVE-2026-91107: CRITICAL auth bypass in openSIS-Classic 9.3 🛑. Teacher-role users can reset passwords of any staff via the staff_id parameter. No patch yet — restrict permissions & monitor password changes. https://radar.offseq.com/threat/cve-2026-91107-cwe-639-authorization-bypass-through-user-controlled-key-in-os4ed-opensis-classic-f7eb55a7a5a0f52d #OffSeq #Vulnerability #openSIS #CVE202691107

Atlassian Flaw Exposes File Data Across Multiple Products

A critical security flaw, rated 9.3 out of 10, has been discovered in multiple Atlassian products, allowing unauthenticated attackers to access sensitive files. This vulnerability, known as CVE-2026-21589, poses a significant risk to self-hosted Data Center products if exploited.

https://osintsights.com/atlassian-flaw-exposes-file-data-across-multiple-products?utm_source=mastodon&utm_medium=social

#Cve202621589 #Atlassian #PathTraversal #DataCenter #VulnerabilityManagement

Happy morning... #critical #CVE in all #Atlassian products.

https://confluence.atlassian.com/security/cve-2026-21589-arbitrary-file-access-vulnerability-impacts-multiple-products-1870495748.html

#patching

Atlassian Data Center vulnerability CVE-2026-21589 (CVSS 9.3) allows arbitrary file access in Jira, Confluence and Bitbucket. Patch now.

#Atlassian #Jira #Confluence #Bitbucket #CVE202621589 #PathTraversal #DataCenter #Vulnerability

https://securityonline.info/atlassian-data-center-vulnerability-cve-2026-21589/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-21589 (CRITICAL, CVSS 9.3) in Atlassian Bamboo Data Center <10.2.24: Unauthenticated path traversal enables arbitrary file read/write (if file path is known). Patch to 10.2.24+ required — no workarounds. Details: https://radar.offseq.com/threat/cve-2026-21589-path-traversal-arbitrary-readwrite-in-atlassian-bamboo-data-center-24a2d0e4e6de8f44 #OffSeq #Atlassian #Infosec

Atlassian Data Center vulnerability CVE-2026-21589 (CVSS 9.3) allows arbitrary file access in Jira, Confluence and Bitbucket. Patch now.

#Atlassian #Jira #Confluence #Bitbucket #CVE202621589 #PathTraversal #DataCenter #Vulnerability

https://securityonline.info/atlassian-data-center-vulnerability-cve-2026-21589/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-21589 (CRITICAL, CVSS 9.3) in Atlassian Bamboo Data Center <10.2.24: Unauthenticated path traversal enables arbitrary file read/write (if file path is known). Patch to 10.2.24+ required — no workarounds. Details: https://radar.offseq.com/threat/cve-2026-21589-path-traversal-arbitrary-readwrite-in-atlassian-bamboo-data-center-24a2d0e4e6de8f44 #OffSeq #Atlassian #Infosec

🟠 CVE-2026-77226 - High (8.1)

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77226 - High (8.1)

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77226/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-100511 - High (8.8)

Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-100511/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58815 - High (7.8)

In multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58815/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49885 - High (7.8)

In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49885/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49885 - High (7.8)

In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49885/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45524 - High (8.8)

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for expl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45524/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45524 - High (8.8)

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for expl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45524/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55266 - High (7.8)

In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55266/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55266 - High (7.8)

In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55266/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58854 - High (7.8)

In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58854/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58854 - High (7.8)

In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58854/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58835 - High (8.8)

In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58835/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58835 - High (8.8)

In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58835/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55286 - High (7.8)

In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103334 - High (7.5)

Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservation...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103334/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103334 - High (7.5)

Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservation...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103334/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Struts 7.4.0 fixes four Apache Struts vulnerabilities, including OGNL injection CVE-2026-104711 and a REST plugin DoS. Upgrade now.

#ApacheStruts #Struts #CVE2026104711 #CVE2026104713 #CVE2026104714 #OGNL #JavaSecurity #Vulnerability

https://securityonline.info/apache-struts-vulnerabilities-7-4-0/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-97303 - High (7.6)

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaw...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97303/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105697 - Critical (9.9)

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrappe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105697 - Critical (9.9)

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrappe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

WTF?

https://nvd.nist.gov/vuln/detail/cve-2026-105221

sev:CRIT 9.1 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.

CRITICAL: gist RubyGem versions 4.0.0 – <6.1.0 vulnerable to improper cert validation (CVE-2026-105221). SSL verification is disabled, exposing GitHub creds to on-path attackers. Patch to 6.1.0+ now! https://radar.offseq.com/threat/cve-2026-105221-improper-certificate-validation-in-defunkt-gist-a4b1b7125f9195f8 #OffSeq #CVE2026105221 #RubyGems #infosec

🟠 CVE-2026-97257 - High (8.8)

Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97257/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-12171 - High (7.8)

auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that untrusted source. The handle...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12171/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105650 - High (8.1)

Ghost is a Node.js content management system. From 2.1.0 until 6.64.0, embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the publishe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105642 - High (8.8)

Ghost is a Node.js content management system. From 6.56.0 until 6.67.0, an image processing library bundled with Ghost contained a vulnerability in its SVG handling. Any staff user, including Contributors, could create a bookmark card for an attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105642/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105637 - Critical (9.6)

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105637/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105637 - Critical (9.6)

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105637/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104979 - High (8.7)

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated user, incl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104979/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104891 - High (7.5)

mppx-condition-gate provides conditional free-access wrappers for mppx payment methods. Prior to @insumermodel/mppx-condition-gate 3.0.0 and @insumermodel/mppx-token-gate 1.0.4, the packages read a wallet address from the client-supplied credentia...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103066 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103066/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-97283 - Critical (9.8)

