XBOW's AI found an unauth RCE in Exim, bug is being called Dead.Letter

https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim

Patches are out: https://www.exim.org/static/doc/security/EXIM-Security-2026-05-01.1/EXIM-Security-2026-05-01.1.txt

Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim
Link: https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim
Comments: https://news.ycombinator.com/item?id=48111748

Dead.letter (CVE-2026-45185) Humans vs. LLM for Unauthenticated RCE Race on Exim - https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim

#hackernews

🚀 Ah, another day, another #CVE nobody asked for. Humans vs. #AI in a race to exploit #Exim, because *obviously* that's what we need—Skynet learning to hack email servers. 😂 But hey, at least the buzzwords and pentest pitches are here to save us from the tedium of actual #security work. 📉
https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim #Skynet #Hacking #HackerNews #ngated

Dead.letter (CVE-2026-45185) Humans vs. LLM for Unauthenticated RCE Race on Exim

https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim

#HackerNews #DeadLetter #CVE202645185 #UnauthenticatedRCE #Exim #LLMVsHumans

Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim

Dead.Letter (CVE-2026-45185) How XBOW found an unauthenticated RCE on Exim https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim

XBOW's AI found an unauth RCE in Exim, bug is being called Dead.Letter

https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim

Patches are out: https://www.exim.org/static/doc/security/EXIM-Security-2026-05-01.1/EXIM-Security-2026-05-01.1.txt

Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim
Link: https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim
Comments: https://news.ycombinator.com/item?id=48111748

🚀 Ah, another day, another #CVE nobody asked for. Humans vs. #AI in a race to exploit #Exim, because *obviously* that's what we need—Skynet learning to hack email servers. 😂 But hey, at least the buzzwords and pentest pitches are here to save us from the tedium of actual #security work. 📉
https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim #Skynet #Hacking #HackerNews #ngated

Dead.letter (CVE-2026-45185) Humans vs. LLM for Unauthenticated RCE Race on Exim

https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim

#HackerNews #DeadLetter #CVE202645185 #UnauthenticatedRCE #Exim #LLMVsHumans

Dead.Letter (CVE-2026-45185) – How XBOW found an unauthenticated RCE on Exim

https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim

Dead.Letter (CVE-2026-45185) How XBOW found an unauthenticated RCE on Exim https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim

🟠 CVE-2026-35071 - High (8.2)

Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35071 - High (8.2)

Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41712 - High (7.5)

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41712 - High (7.5)

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41712 - High (7.5)

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41712 - High (7.5)

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Fortinet Disrupts Critical RCE Flaws in FortiSandbox, FortiAuthenticator

Fortinet has patched a critical remote code execution vulnerability in its FortiAuthenticator and FortiSandbox products, which could have allowed unauthenticated attackers to run unauthorized code or commands. The company has released fixed builds to address the flaw, tracked as CVE-2026-44277, and…

https://osintsights.com/fortinet-disrupts-critical-rce-flaws-in-fortisandbox-fortiauthenticator?utm_source=mastodon&utm_medium=social

#RemoteCodeExecution #Fortiauthenticator #Cve202644277 #Fortinet #IdentityAndAccessManagement

🔴 CVE-2026-44277 - Critical (9.8)

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-44277 - Critical (9.8)

A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6.8, FortiAuthenticator 6.5.0 through 6.5.6 may allow attacker to execute unauthorized code or commands via

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Here is a brief overview of two kernel-level vulnerabilities uncovered by Xint Code in iOS and iPadOS and now patched: CVE-2026-28972 and CVE-2026-28986
https://xint.io/blog/kernel-vulnerabilities-ios-ipados

Here is a brief overview of two kernel-level vulnerabilities uncovered by Xint Code in iOS and iPadOS and now patched: CVE-2026-28972 and CVE-2026-28986
https://xint.io/blog/kernel-vulnerabilities-ios-ipados

🔴 CVE-2026-44183 - Critical (9.8)

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, TrustedNetworkAuthenticationHandler.ResolveClientIp parses the leftmost entry of the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44183/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-44183 - Critical (9.8)

Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent. Prior to 2.9.10, TrustedNetworkAuthenticationHandler.ResolveClientIp parses the leftmost entry of the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44183/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44167 - High (7.5)

phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc). This is a bypass of CVE-2024-27355. This vulnerability is fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44167 - High (7.5)

phpseclib is a PHP secure communications library. Prior to 1.0.29, 2.0.54, and 3.0.52, anyone loading untrusted ASN1 files (eg. X509 certificates, RSA PKCS8 private or public keys, etc). This is a bypass of CVE-2024-27355. This vulnerability is fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-42899 – ASP.NET Core Denial of Service github.com/dotnet/annou...

