CVE-2026-65603: HIGH severity privilege escalation in Grav Login plugin (<=3.8.11). Low-priv users can gain super-admin & RCE. Patch to v3.8.12 ASAP! https://radar.offseq.com/threat/cve-2026-65603-improper-privilege-management-in-getgrav-grav-12319d7ebec99910 #OffSeq #GravCMS #Vuln #PrivilegeEscalation

CVE-2026-65603: HIGH severity privilege escalation in Grav Login plugin (<=3.8.11). Low-priv users can gain super-admin & RCE. Patch to v3.8.12 ASAP! https://radar.offseq.com/threat/cve-2026-65603-improper-privilege-management-in-getgrav-grav-12319d7ebec99910 #OffSeq #GravCMS #Vuln #PrivilegeEscalation

🟠 CVE-2026-49499 - High (8.8)

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49499/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49499 - High (8.8)

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49499/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-63764 - Critical (9.3)

lmdeploy's OpenAI-compatible API server contains a server-side request forgery vulnerability that allows unauthenticated attackers to access internal services and cloud metadata endpoints by supplying a crafted image_url that redirects to internal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63764/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40712 - Critical (9.1)

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40712 - Critical (9.1)

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40712/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-46738 - Critical (9.1)

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46738/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-46738 - Critical (9.1)

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46738/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-15900: CRITICAL use-after-free in Chrome (Android <150.0.7871.128). Exploitable via malicious HTML, enabling sandbox escape & elevated code execution. Patch ASAP: update Chrome for Android. https://radar.offseq.com/threat/cve-2026-15900-use-after-free-in-google-chrome-7d985b12f49a9534 #OffSeq #CVE202615900 #Chrome #Android

Unblu Spark suffers a CRITICAL open redirect (CVE-2026-8152) leading to DOM XSS in siteEmbeddedSetup=true config. Attacker can access cookies & APIs of host app. No patch yet — disable this config ASAP. https://radar.offseq.com/threat/cve-2026-8152-cwe-601-url-redirection-to-untrusted-site-open-redirect-in-unblu-inc-unblu-spark-7d13478f5c7eb4ac #OffSeq #XSS #Vulnerability #InfoSec

Unblu Spark suffers a CRITICAL open redirect (CVE-2026-8152) leading to DOM XSS in siteEmbeddedSetup=true config. Attacker can access cookies & APIs of host app. No patch yet — disable this config ASAP. https://radar.offseq.com/threat/cve-2026-8152-cwe-601-url-redirection-to-untrusted-site-open-redirect-in-unblu-inc-unblu-spark-7d13478f5c7eb4ac #OffSeq #XSS #Vulnerability #InfoSec

📈 CVE Published in last days (2026-07-13 - 2026-07-13)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 224
- High: 1087
- Medium: 754
- Low: 179
- None: 135

Status:
- : 75
- Analyzed: 539
- Awaiting Analysis: 531
- Deferred: 828
- Modified: 19
- Received: 236
- Rejected: 27
- Undergoing Analysis: 124

CISA KEVs:
- CISA-2026:0713 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0713)
- CISA-2026:0714 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0714)
- CISA-2026:0715 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0715)
- CISA-2026:0716 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0716)

Top CNAs:
- Microsoft Corporation: 576
- GitHub, Inc.: 418
- VulnCheck: 200
- VulDB: 162
- Patchstack: 149
- Adobe Systems Incorporated: 91
- MITRE: 77
- N/A: 75
- Wordfence: 59
- WPScan: 43

Top Affected Products:
- UNKNOWN: 1385
- Microsoft Windows Server 2025: 387
- Microsoft Windows 11 26h1: 382
- Microsoft Windows 11 24h2: 379
- Microsoft Windows 11 25h2: 379
- Microsoft Windows Server 2022: 324
- Microsoft Windows 10 21h2: 313
- Microsoft Windows 10 22h2: 313
- Microsoft Windows Server 2019: 310
- Microsoft Windows 10 1809: 310