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Object Injection.This issue affects Advanced Post Manager: from n/a through 4.5.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58865 - High (7.5)

In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58865/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105640 - Critical (9.1)

Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed GitLab OAuth deployments where email confirmation is disabled, without verifying that the provider authentica...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105640/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105638 - Critical (9.1)

Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximately 20 bits of entropy. The verifier has no per-code failed-attempt counter, and an incorrect code does not...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105638/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105636 - Critical (9.9)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105636/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105636 - Critical (9.9)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhook_task.py calls requests.post() without allow_redirects=False and does not validate redirect targets. validate_url() blocks ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105636/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105630 - High (8.7)

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Conten...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105630/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104977 - High (7.7)

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project memb...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104977/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-104905 - Insecure Deserialization in FacturaScripts leads to arbitrary file deletion and DoS. CVSS 8.1. Update to v2026.7 now. #CVE #FacturaScripts #infosec

https://www.valtersit.com/cve/CVE-2026-104905/

🔴 CVE-2026-79820 - Critical (9)

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79820/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82044 - High (7.7)

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() meth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105628 - High (7.6)

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by defaul...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105628/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📢 CVE-2026-102282 : Élévation de privilèges locale dans adm-zip via préservation du bit SUID

Cet article est un advisory de sécurité accompagné d'un PoC fonctionnel pour la vulnérabilité CVE-2026-102282 affectant adm-zip, une bibliothèque JavaScript pure pour Node.js comptant plus de 20 millions de téléchargements hebdomadaires sur npm. La bibliothèque…

📖 cyberveille : https://cyberveille.ch/posts/2026-04-10-cve-2026-102282-elevation-de-privileges-locale-dans-adm-zip-via-preservation-du-bit-suid/
🌐 source : https://github.com/x86byte/adm-zip_LPE-PoC
🟡 vérification factuelle moyenne
#SUID #AdmZip #Cyberveille

🟠 CVE-2026-97307 - High (7.5)

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97307/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

StylemixThemes Cost Calculator Builder (<4.0.18) hit by HIGH severity vuln (CVE-2026-97307): sensitive info may be leaked via sent data. Patch not confirmed — track vendor updates and secure affected sites. 🛡️ https://radar.offseq.com/threat/cve-2026-97307-insertion-of-sensitive-information-into-sent-data-in-stylemixthemes-cost-calculator-f23de2d1b2c3a3d8 #OffSeq #WordPress #Vuln

CVE-2026-71886: Bouncy Castle for Java <1.86 HIGH severity vuln lets restricted OpenPGP subkeys improperly certify or delegate trust. No patch yet — validate key flags before accepting certifications. https://radar.offseq.com/threat/in-bouncy-castle-for-java-before-186-the-high-level-openpgp-certificate-api-accepted-a-third-party-032fc543ac46afc4 #OffSeq #JavaSecurity #PKI #BouncyCastle

Totolink A3002MU (v1.0.0-B20230403.1455) hit by CRITICAL CVE-2026-105284 — improper auth in /bin/boa (CVSS 10). Remote attackers can bypass auth; public exploit exists. Restrict admin access, monitor vendor. https://radar.offseq.com/threat/cve-2026-105284-improper-authorization-in-totolink-a3002mu-1d61e588042247d2 #OffSeq #CVE2026105284 #IoTSecurity

🔴 CVE-2026-105284 - Critical (10)

A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77805 - High (7.9)

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77805/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-105223 (CRITICAL, CVSS 9.1): maclof kubernetes-client v0.17.0 – 0.31.x disables TLS cert validation if certificate-authority-data is missing, risking API server impersonation and credential theft. Check configs & vendor advisories. https://radar.offseq.com/threat/cve-2026-105223-improper-certificate-validation-in-maclof-kubernetes-client-8fb4f3aba9271610 #OffSeq #kubernetes #security

🟠 CVE-2026-105212 - High (7.5)

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Zitadel has some new sev:CRIT CVEs for some not-new vulns.

https://nvd.nist.gov/vuln/detail/cve-2026-105211

https://nvd.nist.gov/vuln/detail/cve-2026-105207

https://nvd.nist.gov/vuln/detail/cve-2026-105209

https://nvd.nist.gov/vuln/detail/cve-2026-105215

🟠 CVE-2026-105211 - High (8.1)

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104408 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injection.This issue affects Groundhogg: from n/a through 4.8.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104408/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103624 - High (8.3)

Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromiu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-103628 - Critical (9.6)

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103628/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105295 - High (7.5)

GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs downloaded updates without integrity or signature verification and permanently ignores TLS errors after one SSL error dialog. Network attackers presenting an invalid ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105295/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Zitadel has some new sev:CRIT CVEs for some not-new vulns.

https://nvd.nist.gov/vuln/detail/cve-2026-105211

https://nvd.nist.gov/vuln/detail/cve-2026-105207

https://nvd.nist.gov/vuln/detail/cve-2026-105209

https://nvd.nist.gov/vuln/detail/cve-2026-105215

🔴 CVE-2026-105215 - Critical (9.1)

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105215/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Several Perforce P4 CVEs this morning, including a few sev:CRIT ones.

https://nvd.nist.gov/vuln/detail/cve-2026-100102

https://nvd.nist.gov/vuln/detail/cve-2026-100103

https://nvd.nist.gov/vuln/detail/cve-2026-103510

Perforce fixes six P4 Search vulnerabilities, including CVE-2026-100103 (CVSS 10) and a JDWP RCE flaw. Upgrade to 2026.4.2 now.