Microsoft Security Advisory CV...

checks notes ...

Windows Netlogon Remote Code Execution
Windows DNS Client Remote Code Execution

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089

checks notes ...

Windows Netlogon Remote Code Execution
Windows DNS Client Remote Code Execution

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089

checks notes ...

Windows Netlogon Remote Code Execution
Windows DNS Client Remote Code Execution

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089

checks notes ...

Windows Netlogon Remote Code Execution
Windows DNS Client Remote Code Execution

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41096
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41089

Even .NET Framework has an update, with its own fixes for CVE-2026-32177 and CVE-2026-35433. support.microsoft.com/en-us/topic/... So, start your update engines :)

May 12, 2026-KB5087051 Cumulat...

CVE-2026-35433 – .NET Elevation of Privilege github.com/dotnet/annou...

Microsoft Security Advisory CV...

Even .NET Framework has an update, with its own fixes for CVE-2026-32177 and CVE-2026-35433. support.microsoft.com/en-us/topic/... So, start your update engines :)

May 12, 2026-KB5087051 Cumulat...

CVE-2026-32177 – .NET Elevation of Privilege github.com/dotnet/annou...

Microsoft Security Advisory CV...

CVE-2026-32175 – .NET Core Tampering github.com/dotnet/annou...

Microsoft Security Advisory CV...

🚨 New security advisory:

CVE-2026-6722 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-6722-php-soap-unauthenticated-rce

#CVE #SecurityPatching #HackerNews

🚩 CRITICAL: CVE-2026-6722 in PHP SOAP (8.2 – 8.5) allows unauthenticated RCE via use-after-free. No patch confirmed — restrict SOAP access or disable if not needed. Details: https://radar.offseq.com/threat/cve-2026-6722-cwe-416-use-after-free-in-php-group--8d881999 #OffSeq #PHP #Vuln #RCE #InfoSec

🔴 CVE-2026-43992 - Critical (9.8)

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43992/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-43992 - Critical (9.8)

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43992/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-43992 - Critical (9.8)

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43992/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-43992 - Critical (9.8)

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43992/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42860 - High (8.5)

The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_sourc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42860/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42860 - High (8.5)

The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a URL stored in SAMLProviderConfig.metadata_sourc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42860/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: CVE-2026-5084 in WebDyne::Session ≤2.075 creates predictable session IDs (MD5, rand()). Risk: session hijacking. No patch yet — use secure session management & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-5084-cwe-340-generation-of-predictable-nu-706ca625 #OffSeq #Infosec #CVE20265084 #Perl

⚠️ HIGH severity: CVE-2026-5084 in WebDyne::Session ≤2.075 creates predictable session IDs (MD5, rand()). Risk: session hijacking. No patch yet — use secure session management & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-5084-cwe-340-generation-of-predictable-nu-706ca625 #OffSeq #Infosec #CVE20265084 #Perl

🟠 CVE-2026-2465 - High (8.8)

Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows Privilege Escalation.

This issue affects Turboard FOR-S: from 7.01.2026 before 18.02.2026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2465/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2465 - High (8.8)

Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows Privilege Escalation.

This issue affects Turboard FOR-S: from 7.01.2026 before 18.02.2026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2465/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2465 - High (8.8)

Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows Privilege Escalation.

This issue affects Turboard FOR-S: from 7.01.2026 before 18.02.2026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2465/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2465 - High (8.8)

Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows Privilege Escalation.

This issue affects Turboard FOR-S: from 7.01.2026 before 18.02.2026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2465/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6001 - High (8.8)

Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers.

This issue affects BAPSİS: before v.202604152042.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6001 - High (8.8)

Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of Trusted Identifiers.