Top EPSS Score:
- CVE-2026-50522 - 20.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-50522)
- CVE-2026-47992 - 19.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47992)
- CVE-2026-47996 - 18.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47996)
- CVE-2026-48356 - 17.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48356)
- CVE-2026-48332 - 11.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48332)
- CVE-2026-48320 - 9.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48320)
- CVE-2026-63030 - 8.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-63030)
- CVE-2026-48284 - 7.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48284)
- CVE-2026-50518 - 7.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-50518)
- CVE-2026-47999 - 7.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47999)

#ZEN #SecDB #InfoSec

🟠 CVE-2026-62561 - High (7.8)

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62561/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62561 - High (7.8)

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62561/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-62549 (CRITICAL, CVSS 9.6) in Oracle HRMS (UK) 12.2.3 – 12.2.15 lets low-priv attackers compromise critical data & impact other Oracle apps. Patch status unclear — check https://radar.offseq.com/threat/cve-2026-62549-easily-exploitable-vulnerability-allows-low-privileged-attacker-with-network-access-via-2a35d285e3bf086c & restrict network access. #OffSeq #Oracle #CVE2026_62549 #Vuln

Check Point confirms CVE-2026-16232, a SmartConsole authentication bypass, is exploited in the wild. Apply the July 22 jumbo hotfix now.

#CheckPoint #CVE202616232 #SmartConsole #AuthBypass #ExploitedInTheWild #InfoSec

https://securityonline.info/check-point-smartconsole-cve-2026-16232/?utm_source=mastodon&utm_medium=jetpack_social

Check Point confirms CVE-2026-16232, a SmartConsole authentication bypass, is exploited in the wild. Apply the July 22 jumbo hotfix now.

#CheckPoint #CVE202616232 #SmartConsole #AuthBypass #ExploitedInTheWild #InfoSec

https://securityonline.info/check-point-smartconsole-cve-2026-16232/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-63048 (CRITICAL, CVSS 9.4): joomlack.fr Page Builder CK for Joomla (v1.0.0 – 3.6.2) lets authenticated users upload arbitrary files, enabling RCE. No patch — restrict usage & monitor for updates. https://radar.offseq.com/threat/cve-2026-63048-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-joomlackfr-page-builder-ck-3921dbf365864886 #OffSeq #Joomla #RCE #Vuln

CVE-2026-63048 (CRITICAL, CVSS 9.4): joomlack.fr Page Builder CK for Joomla (v1.0.0 – 3.6.2) lets authenticated users upload arbitrary files, enabling RCE. No patch — restrict usage & monitor for updates. https://radar.offseq.com/threat/cve-2026-63048-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-joomlackfr-page-builder-ck-3921dbf365864886 #OffSeq #Joomla #RCE #Vuln

🟠 CVE-2026-3821 - High (8.8)

Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI.
An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3821/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3821 - High (8.8)

Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI.
An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3821/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-15802 - High (8.1)

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15802/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-15802 - High (8.1)

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15802/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔵 THREAT INTELLIGENCE

Critical wp2shell WordPress flaws exploited to install webshells

Vulnerability | CRITICAL
CVEs: CVE-2026-60137, CVE-2026-63030

Hackers are exploiting the 'wp2shell' critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent...