#Perforce #P4Search #HelixCore #CVE2026100103 #CVE2026100102 #CVE2026103510 #DevSecOps #Vulnerability

https://securityonline.info/perforce-p4-search-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

📢 ⚠️[VULN] Citrix NetScaler - Et c'est reparti pour un patch ! - CVE-2026-88779

1) Citrix publie un correctif pour la CVE-2026-88779 sur NetScaler, activement exploitée et touchant même les appliances déjà patchées contre PitScaler si elles utilisent SAML 2) Citrix parle d'un simple déni de service, mais le chercheur Kevin Beaumont a vu un binaire malveillant tourner sur un honeypot pourtant…

🔗 https://korben.info/citrix-netscaler-pitscaler-2-zero-day.html
💬 discussion : https://infosec.pub/post/53213585
#CVE #Cyberveille

Citrix Unveils Third Exploited NetScaler Zero-Day Vulnerability

Citrix has just revealed a third critical NetScaler zero-day vulnerability, CVE-2026-88779, which can cause a denial of service in SAML-enabled deployments, and security experts warn it's painfully easy to trigger. This high-severity defect is the latest in a string of actively exploited NetScaler vulnerabilities.

https://osintsights.com/citrix-unveils-third-exploited-netscaler-zero-day-vulnerability?utm_source=mastodon&utm_medium=social

#NetscalerVulnerability #ZeroDay #Cve202688779 #DenialOfService #Saml

Citrix discloses third actively exploited NetScaler zero-day in less than a week

Citrix NetScaler에서 세 번째로 확인된 실제 악용 중인 제로데이 CVE-2026-88779가 공개됐으며, SAML이 활성화된 인스턴스에서 단일 조작 요청으로 서비스 거부를 유발할 수 있다. 패치는 이미 제공됐고 CISA도 이를 Known Exploited Vulnerabilities 카탈로그에 추가했으므로, NetScaler를 인증 게이트웨이 또는 AI 서비스의 외부 접근 경로로 운영하는 조직은 우선 패치와 SAML 노출 범위 점검이 필요하다. 현재 영향은 DoS 중심으로 평가되지만...

https://cyberscoop.com/citrix-netscaler-third-exploited-zero-day-vulnerability/

🔵 THREAT INTELLIGENCE

New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline

Vulnerability | CRITICAL
CVEs: CVE-2026-88779

Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in...

Full analysis:
https://www.yazoul.net/news/article/new-netscaler-zero-day-exploited-in-targeted-attacks-can-knock-saml-deployments-

by Yazoul AI

#InfoSec #Ransomware #CyberNews

Citrix NetScaler Exploited in Active Attacks Amid New 0-Day Reports

Citrix NetScaler is under active attack, with hackers exploiting a newly discovered vulnerability that can cause denial of service with just a single specially crafted request. The flaw, known as CVE-2026-88779, affects certain NetScaler deployments configured for single sign-on authentication.

https://osintsights.com/citrix-netscaler-exploited-in-active-attacks-amid-new-0-day-reports?utm_source=mastodon&utm_medium=social

#CitrixNetscaler #Cve202688779 #DenialOfService #Saml #ZeroDay

📢 Citrix corrige une zero-day NetScaler SAML exploitée, potentiellement en RCE

BleepingComputer — Publié le 4 octobre 2026. Citrix a publié des mises à jour d'urgence pour corriger une vulnérabilité zero-day identifiée comme CVE-2026-88779, affectant les appliances NetScaler ADC et NetScaler Gateway configurées avec l'authentification SAML (en mode SP ou…

📖 cyberveille : https://cyberveille.ch/posts/2026-10-05-citrix-corrige-une-zero-day-netscaler-saml-exploitee-potentiellement-en-rce/
🌐 source : https://www.bleepingcomputer.com/news/security/citrix-patches-netscaler-saml-zero-day-exploited-in-attacks/
🟢 vérification factuelle haute
#Citrix #NetScaler #Cyberveille

Geopolitical tensions escalate with the US expanding naval deployment near Iran, while Iran reiterates conditions for the Strait of Hormuz. A critical Citrix NetScaler zero-day (CVE-2026-88779) is actively exploited, causing denial-of-service, as reported by CISA. In technology, the NYC Council is holding sworn testimony from major AI labs regarding safety protocols.

#Cybersecurity #Geopolitics #AIGovernance

Citrix NetScaler SAML zero-day CVE-2026-88779 patched

https://fawkes.rocks/2026/10/05/citrix-netscaler-saml-zero-day-cve-2026-88779-patched/

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-88779 – Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Immediate CISA KEV threat advisory for CVE-2026-88779 affecting Citrix NetScaler. Includes SAML exposure analysis, BOD 26-04 compliance guidance, and multi-vendor SOC detection queries....

https://thecybermind.co/0b64

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-88779 – Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Immediate CISA KEV threat advisory for CVE-2026-88779 affecting Citrix NetScaler. Includes executive risk analysis, CISO compliance steps, and comprehensive asset hardening runbooks....

https://thecybermind.co/bl05

TheCyberMind.co™ Survival Series —Part 4

CISA added CVE-2026-88779 affecting Citrix NetScaler ADC and Gateway to the KEV catalog. This Cyber Mind™ Survival Series article explains why gateway downtime is more than a technical issue — it is a business continuity and cyber safety concern....

https://thecybermind.co/3is1

🏆 New Achievement! Phase Two Has Already Started!