This issue affects BAPSİS: before v.202604152042.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42609 - High (8.1)

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42609/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42609 - High (8.1)

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) to overwrite existing accounts, including the primary administrator...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42609/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42612 - High (8.5)

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss(...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42612/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42612 - High (8.5)

Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a stored Cross-Site Scripting (XSS) vulnerability in getgrav/grav allows publisher-level accounts to execute arbitrary JavaScript. The issue arises from a blacklist bypass in the detectXss(...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42612/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43937 - High (8.8)

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43937/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43937 - High (8.8)

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43937/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Here is a brief overview of two kernel-level vulnerabilities uncovered by Xint Code in iOS and iPadOS and now patched: CVE-2026-28972 and CVE-2026-28986
https://xint.io/blog/kernel-vulnerabilities-ios-ipados

Here is a brief overview of two kernel-level vulnerabilities uncovered by Xint Code in iOS and iPadOS and now patched: CVE-2026-28972 and CVE-2026-28986
https://xint.io/blog/kernel-vulnerabilities-ios-ipados

🟠 CVE-2026-8111 - High (8.8)

SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8111/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8111 - High (8.8)

SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8111/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8110 - High (7.8)

Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8110/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8110 - High (7.8)

Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8110/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8110 - High (7.8)

Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8110/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8110 - High (7.8)

Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenticated attacker to escalate their privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8110/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

til that Ivanti doesn't just make insecure endpoint management software. they also make insecure reporting software :neobot_giggle:

https://nvd.nist.gov/vuln/detail/cve-2026-8043

🔴 CVE-2026-8043 - Critical (9.6)

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8043/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

til that Ivanti doesn't just make insecure endpoint management software. they also make insecure reporting software :neobot_giggle:

https://nvd.nist.gov/vuln/detail/cve-2026-8043

🔴 CVE-2026-8043 - Critical (9.6)

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8043/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7432 - High (7.8)

A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7432/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7432 - High (7.8)

A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEM

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7432/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📰 Critical Palo Alto Networks Zero-Day (CVE-2026-0300) Actively Exploited for RCE

🚨 CRITICAL ZERO-DAY: Palo Alto Networks warns of an unpatched, actively exploited RCE vulnerability (CVE-2026-0300) in PAN-OS firewalls. The flaw allows root access via the User-ID portal. Mitigate immediately! #CyberSecurity #ZeroDay #PANOS

🔗 https://cyber.netsecops.io

🔵 THREAT INTELLIGENCE

Weekly Threat Roundup: 2026-05-04 to 2026-05-10

Roundup | CRITICAL
CVEs: CVE-2026-0300, CVE-2026-33587, CVE-2026-40281

Cybersecurity roundup for 2026-05-04 to 2026-05-10. 10 CVE advisories, 5 breach reports, 4 threat news stories.

Full analysis:
https://www.yazoul.net/news/article/2026-w19-weekly-threat-roundup

#InfoSec #ZeroDay #SecurityOps

Copy Fail (CVE-2026-31431): A Technical Deep Dive https://github.com/fraynal/articles/tree/main/copy.fail

I upgraded my kernel for Copy Fail (CVE-2026-31431) not that long ago.

Now I am upgrading again for Dirty Frag (CVE-2026-43284 and CVE-2026-43500).

I hope things calm down a bit now but I guess we shall see…

GitHub - sgkdev/page_inject: CVE-2026-31431-killed page-cache exploit — code exec into containers sharing the same image layer

https://github.com/sgkdev/page_inject/

Read on HackerWorkspace: https://hackerworkspace.com/article/github-sgkdev-page-inject-cve-2026-31431-killed-page-cache-exploit-code-exec-into-containers-sharing-the-same-image-layer

#cybersecurity #vulnerability #exploit

Copy Fail (CVE-2026-31431): A Technical Deep Dive https://github.com/fraynal/articles/tree/main/copy.fail

I upgraded my kernel for Copy Fail (CVE-2026-31431) not that long ago.

Now I am upgrading again for Dirty Frag (CVE-2026-43284 and CVE-2026-43500).

I hope things calm down a bit now but I guess we shall see…

GitHub - sgkdev/page_inject: CVE-2026-31431-killed page-cache exploit — code exec into containers sharing the same image layer

https://github.com/sgkdev/page_inject/

Read on HackerWorkspace: https://hackerworkspace.com/article/github-sgkdev-page-inject-cve-2026-31431-killed-page-cache-exploit-code-exec-into-containers-sharing-the-same-image-layer

#cybersecurity #vulnerability #exploit

🟠 CVE-2026-7287 - High (7.5)

** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7287 - High (7.5)

** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7256 - High (8.8)

** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7256 - High (8.8)

** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45091 - Critical (9.1)

sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45091 - Critical (9.1)

sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8162 - High (7.5)

multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition header whose filename* parameter contains a malformed percent-encoding, the parser ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8162/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8162 - High (7.5)

multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition header whose filename* parameter contains a malformed percent-encoding, the parser ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8162/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8162 - High (7.5)

multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition header whose filename* parameter contains a malformed percent-encoding, the parser ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8162/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8162 - High (7.5)

multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition header whose filename* parameter contains a malformed percent-encoding, the parser ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8162/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8159 - High (7.5)

multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8159/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8159 - High (7.5)

multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8159/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45223 - High (8.8)

Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45223/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45223 - High (8.8)

Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin claim, allowing attackers to escalate privileges...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45223/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45006 - High (8.8)

OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write unsafe configuration changes by bypassing an incomplete denylist pro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45006/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45006 - High (8.8)

OpenClaw before 2026.4.23 contains an improper access control vulnerability in the gateway tool's config.apply and config.patch operations that allows compromised models to write unsafe configuration changes by bypassing an incomplete denylist pro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45006/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34263 - Critical (9.6)

Due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentia...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34263/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SAP Security Patch Day May 2026: Critical RCE and SQL Injection Flaws

SAP's May 2026 security update addresses 15 vulnerabilities, including two critical flaws (CVE-2026-34263 and CVE-2026-34260) that allow unauthenticated remote code execution and SQL injection.

**If you are using SAP products, review the advisory in detail. Prioritize patching the critical missing authentication check in SAP Commerce Cloud and the critical SQL injection vulnerability in SAP S/4HANA Enterprise Search for ABAP, followed by the high-severity OS command injection in SAP Forecasting & Replenishment. Then review the rest of the issues.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/sap-security-patch-day-may-2026-critical-rce-and-sql-injection-flaws-w-6-7-x-n/gD2P6Ple2L

🚨 CRITICAL (CVSS 9.6): CVE-2026-34263 hits SAP Commerce Cloud (HY_COM 2205, COM_CLOUD 2211/JDK21). Unauthenticated attackers can upload configs & inject code — full server compromise risk. Monitor & restrict config uploads! https://radar.offseq.com/threat/cve-2026-34263-cwe-459-incomplete-cleanup-in-sapse-30ad114e #OffSeq #SAP #Vuln

🔴 CVE-2026-34263 - Critical (9.6)

Due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentia...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34263/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SAP Security Patch Day May 2026: Critical RCE and SQL Injection Flaws

SAP's May 2026 security update addresses 15 vulnerabilities, including two critical flaws (CVE-2026-34263 and CVE-2026-34260) that allow unauthenticated remote code execution and SQL injection.

**If you are using SAP products, review the advisory in detail. Prioritize patching the critical missing authentication check in SAP Commerce Cloud and the critical SQL injection vulnerability in SAP S/4HANA Enterprise Search for ABAP, followed by the high-severity OS command injection in SAP Forecasting & Replenishment. Then review the rest of the issues.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/sap-security-patch-day-may-2026-critical-rce-and-sql-injection-flaws-w-6-7-x-n/gD2P6Ple2L

🚨 CRITICAL (CVSS 9.6): CVE-2026-34263 hits SAP Commerce Cloud (HY_COM 2205, COM_CLOUD 2211/JDK21). Unauthenticated attackers can upload configs & inject code — full server compromise risk. Monitor & restrict config uploads! https://radar.offseq.com/threat/cve-2026-34263-cwe-459-incomplete-cleanup-in-sapse-30ad114e #OffSeq #SAP #Vuln

🔴 CVE-2026-34260 - Critical (9.6)

SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34260/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SAP Security Patch Day May 2026: Critical RCE and SQL Injection Flaws

SAP's May 2026 security update addresses 15 vulnerabilities, including two critical flaws (CVE-2026-34263 and CVE-2026-34260) that allow unauthenticated remote code execution and SQL injection.