Full analysis:
https://www.yazoul.net/news/article/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells

#InfoSec #ZeroDay #SecurityOps

📰 CISA Adds Four Actively Exploited Flaws in DD-WRT, Langflow, WordPress

CISA adds 4 actively exploited vulnerabilities to its KEV catalog: CVE-2021-27137 (DD-WRT), CVE-2026-0770 (Langflow), and CVE-2026-63030 & CVE-2026-60137 (WordPress). Patching is urgent. #CISA #KEV #Vulnerability #PatchNow #WordPress

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/cisa-adds-four-actively-exploited-vulnerabilities-in-dd-wrt-langflow-wordpress-to-kev-catalog/?utm_s…

⚠️ CRITICAL THREAT: CVE-2026-63030 in WordPress Core enables SQL injection and RCE via interpretation conflicts. Active exploitation is confirmed! Get the forensic detection queries and hardening strategies needed to secure your web assets now. https://thecybermind.co/9k20

#CyberSecurity #InfoSec #WordPress #ThreatIntel

⚠️ CRITICAL THREAT: CVE-2026-63030 in WordPress Core enables SQL injection and RCE via interpretation conflicts. Active exploitation is confirmed! Get the forensic detection queries and hardening strategies needed to secure your web assets now. https://thecybermind.co/9k20

#CyberSecurity #InfoSec #WordPress #ThreatIntel

WordPressに認証不要でコード実行される緊急の脆弱性　即時更新を呼び掛け

https://www.itmedia.co.jp/news/articles/2607/21/news084.html

　WordPressの開発チームは7月17日（米国時間）、深刻な2件の脆弱性を修正したセキュリティリリース「WordPress 7.0.2」を公開した。

　1件は深刻度「Critical」（緊急）と評価された認証不要のリモートコード実行（RCE）の脆弱性（CVE-2026-63030）で、REST APIのバッチ処理エンドポイントを悪用されると、ログインやユーザーの操作なしに攻撃者が任意のコードを実行できる恐れがある。
もう1件は「High」（高）と評価されたSQLインジェクションの脆弱性（CVE-2026-60137）で、細工した入力によってデータベースへのクエリを改ざんされる可能性がある。なお、RCEはこのSQLインジェクションに起因しているという。

Critical wp2shell WordPress flaws exploited to install webshells

Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy...

🔗️ [Bleepingcomputer] https://link.is.it/KxezNe

🚨 [CISA-2026:0721] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0721)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2021-27137 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-27137)
- Name: DD-WRT Stack-Based Buffer Overflow Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: DD-WRT
- Product: DD-WRT
- Notes: This vulnerability affects a common open-source component, third-party library, proprietary implementation, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://svn.dd-wrt.com/changeset/45724 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-27137

⚠️ CVE-2026-0770 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-0770)
- Name: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/releases/tag/v1.9.0 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-0770

⚠️ CVE-2026-60137 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-60137)
- Name: WordPress Core SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: WordPress
- Product: Core
- Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137

⚠️ CVE-2026-63030 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-63030)
- Name: WordPress Core Interpretation Conflict Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: WordPress
- Product: Core
- Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260721 #cisa20260721 #cve_2021_27137 #cve_2026_0770 #cve_2026_60137 #cve_2026_63030 #cve202127137 #cve20260770 #cve202660137 #cve202663030

CISA added four flaws to its KEV catalog, including WordPress RCE (CVE-2026-63030) and Langflow RCE (CVE-2026-0770). All are exploited in the wild.

#CISA #KEV #WordPress #Langflow #DDWRT #RCE #SQLInjection

https://securityonline.info/cisa-kev-four-exploited-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

CVE ID: CVE-2026-63030
Vendor: WordPress
Product: Core
Date Added: 2026-07-21
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-63030

#IoC von #wp2shell suchen:

- Webserverlogs

`zgrep /batch/v1 *.log *.log.gz | egrep '45.79.167[.]238|34.81.132[.]62|79.177.131[.]206|15.157.135[.]170|94.100.52[.]128|172.235.128[.]52'`

- Wordpress-Verzeichnis

`find . -type f -print0 | xargs -0 md5sum | egrep '2a1410d8e2a8337ac2171cedea8c0fdc47c647a0|58eca847e9eae9e6b08cc211f1559817b71bc4cc|ebea44890f434d5d67ede22009a3f4bb5cac33f8|d9a220c8039f1c4d72cae7ccb8b3a33dec8815be|e9756e2338f84746007235e4cab7a70d5b3ca47f'`

https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

Broadcom has new advisories for two medium-severity vulnerabilities https://support.broadcom.com/web/ecx/security-advisory #Broadcom

CISA KEV updates:

- CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-27137

- CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-0770

- CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-63030

- CVE-2026-60137L WordPress Core SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-60137 #CISA #WordPress #vulnerability #infosec

wp2shell, a WordPress Core RCE chain (CVE-2026-63030, CVE-2026-60137), is exploited in the wild. Public PoC code is out. Patch WordPress now.