RAID ALERT. RAID ALERT. NetScaler has entered its second phase and nobody called it. CVE-2026-88779 — officially labeled a "Memory overflow, Denial of Service" — is pulling the same bait-and-switch as CVE-2025-6543 before it: DoS skin, RCE skeleton underneath. watchTowr Labs reproduced it off honeypot activity. Admins watched patched appliances reboot anyway. You wiped. Again. (1/2)

As always thank you @GossiTheDog and @watchTowr

Do you have any IoCs for CVE-2026-88779 at hand? Much appreciated.

Here's a summary of the latest geopolitical, technology, and cybersecurity news from the last 24 hours:

Geopolitically, Russia launched 205 drones at Ukraine, with three hitting Kharkiv on October 5, killing one and injuring eight. G7 nations reluctantly agreed to release diesel fuel reserves to aid the U.S. on October 4. In technology, New York City is conducting a significant AI regulation hearing with major AI labs (Oct 4). Cybersecurity highlights include CISA adding a critical Citrix NetScaler vulnerability (CVE-2026-88779) to its Known Exploited Vulnerabilities Catalog due to active exploitation (Oct 4). Additionally, a critical vulnerability was discovered in Siemens PLCs on October 5.

#AnonNews_irc #Cybersecurity #News

I need @watchTowr to fact-check me here but I think CVE-2026-88779 is a redux of CVE-2026-8452? At least based on this mitigation Citrix support are giving out, somebody posted it on their blog. https://www.deyda.net/index.php/de/2026/08/28/netscaler-cve-checkliste-updates-sicherheitspruefung-und-incident-response/

The 8452 patch locked SAML PrefixList to 512 byte or below string. But I think CVE-2026-88779 may be more than 15 items in PrefixList, space-separated, to trigger a vuln. Assuming Citrix support gave out the right mitigation.

Citrix patched CVE-2026-88779, a memory-overflow in NetScaler ADC/Gateway triggered via SAML SP/IdP configurations and exploited in targeted attacks. Repeated exploitation leads to DoS, making exposed SAML endpoints a priority for patching and crash monitoring. #NetScaler #SamlSecurity #InfoSec

https://cyberworldops.eu/en/netscaler-saml-deployments-need-a-second-upgrade-after-cve-2026-88779

CISA adds CVE-2026-88779 to the KEV Catalog. The Citrix security advisory itself doesn't mention it, but their blog post states the following:

Citrix has observed targeted attacks on unmitigated NetScaler deployments which can lead to Denial of Service.

#CISA #KEV #Citrix #NetScaler #CVE #zeroday

Our weekly Citrix NetScaler zero-day CVE-2026-88779. See you next Sunday I guess

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88779

https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/

#citrix #netscaler #zeroday #eitw

Citrix patches NetScaler SAML zero-day exploited in attacks

Citrix has released emergency updates for a new NetScaler denial-of-service vulnerability tracked as CVE-2026-88779 that has been exploited in...

🔗️ [Bleepingcomputer] https://link.is.it/yTc0yp

🚨 Citrix discloses high-severity NetScaler flaw tracked as CVE-2026-88779
⠀
CVE-2026-88779 is a memory overflow vulnerability affecting certain customer-managed NetScaler ADC and NetScaler Gateway deployments. Successful exploitation can cause a denial-of-service condition. Citrix assigned it a CVSS v4.0 score of 8.7.
⠀
The vulnerability applies when the appliance is configured as either:
⠀
• A SAML Service Provider (SP)
• A SAML Identity Provider (IdP)
⠀
Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28, along with affected FIPS and NDcPP builds. Citrix is urging customers to install the updated releases as soon as possible.
⠀
CVE: CVE-2026-88779
Severity: High
CVSS v4.0: 8.7
Impact: Denial of Service
CWE: CWE-119

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174

@GossiTheDog @jsmall I know but I'm interested not just in CVE-2026-88779. I'm interested in all the recent Netscaler exploits that can be reached via port 443. My honeypot is quite old; it handles only CVE-2019-19781. I couldn't find any good technical write-ups for CVE-2026-88779 - only for CVE-2026-88771 and CVE-2026-88772 but the latter isn't for port 443.

🚨 [CISA-2026:1004] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1004)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-88779 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88779)
- Name: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174 ; https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88779

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261004 #cisa20261004 #cve_2026_88779 #cve202688779

CVE ID: CVE-2026-88779
Vendor: Citrix
Product: NetScaler
Date Added: 2026-10-04
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-88779

Einordnung: NetScaler-Zero-Day trifft Fernwartung

Citrix NetScaler: Zero-Day CVE-2026-88779 wird ausgenutzt. Wer SAML nutzt, sollte sofort auf 14.1-73.41 bzw. 13.1-64.28 patchen – auch die Fernwartung.

#OTSecurity #ICS #KRITIS #NIS2 #Cybersicherheit
https://ot-cyber.de/blog/einordnung-netscaler-zero-day-trifft-fernwartung.html

@bontchev @jsmall ah. You were replying to posts about CVE-2026-88779.

@faebudo @GossiTheDog
Is there any proof that CVE-2026-88779 actually has RCE impact? As far as I can tell this is all just conjecture based on the attempted command injection payloads from the same actor that introduced the crashes that lead to this fix.

The new Citrix Netscaler vuln from Friday is CVE-2026-88779, patch is out now and they recommend patching as soon as possible: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174

Although the vuln is labeled “Memory overflow vulnerability leading to Denial of Service”, that’s the same as CVE-2025–6543. You may remember that lead to RCE in the wild. Prior blog on that: https://doublepulsar.com/citrix-forgot-to-tell-you-cve-2025-6543-has-been-used-as-a-zero-day-since-may-2025-d76574e2dd2c

Citrix NetScaler CVE-2026-88779 is exploited in the wild against NetScaler SAML authentication setups. Upgrade to 14.1-73.41 now.