**If you are using SAP products, review the advisory in detail. Prioritize patching the critical missing authentication check in SAP Commerce Cloud and the critical SQL injection vulnerability in SAP S/4HANA Enterprise Search for ABAP, followed by the high-severity OS command injection in SAP Forecasting & Replenishment. Then review the rest of the issues.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/sap-security-patch-day-may-2026-critical-rce-and-sql-injection-flaws-w-6-7-x-n/gD2P6Ple2L

🚨 CRITICAL: SQL injection (CVE-2026-34260, CVSS 9.6) in SAP S/4HANA (SAP_BASIS 751-816). Authenticated attackers can access sensitive data & crash apps. No patch yet — restrict access & monitor logs. https://radar.offseq.com/threat/cve-2026-34260-cwe-89-improper-neutralization-of-s-4864cd58 #OffSeq #SAP #Infosec #SQLInjection

🔴 CVE-2026-34260 - Critical (9.6)

SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34260/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SAP Security Patch Day May 2026: Critical RCE and SQL Injection Flaws

SAP's May 2026 security update addresses 15 vulnerabilities, including two critical flaws (CVE-2026-34263 and CVE-2026-34260) that allow unauthenticated remote code execution and SQL injection.

**If you are using SAP products, review the advisory in detail. Prioritize patching the critical missing authentication check in SAP Commerce Cloud and the critical SQL injection vulnerability in SAP S/4HANA Enterprise Search for ABAP, followed by the high-severity OS command injection in SAP Forecasting & Replenishment. Then review the rest of the issues.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/sap-security-patch-day-may-2026-critical-rce-and-sql-injection-flaws-w-6-7-x-n/gD2P6Ple2L

🚨 CRITICAL: SQL injection (CVE-2026-34260, CVSS 9.6) in SAP S/4HANA (SAP_BASIS 751-816). Authenticated attackers can access sensitive data & crash apps. No patch yet — restrict access & monitor logs. https://radar.offseq.com/threat/cve-2026-34260-cwe-89-improper-neutralization-of-s-4864cd58 #OffSeq #SAP #Infosec #SQLInjection

🟠 CVE-2026-34259 - High (8.2)

Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful expl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34259/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34259 - High (8.2)

Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful expl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34259/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-40946 - High (8.3)

A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 105 TL3 (All versions), blueplanet 105 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 110 TL3 (All ver...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40946/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-40946 - High (8.3)

A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 105 TL3 (All versions), blueplanet 105 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 110 TL3 (All ver...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40946/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-40949 - Critical (9.1)

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGED...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40949/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-40949 - Critical (9.1)

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGED...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40949/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-40947 - High (7.5)

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGED...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40947/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-40947 - High (7.5)

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX1500 (All versions < V2.17.1), RUGGED...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40947/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25786 - Critical (9.1)

Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface.
This could allow an authenticated attacker who is authorized to download a TIA project into the product,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25786 - Critical (9.1)

Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface.
This could allow an authenticated attacker who is authorized to download a TIA project into the product,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27662 - High (7.7)

Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.
This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potenti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27662/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27662 - High (7.7)

Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.
This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potenti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27662/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44412 - High (7.8)

A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications contain a stack based overflow vulnerability while parsing specially crafted PAR files.
This could allow an attacker to execut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44412/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44412 - High (7.8)

A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications contain a stack based overflow vulnerability while parsing specially crafted PAR files.
This could allow an attacker to execut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44412/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32658 - High (8)

Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32658/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32658 - High (8)

Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32658/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-42869 (CRITICAL): socfortress CoPilot <0.1.57 uses a hardcoded JWT secret, letting attackers forge admin tokens and seize control. Upgrade to 0.1.57+ and set JWT_SECRET securely! Details: https://radar.offseq.com/threat/cve-2026-42869-cwe-287-improper-authentication-in--a2c3bf34 #OffSeq #Vuln #CVE #InfoSec

🚨 CVE-2026-42869 (CRITICAL): socfortress CoPilot <0.1.57 uses a hardcoded JWT secret, letting attackers forge admin tokens and seize control. Upgrade to 0.1.57+ and set JWT_SECRET securely! Details: https://radar.offseq.com/threat/cve-2026-42869-cwe-287-improper-authentication-in--a2c3bf34 #OffSeq #Vuln #CVE #InfoSec

#OT #Advisory VDE-2026-042
CODESYS Modbus TCP Server - Improper resource management

CODESYS Modbus is an add‑on for the CODESYS Development System that provides a fully integrated Modbus protocol stack along with diagnostic capabilities. A flaw in the CODESYS Modbus TCP Server protocol stack library results in a vulnerability. When a Modbus TCP server is configured, this vulnerable protocol stack is downloaded to and executed by CODESYS Control runtime systems.
#CVE CVE-2026-35227

https://certvde.com/en/advisories/vde-2026-042/

#CSAF https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-05_vde-2026-042.json

#OT #Advisory VDE-2026-042
CODESYS Modbus TCP Server - Improper resource management

CODESYS Modbus is an add‑on for the CODESYS Development System that provides a fully integrated Modbus protocol stack along with diagnostic capabilities. A flaw in the CODESYS Modbus TCP Server protocol stack library results in a vulnerability. When a Modbus TCP server is configured, this vulnerable protocol stack is downloaded to and executed by CODESYS Control runtime systems.
#CVE CVE-2026-35227

https://certvde.com/en/advisories/vde-2026-042/

#CSAF https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-05_vde-2026-042.json

🟠 CVE-2026-4890 - High (7.5)

A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4890/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4890 - High (7.5)

A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4890/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43441 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
initialized because inet6_init() exits befo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43441/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43441 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled

When booting with the 'ipv6.disable=1' parameter, the nd_tbl is never
initialized because inet6_init() exits befo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43441/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43437 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()

In the drain loop, the local variable 'runtime' is reassigned to a
linked stream's runtime (runtime = s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43437/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43437 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()

In the drain loop, the local variable 'runtime' is reassigned to a
linked stream's runtime (runtime = s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43437/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43456 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix type confusion in bond_setup_by_slave()

kernel BUG at net/core/skbuff.c:2306!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:pskb_expand_head+0xa08/0xfe0...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43456/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43456 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

bonding: fix type confusion in bond_setup_by_slave()

kernel BUG at net/core/skbuff.c:2306!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:pskb_expand_head+0xa08/0xfe0...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43456/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43466 - High (8.2)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery

In case of a TX error CQE, a recovery flow is triggered,
mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43466/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43466 - High (8.2)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery

In case of a TX error CQE, a recovery flow is triggered,
mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43466/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43464 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ

XDP multi-buf programs can modify the layout of the XDP buffer when the
program calls bpf_xdp_pull_data() or bpf_xdp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43464/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43464 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ

XDP multi-buf programs can modify the layout of the XDP buffer when the
program calls bpf_xdp_pull_data() or bpf_xdp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43464/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39432 - High (8.2)

Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Timetics: from n/a through 1.0.53.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39432/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔍 HIGH severity: CVE-2026-39432 in Arraytics Timetics ≤1.0.53 — Missing authorization (CWE-862) enables potential data exposure. No patch available yet. Restrict access, monitor advisories. https://radar.offseq.com/threat/cve-2026-39432-cwe-862-missing-authorization-in-ar-e310bf2a #OffSeq #Cybersecurity #Vuln #CVE202639432

🟠 CVE-2026-39432 - High (8.2)

Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Timetics: from n/a through 1.0.53.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39432/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔍 HIGH severity: CVE-2026-39432 in Arraytics Timetics ≤1.0.53 — Missing authorization (CWE-862) enables potential data exposure. No patch available yet. Restrict access, monitor advisories. https://radar.offseq.com/threat/cve-2026-39432-cwe-862-missing-authorization-in-ar-e310bf2a #OffSeq #Cybersecurity #Vuln #CVE202639432

🟠 CVE-2026-42742 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This issue affects Views for WPForms: from n/a through &lt;= 3.4.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42742/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42742 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL Injection.This issue affects Views for WPForms: from n/a through &lt;= 3.4.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42742/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42741 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms allows Blind SQL Injection....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42741/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42741 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views &#8211; Display &amp; Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms allows Blind SQL Injection....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42741/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-8072 (CRITICAL, 9.2): Ingeteam Ingecon Sun EMS Board uses weak hashing for SAT access credentials, risking privilege escalation. No mitigation yet — review access and monitor for updates. https://radar.offseq.com/threat/cve-2026-8072-cwe-327-use-of-a-broken-or-risky-cry-6e7aa5de #OffSeq #ICS #Vulnerability

🔴 CVE-2026-8072 (CRITICAL, 9.2): Ingeteam Ingecon Sun EMS Board uses weak hashing for SAT access credentials, risking privilege escalation. No mitigation yet — review access and monitor for updates. https://radar.offseq.com/threat/cve-2026-8072-cwe-327-use-of-a-broken-or-risky-cry-6e7aa5de #OffSeq #ICS #Vulnerability

🔴 CVE-2026-25787 - Critical (9.1)

Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25787/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25787 - Critical (9.1)

Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25787/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33893 - High (7.5)