#Citrix #NetScaler #CVE202688779 #SAML #ActivelyExploited #DoS #Vulnerability

https://securityonline.info/citrix-netscaler-cve-2026-88779-exploited/?utm_source=mastodon&utm_medium=jetpack_social

This is the patch that never ends
It goes on and on my friends
Some people
Started applying it
Not knowing what it was
And they will keep applying it
Forever just because

(CVE-2026-88779 advisory and patch included now)

https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867

#Citrix #Netscaler #ThreatIntel #ThreatIntelligence

CVE-2026-88779 (HIGH, CVSS 8.7) impacts NetScaler ADC & Gateway <14.1-73.41, <13.1-64.28, <13.1-37.282. Remote, unauthenticated attackers can disrupt availability. Patch required; no active exploits. https://radar.offseq.com/threat/cve-2026-88779-vulnerability-in-netscaler-adc-93f6c6cf8720e4e9 #OffSeq #NetScaler #Vulnerability #InfoSec

PoC released for LibreOffice Calc vulnerability CVE-2026-63277, which runs code when a file opens. Five more flaws fixed. Upgrade to 26.2.5.

#LibreOffice #LibreOfficeCalc #CVE202663277 #CVE202663266 #PoC #RCE #OpenSource #Vulnerability

https://securityonline.info/libreoffice-calc-vulnerability-cve-2026-63277-poc/?utm_source=mastodon&utm_medium=jetpack_social

PoC released for LibreOffice Calc vulnerability CVE-2026-63277, which runs code when a file opens. Five more flaws fixed. Upgrade to 26.2.5.

#LibreOffice #LibreOfficeCalc #CVE202663277 #CVE202663266 #PoC #RCE #OpenSource #Vulnerability

https://securityonline.info/libreoffice-calc-vulnerability-cve-2026-63277-poc/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-105285 - Critical (10)

A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQos/comment/entry_name leads...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Totolink A3002MU (v1.0.0-B20230403.1455) hit by CRITICAL stack buffer overflow (CVE-2026-105285). Remote, unauthenticated RCE possible; public exploit out. Restrict management access. https://radar.offseq.com/threat/cve-2026-105285-stack-based-buffer-overflow-in-totolink-a3002mu-7f5ef0e4ed321bf1 #OffSeq #CVE2026105285 #Infosec #IoT

🟠 CVE-2026-105314 - High (7.5)

Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105314/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Several Perforce P4 CVEs this morning, including a few sev:CRIT ones.

https://nvd.nist.gov/vuln/detail/cve-2026-100102

https://nvd.nist.gov/vuln/detail/cve-2026-100103

https://nvd.nist.gov/vuln/detail/cve-2026-103510

CVE-2026-104706: HIGH severity (CVSS 8.4) path traversal in Mitel MiVoice Office 400 v11.0.96.0. Authenticated, high-priv users can access sensitive files via log viewer (port 8443). Restrict access & monitor for updates. https://radar.offseq.com/threat/cve-2026-104706-cwe-31-path-traversal-dirfilename-in-mitel-mitel-mivoice-office-400-01881b6fa741b90b #OffSeq #Vuln #Mitel

Several Perforce P4 CVEs this morning, including a few sev:CRIT ones.

https://nvd.nist.gov/vuln/detail/cve-2026-100102

https://nvd.nist.gov/vuln/detail/cve-2026-100103

https://nvd.nist.gov/vuln/detail/cve-2026-103510

🟠 CVE-2026-104389 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104389/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105293 - High (8.1)

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as thro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105293/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-105222: CRITICAL vuln in alexpechkarev/google-maps (v1.0.3 – 12.16). TLS cert checks off by default — API keys can leak, responses tampered. Set ssl_verify_peer=TRUE. Patch status unknown. https://radar.offseq.com/threat/cve-2026-105222-improper-certificate-validation-in-alexpechkarev-google-maps-f327aeed77a71a14 #OffSeq #Vulnerability #Laravel #CVE2026_105222

🟠 CVE-2026-105220 - High (7.8)

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105220/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105219 - High (7.5)

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an untermina...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105219/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105089 - High (8.7)

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and chann...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105089/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105086 - High (8.7)

WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entitie...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105086/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105213 - High (8.2)

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refres...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105210 - High (8.2)

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105210/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Zitadel has some new sev:CRIT CVEs for some not-new vulns.

https://nvd.nist.gov/vuln/detail/cve-2026-105211

https://nvd.nist.gov/vuln/detail/cve-2026-105207

https://nvd.nist.gov/vuln/detail/cve-2026-105209

https://nvd.nist.gov/vuln/detail/cve-2026-105215

CVE-2026-105207: CRITICAL vuln in ZITADEL 3.0.0 – 3.4.15 & 4.0.0<4.17.3 allows unauthenticated attackers to link their own IdP identity to any account — full takeover possible. Patch status unknown. Details: https://radar.offseq.com/threat/zitadel-300-through-3415-and-400-before-4173-creates-links-between-user-accounts-and-external-identity-cb61bb81cf2dabad #OffSeq #ZITADEL #Vuln #AccountSecurity

🔴 CVE-2026-105207 - Critical (9.8)

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User S...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Zitadel has some new sev:CRIT CVEs for some not-new vulns.