A vulnerability has been identified in Teamcenter V2312 (All versions &lt; V2312.0014), Teamcenter V2406 (All versions &lt; V2406.0012), Teamcenter V2412 (All versions &lt; V2412.0009), Teamcenter V2506 (All versions &lt; V2506.0005), Teamcenter V...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33893/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33893 - High (7.5)

A vulnerability has been identified in Teamcenter V2312 (All versions &lt; V2312.0014), Teamcenter V2406 (All versions &lt; V2406.0012), Teamcenter V2412 (All versions &lt; V2412.0009), Teamcenter V2506 (All versions &lt; V2506.0005), Teamcenter V...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33893/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44411 - High (7.8)

A vulnerability has been identified in Solid Edge SE2026 (All versions &lt; V226.0 Update 5). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44411 - High (7.8)

A vulnerability has been identified in Solid Edge SE2026 (All versions &lt; V226.0 Update 5). The affected application is vulnerable to uninitialized pointer access while parsing specially crafted PAR files. An attacker could leverage this vulnera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41551 - Critical (9.1)

A vulnerability has been identified in ROS# (All versions &lt; V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properly sanitized.
This could allow a remote attacker to access arbitrary files on the dev...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41551 - Critical (9.1)

A vulnerability has been identified in ROS# (All versions &lt; V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properly sanitized.
This could allow a remote attacker to access arbitrary files on the dev...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45214 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL Injection.This issue affects Xpro Elementor Addons: from n/a through &lt;= 1.5.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45214 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL Injection.This issue affects Xpro Elementor Addons: from n/a through &lt;= 1.5.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45214 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL Injection.This issue affects Xpro Elementor Addons: from n/a through &lt;= 1.5.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45214 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL Injection.This issue affects Xpro Elementor Addons: from n/a through &lt;= 1.5.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45213 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects BEAR: from n/a through &lt;= 1.1.7.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45213 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects BEAR: from n/a through &lt;= 1.1.7.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45213 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects BEAR: from n/a through &lt;= 1.1.7.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45213 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This issue affects BEAR: from n/a through &lt;= 1.1.7.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41713 - High (8.2)

A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41713/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41713 - High (8.2)

A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41713/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45211 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45211 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45218 - High (7.7)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows Blind SQL Injection.This issue affects WP Travel: from n/a through &lt;= 11.4.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45218 - High (7.7)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows Blind SQL Injection.This issue affects WP Travel: from n/a through &lt;= 11.4.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45218/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-40833 - High (7.5)

The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an attacker to cause denial of service condition. A manual restart is required to recover the system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-40833 - High (7.5)

The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an attacker to cause denial of service condition. A manual restart is required to recover the system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22925 - High (7.5)

A vulnerability has been identified in SIMATIC CN 4100 (All versions &lt; V5.0). The affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets
This could allow an attacker to render the service un...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22925 - High (7.5)

A vulnerability has been identified in SIMATIC CN 4100 (All versions &lt; V5.0). The affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets
This could allow an attacker to render the service un...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22924 - Critical (9.1)

A vulnerability has been identified in SIMATIC CN 4100 (All versions &lt; V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions.
This could allow an attacker to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22924 - Critical (9.1)

A vulnerability has been identified in SIMATIC CN 4100 (All versions &lt; V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions.
This could allow an attacker to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-6577 - Critical (9.8)

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows SQL Injection.

This issue affects E-Commerce Website: before 4.5.001.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-6577/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-6577 - Critical (9.8)

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows SQL Injection.

This issue affects E-Commerce Website: before 4.5.001.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-6577/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2993 - High (7.5)

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.17 due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing S...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2993/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2993 - High (7.5)

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.17 due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing S...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2993/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-42882 (CRITICAL): oxyno-zeta s3-proxy <5.0.0 has a path traversal bug, letting unauthenticated attackers bypass auth to access or modify protected S3 objects. Patch to v5.0.0 now! https://radar.offseq.com/threat/cve-2026-42882-cwe-22-improper-limitation-of-a-pat-5be1c7df #OffSeq #CVE202642882 #CloudSecurity #Vuln

🚨 CVE-2026-42882 (CRITICAL): oxyno-zeta s3-proxy <5.0.0 has a path traversal bug, letting unauthenticated attackers bypass auth to access or modify protected S3 objects. Patch to v5.0.0 now! https://radar.offseq.com/threat/cve-2026-42882-cwe-22-improper-limitation-of-a-pat-5be1c7df #OffSeq #CVE202642882 #CloudSecurity #Vuln

🟠 CVE-2026-42843 - High (8.8)

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42843/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42843 - High (8.8)

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content, media, configuration, users, and system management. Prior to 1.0.0-beta.15, an insecure direct object reference and logic flaw in the Grav API...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42843/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41431 - High (8)

Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from. The MAR files...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41431/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41431 - High (8)

Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource (MAR) updater (org.mozilla.updater) that has had all MAR signature verification stripped from the Firefox codebase it was forked from. The MAR files...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41431/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8177 - High (7.5)

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences.

A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8177/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-8177 - High (7.5)

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences.

A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8177/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-6433 in Custom css-js-php <=2.0.7 enables unauthenticated PHP code execution via flawed input handling. No patch or exploit in the wild yet. Disable/remove plugin now. https://radar.offseq.com/threat/cve-2026-6433-cwe-94-improper-control-of-generatio-3ad54b4b #OffSeq #WordPress #vuln #WebSecurity

🚨 CRITICAL: CVE-2026-6433 in Custom css-js-php <=2.0.7 enables unauthenticated PHP code execution via flawed input handling. No patch or exploit in the wild yet. Disable/remove plugin now. https://radar.offseq.com/threat/cve-2026-6433-cwe-94-improper-control-of-generatio-3ad54b4b #OffSeq #WordPress #vuln #WebSecurity

📰 High-Severity Flaw in JetBrains TeamCity On-Premises Allows API Exposure (CVE-2026-44413)

PATCH NOW: A high-severity vulnerability (CVE-2026-44413) in JetBrains TeamCity On-Premises allows any authenticated user to expose server APIs. All versions up to 2025.11.4 are affected. Upgrade to 2026.1 immediately. 💻🔧 #TeamCity #JetBrains #CI/CD

🔗 https://cyber.netsecops.io

🟠 CVE-2026-44413 - High (8.2)

In JetBrains TeamCity before 2026.1
2025.11.5 authenticated users could expose server API to unauthorised access

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44413/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44413 - High (8.2)

In JetBrains TeamCity before 2026.1
2025.11.5 authenticated users could expose server API to unauthorised access

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44413/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43639 - High (8)

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43639/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43639 - High (8)

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43639/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45004 - High (7.8)

OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution. Attackers can execute arbitrary JavaScript unde...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45004/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45004 - High (7.8)

OpenClaw before 2026.4.23 contains an arbitrary code execution vulnerability in the bundled plugin setup resolver that loads setup-api.js from process.cwd() during provider setup metadata resolution. Attackers can execute arbitrary JavaScript unde...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45004/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33357 - High (7.5)

In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label &lt;= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP dat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33357/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33357 - High (7.5)

In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label &lt;= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP dat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33357/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33357 - High (7.5)

In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label &lt;= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP dat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33357/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33357 - High (7.5)

In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label &lt;= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP dat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33357/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33356 - High (7.7)

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but doe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33356/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33356 - High (7.7)

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but doe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33356/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33356 - High (7.7)

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but doe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33356/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33356 - High (7.7)

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but doe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33356/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33362 - High (8.6)

In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps &lt;= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, pas...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33362 - High (8.6)

In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps &lt;= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, pas...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33361 - High (7.5)

In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (&lt;= 1.8.x), baby monitor &quot;.jpgx3&quot; files use reversible XOR over only the first 1024 by...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33361/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33361 - High (7.5)

In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (&lt;= 1.8.x), baby monitor &quot;.jpgx3&quot; files use reversible XOR over only the first 1024 by...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33361/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33359 - High (7.5)

In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33359 - High (7.5)

In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7815 - High (8.8)

SQL injection vulnerability in pgAdmin 4 Maintenance Tool.

Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7815/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7815 - High (8.8)

SQL injection vulnerability in pgAdmin 4 Maintenance Tool.

Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7815/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7813 - Critical (9.9)

Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.

Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7813/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7813 - Critical (9.9)

Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.

Multiple endpoints fetched user-owned objects without filtering by the requesting user's identity. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7813/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7819 - High (8.1)

Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.

check_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7819/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7819 - High (8.1)

Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.

check_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7819/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43640 - High (8.1)

Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43640/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-43640 - High (8.1)

Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-43640/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42603 - High (8.8)

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Prior to 2.1.2, .github/workflows/pre-commit-fix.yaml uses pull_request_target (privileged trigger) but checks out and exe...