https://nvd.nist.gov/vuln/detail/cve-2026-105211

https://nvd.nist.gov/vuln/detail/cve-2026-105207

https://nvd.nist.gov/vuln/detail/cve-2026-105209

https://nvd.nist.gov/vuln/detail/cve-2026-105215

🔴 CVE-2026-105209 - Critical (9.6)

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organizat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105209/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105208 - High (7.7)

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-103355 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103355/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-103355: CRITICAL blind SQL Injection in Unlimited Elements For Elementor (<2.0.21). Risk of data compromise — patch ASAP when available! https://radar.offseq.com/threat/cve-2026-103355-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-in-3504f0f6c5f88104 #OffSeq #WordPress #Infosec #SQLInjection

AhsayCBS <10.3.4 hit by CRITICAL OS command injection (CVE-2026-105134) in Replication Receiver. Remote, unauthenticated exploitation = total system compromise. Upgrade to 10.3.4 ASAP. Exploit is public. https://radar.offseq.com/threat/a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-1032-cve-2026-105134-a9f0def985d0c48e #OffSeq #CVE2026105134 #Infosec #Vulnerability

🔴 CVE-2026-105134 - Critical (10)

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os comman...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105134/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-105134 (CRITICAL): Ahsay AhsayCBS ≤10.3.2 suffers OS command injection in Replication Receiver (/rps/api/json/UpdateReceivers.do). Remote RCE possible — public exploit out. Patch to 10.3.4+ now. https://radar.offseq.com/threat/cve-2026-105134-os-command-injection-in-ahsay-ahsaycbs-a9df873cc55c0ce9 #OffSeq #Vuln #CVE #PatchNow

🔴 CVE-2026-105135 - Critical (10)

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105135/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

InternLM MindSearch 0.1.0 hit by CRITICAL code injection (CVE-2026-105135) in ExecutionAction.run — remote attackers can execute arbitrary code via manipulated inputs. No patch; restrict access & monitor for updates. https://radar.offseq.com/threat/cve-2026-105135-code-injection-in-internlm-mindsearch-f0d6fc8a61cd76d9 #OffSeq #CVE2026105135 #infosec #zeroday

vincent-peugnet wcms ≤3.18.0 is vulnerable (CVE-2026-105123, HIGH, CVSS 8.7): Authenticated editors can upload malicious files via /api/v0/media/upload/ and delete arbitrary files. Restrict privileges, monitor uploads. https://radar.offseq.com/threat/cve-2026-105123-unrestricted-upload-of-file-with-dangerous-type-in-vincent-peugnet-wcms-9cc4f5671e51d0dd #OffSeq #RCE #WebSecurity #Vuln

🟠 CVE-2026-105123 - High (8.8)

W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php file...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-105129 | LaraDashboard <1.4.8 HIGH severity: settings.view users can access plaintext secrets (API keys, mail creds, tokens) via API. Patch to 1.4.8+ recommended. https://radar.offseq.com/threat/laradashboard-before-148-contains-an-incorrect-authorization-vulnerability-that-allows-authenticated-16249131d2f6c23b #OffSeq #Vulnerability #LaraDashboard #AppSec

🔴 CVE-2026-103626 - Critical (9.6)

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103626/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101161 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of ser...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101161/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101159 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101159/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97363 - High (7.5)

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97363/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94592 - High (8.4)

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operatin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94592/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93428 - High (7.5)

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101160 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Seems to be a theme today. Good think no one uses Bouncy Castle.

https://nvd.nist.gov/vuln/detail/cve-2026-71885

sev:CRIT 9.2 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/U:Amber

In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 9420) implementation did not bind an X.509 credential to a LeafNode's signature_key. LeafNode.verify() checked a leaf's signature against the signature_key carried in the leaf itself, while the credential's X.509 certificate chain was stored but never parsed or validated, so the end-entity certificate's public key was never required to match signature_key as RFC 9420 sec. 5.3 requires. A party could therefore present another party's certificate as its credential while signing the leaf, and the enclosing KeyPackage, with an unrelated key, and be accepted under that other party's identity through KeyPackage.verify() and the Group leaf-validation path. In a deployment that admits external commits without an independent credential-admission check, an unauthenticated attacker could be admitted under a victim's X.509 identity, evict the victim (resynchronization compares whole credentials rather than signing keys), derive the current epoch, decrypt subsequent group messages, and send messages accepted as the victim. TreeKEM.LeafNode now requires the end-entity certificate's subject public key, in the cipher suite's signature encoding, to equal signature_key for an X.509 credential and rejects the leaf otherwise, including an empty chain or a certificate whose key type does not match the cipher suite; certificate-chain and identity validation to a trust anchor remain the application's responsibility per RFC 9420 sec. 5.3.1. Deployments using only basic credentials are unaffected.

Bouncy Castle Patches Identity Binding Vulnerability in Messaging Layer Security Implementation

Bouncy Castle for Java patched a critical identity binding vulnerability (CVE-2026-71885) in its Messaging Layer Security implementation that allows attackers to spoof user identities and decrypt private group messages.

**If your apps or servers use Bouncy Castle for Java (including Android apps and enterprise Java frameworks), update to version 1.86 or later as soon as possible, because attackers can impersonate users and read secure group messages. Ask your developers to check that their apps properly verify certificates and identities all the way back to a trusted source.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/bouncy-castle-patches-identity-binding-vulnerability-in-messaging-layer-security-implementation-i-0-l-r-6/gD2P6Ple2L

CVE-2026-71885 (CRITICAL): Bouncy Castle for Java <1.86 suffers from X.509 credential binding flaw in MLS. Attackers can impersonate users & decrypt group messages. Upgrade to v1.86+ now. https://radar.offseq.com/threat/in-bouncy-castle-for-java-before-186-the-messaging-layer-security-mls-rfc-9420-implementation-did-not-53cae24ecd925b00 #OffSeq #BouncyCastle #Java #Infosec

🟠 CVE-2026-97644 - High (8.8)

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97644/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-92536 - High (8.8)

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the g...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92536/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Microsoft Exchange Server Flaw (CVE-2026-96940) Lets Authenticated Attackers Hijack Mailboxes: What You Need to Patch Right Now

https://thecybersecguru.com/exploits/cve-2026-96940-microsoft-exchange-vulnerability/

Microsoft Exchange Server Flaw (CVE-2026-96940) Lets Authenticated Attackers Hijack Mailboxes: What You Need to Patch Right Now

https://thecybersecguru.com/exploits/cve-2026-96940-microsoft-exchange-vulnerability/

Exchange Server CVE-2026-96940 gets out-of-band patch

https://fawkes.rocks/2026/10/05/exchange-server-cve-2026-96940-gets-out-of-band-patch/

🟠 CVE-2026-96940 - High (8.8)

Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-102490 – Zammad GmbH Zammad Improper Privilege Management Vulnerability

Immediate CISA KEV threat advisory for CVE-2026-102490 affecting Zammad. Includes local privilege escalation analysis, CISO compliance steps, and comprehensive asset hardening runbooks....

https://thecybermind.co/8neo

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-102490 – Zammad GmbH Zammad Improper Privilege Management Vulnerability

Immediate CISA KEV threat advisory for CVE-2026-102490 affecting Zammad. Includes local privilege escalation analysis, BOD 26-04 compliance guidance, and multi-vendor SOC detection queries....

https://thecybermind.co/l7ux

The Cyber Mind Cybersecurity Weekly Brief October 4, 2026

Immediate CISA KEV threat advisory for CVE-2026-102490 affecting Zammad. Includes privilege escalation workflow analysis, BOD 26-04 compliance steps, and production-ready SOC detection queries....

https://thecybermind.co/9km9

🔴 CVE-2026-105080 - Critical (9.9)

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 RAPID RESPONSE: CVE-2026-84411 is a critical unauthenticated remote code execution vulnerability affecting MikroTik RouterOS web management.

Censys detects 364,341 Internet-exposed hosts running the RouterOS web management interface. Roughly 19,200 report RouterOS 7.x, and none currently report the patched 7.24 release or later.

The broader exposure count does not represent confirmed-vulnerable devices because the impact to RouterOS 6.x has not yet been established. No public exploitation has been reported.

Full Censys ARC advisory: https://censys.com/advisory/cve-2026-84411/

#CensysARC #MikroTik #Cybersecurity

⚪️ CISA Warns of Critical RCE Vulnerability in MikroTik RouterOS

🗨️ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability, CVE-2026-84411, in MikroTik RouterOS. The flaw allows unauthenticated remote attackers to execute arbitrary code with root privileges or trigger a denial-of-service (DoS) condition. Exploit…

🔗 https://hackmag.com/news/cve-2026-84411?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

#news

🔴 CVE-2026-84411 - Critical (9.8)

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary cod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104433 - High (7.5)

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104433/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-95102 - Critical (9.4)

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95102/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94593 - High (7.8)

Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94593/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94591 - High (8.4)

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94591/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-103956 - Critical (10)

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103956/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103625 - High (8.8)

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103625/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103622 - High (8.8)

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103622/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82039 - High (8.8)

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82042 - Critical (9.8)

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82041 - Critical (9.9)

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before for...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82041/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104988 - High (8.1)

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-51907 - High (8.1)

In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51907/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67989 - High (7.5)

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-51916 - High (7.5)

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowle...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51916/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39718 - High (8.8)

Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103958 - High (7.6)

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103958/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-102489 – Zammad GmbH Zammad Session Fixation Vulnerability

Immediate CISA KEV threat advisory for CVE-2026-102489 affecting Zammad. Includes session fixation RCE analysis, CISO compliance steps, and comprehensive asset hardening runbooks....

https://thecybermind.co/qfru

(CISA TwS) The Cyber Mind TSUITE Brief: CVE-2026-102489 – Zammad GmbH Zammad Session Fixation Vulnerability

Immediate CISA KEV threat advisory for CVE-2026-102489 affecting Zammad. Includes session fixation RCE analysis, BOD 26-04 compliance guidance, and multi-vendor SOC detection queries....

https://thecybermind.co/l7ux

Zammad security alert: session hijacking and remote code execution

CVE-2026-102489 concerns session hijacking that can lead to code execution as the Zammad service account on affected older installations. DIVD reports exploitation in a real incident.

Zammad states that version 7.0 and later are not exploitable through this issue and recommends upgrading to 7.2.0.

#Zammad #CyberSecurity #VulnerabilityManagement #SecPoint #Penetrator

🏆 New Achievement! Duo-pocalypse Now!

Thank you for contacting GitLab Support. I see you're running a self-hosted AI Gateway. Great choice! Have you tried letting authenticated users execute arbitrary commands on it? Because CVE-2026-90970, CVSS 9.9, has gone ahead and enabled that feature for you. You're welcome. We've escalated your ticket to "catastrophic." (1/3)

⚠️ CRITICAL: GitLab warns of critical RCE vulnerability in AI Gateway service

GitLab disclosed CVE-2026-90970, a critical RCE in AI Gateway that lets authenticated users with Duo Agent Platform access break out of prompt sandbox and run arbitrary commands. Self-hosted deployments are vulnerable; cloud instances are already patched. This is the second critical GitLab vuln in…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

POV: you shipped an AI gateway

the prompt template: "hi {{name}}"

a logged in user with a crafted flow config: "what if i was a shell"

gitlab patched a CVSS 9.9 prompt template sandbox escape in its self-hosted AI gateway (CVE-2026-90970). affected: 18.1.6 to 19.2.3, 19.3.0 to 19.3.1, 19.4.0. fixed in 19.2.4, 19.3.2, 19.4.1. gitlab.com and dedicated already patched

#InfoSec #GitLab #AI #DevSecOps

📈 CVE Published in last 7 days (2026-09-28 - 2026-09-28)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 264
- High: 1061
- Medium: 941
- Low: 181
- None: 99

Status:
- : 37
- Analyzed: 207
- Awaiting Analysis: 736
- Deferred: 1237
- Received: 185
- Rejected: 12
- Undergoing Analysis: 132

CISA KEVs:
- CISA-2026:0929 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0929)
- CISA-2026:0930 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0930)
- CISA-2026:1001 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1001)
- CISA-2026:1002 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1002)
- CISA-2026:1004 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1004)

Top CNAs:
- VulnCheck: 281
- Patchstack: 215
- VulDB: 204
- GitHub, Inc.: 169
- Apache Software Foundation: 155
- Chrome: 152
- Wordfence: 144
- NVIDIA Corporation: 116
- WPScan: 100
- MITRE: 98

Top Affected Products:
- UNKNOWN: 2107
- Google Chrome: 141
- Jetbrains Youtrack: 29
- Yeswiki: 26
- Ghost: 24
- Watchguard Fireware Os: 15
- Moodle: 12
- N8n: 12
- Zfnd Zebra: 11
- Pexip Infinity: 10

Top EPSS Score:
- CVE-2026-12269 - 6.99 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-12269)
- CVE-2026-12268 - 4.73 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-12268)
- CVE-2026-12267 - 3.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-12267)
- CVE-2026-102792 - 3.04 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102792)
- CVE-2026-101001 - 2.63 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101001)
- CVE-2026-102793 - 2.49 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102793)
- CVE-2026-101075 - 2.45 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101075)
- CVE-2026-101261 - 2.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101261)
- CVE-2026-101262 - 2.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101262)
- CVE-2026-102794 - 2.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102794)

#ZEN #SecDB #InfoSec

Geopolitical tensions are escalating with intensified fighting in Yemen, as Iran reiterates that there is "no military solution" to the ongoing conflict. In technology, OpenAI has halted the release of its GPT-6.1 Astra model citing safety concerns, highlighting the growing scrutiny of advanced AI. On the cybersecurity front, a suspected ShinyHunters hacker has been detained in Jordan, assisting the FBI. Urgent action is also advised for an exploited critical FortiMail zero-day vulnerability (CVE-2026-104286).

#AnonNews_irc #Cybersecurity #News

2026-W40 — Weekly Threat Roundup

🔥 A zero-day in Fortinet FortiMail (CVE-2026-104286) is actively exploited with no patch available yet, demanding immediate workarounds.
🏴‍☠️ Operation KillSwitch dismantled the KillSec ransomware gang, allegedly run by a 16-year-old, seizing 110TB of stolen victim data.
🇨🇳 China-linked Warlock…

https://threatnoir.com/weekly/2026-w40

#infosec #cybersecurity #threatintel

🤖 AI generated summary

📰 Critical Fortinet FortiMail Zero-Day Exploited for RCE

Fortinet warns of critical zero-day (CVE-2026-104286) in FortiMail, actively exploited for RCE. CVSS 9.8. CISA added to KEV. Patches are pending, but urgent workarounds are available. #Fortinet #ZeroDay #CVE2026104286 #CyberSecurity

🔗 https://cyber.netsecops.io/articles/critical-fortinet-fortimail-zero-day-exploited-cve-2026-104286/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Apache Thrift 0.25.0 fixes 61 Apache Thrift vulnerabilities, including critical heap overflow CVE-2026-91135. Upgrade every binding now.

#ApacheThrift #Apache #CVE202683632 #CVE202691135 #RPC #DoS #OpenSource #Vulnerability

https://securityonline.info/apache-thrift-vulnerabilities-0-25-0/?utm_source=mastodon&utm_medium=jetpack_social

Apache Thrift 0.25.0 fixes 61 Apache Thrift vulnerabilities, including critical heap overflow CVE-2026-91135. Upgrade every binding now.

#ApacheThrift #Apache #CVE202683632 #CVE202691135 #RPC #DoS #OpenSource #Vulnerability

https://securityonline.info/apache-thrift-vulnerabilities-0-25-0/?utm_source=mastodon&utm_medium=jetpack_social

ASUS Patches Critical Vulnerabilities in Router Firmware Triggered by Malicious VPN Files

ASUS patched two vulnerabilities (CVE-2026-14157 and CVE-2026-13313) in its router firmware that allow authenticated attackers to execute arbitrary commands and gain root privileges via malicious VPN configuration files or active debug code.

**If you have an ASUS router, update its firmware ASAP from the official ASUS support page, and make sure its admin page can only be reached from your trusted internal network, never from the internet. Only import VPN configuration files from providers you trust, and if your router is on ASUS's end-of-life list, plan to replace it since it will not be patched.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/asus-patches-critical-vulnerabilities-in-router-firmware-triggered-by-malicious-vpn-files-0-p-k-n-f/gD2P6Ple2L

📈 CVE Published in last 7 days (2026-09-28 - 2026-09-28)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 264
- High: 1061
- Medium: 941
- Low: 181
- None: 99