#wp2shell #WordPress #RCE #CVE202663030 #CVE202660137 #InfoSec #WebSecurity #PatchNow

https://securityonline.info/wp2shell-wordpress-core-rce/?utm_source=mastodon&utm_medium=jetpack_social

🤖 WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)

📝 Last week, Searchlight Cyber released details about a vulnerability they are calling &quot;wp2shell&quot;. The vulner...

https://isc.sans.edu/diary/rss/33168

📰 SANS Internet Storm Center, InfoCON: green

#AI #CVE #ZeroDay

WordPress Exploitation Underway (CVE-2026-63030) https://isc.sans.edu/diary/33168

W cyberpodziemiu opublikowano exploity wykorzystujące krytyczne luki RCE typu „wp2shell” występujące przed uwierzytelnieniem, które dotyczą jądra WordPressa. W wersjach WordPressa 6.9.5 i 7.0.2 naprawiono cały łańcuch ataków typu wp2shell. Atak typu wp2shell składa się z dwóch luk – CVE-2026-63030 i CVE-2026-60137, które można połączyć w celu zdalnego wykonania kodu przed uwierzytelnieniem w instalacjach WordPressa w wersjach 6.9. i 7.0.

New.

Picus: CVE-2026-63030 and CVE-2026-60137 (wp2shell): WordPress RCE Explained https://www.picussecurity.com/resource/blog/cve-2026-63030-and-cve-2026-60137-wp2shell-wordpress-rce-explained #infosec #vulnerability #WordPress

⚠️ 📢 #Sicherheitswarnung: WordPress – Schwachstellen erlauben "Remote Code Execution"

Am 17. Juli 2026 wurde seitens #Wordpress eine Aktualisierung bekannt gegeben, die zwei #Schwachstellen in der Wordpress-Software behebt.

❗️ Die beiden Schwachstellen CVE-2026-60137 und CVE-2026-63030 ermöglichen einem nicht authentifizierten, entfernten Angreifer Code zur Ausführung zu bringen.

Mehr dazu hier: 👉️ https://www.bsi.bund.de/dok/1203360

@certbund

⚠️ Si vous administrez un site WordPress ou si vous connaissez quelqu’un qui en gère un faites passer l’information.

Une vulnérabilité critique baptisée WP2Shell touche directement le cœur de WordPress.

Cette fois, il ne s’agit pas d’un plugin abandonné ou d’un thème douteux : une installation standard peut être attaquée à distance, sans compte utilisateur, sans mot de passe et sans authentification préalable.

WP2Shell combine deux failles, CVE-2026-60137 et CVE-2026-63030, permettant à un attaquant d’exécuter du code sur le serveur et donc, potentiellement, de prendre le contrôle du site.

-> Des tentatives d’exploitation et des compromissions ont déjà été observées dans la nature.

Sont notamment concernées les versions :

➡️ WordPress 6.9.0 à 6.9.4
➡️ WordPress 7.0.0 à 7.0.1

Les correctifs sont disponibles dans les versions 6.9.5 et 7.0.2. WordPress a activé des mises à jour automatiques forcées en raison de la gravité de la faille, mais il ne faut pas supposer qu’elles ont forcément fonctionné : elles peuvent avoir été désactivées, bloquées par l’hébergeur ou empêchées par une configuration particulière.

À faire rapidement:

✅ vérifier la version réellement installée ;
✅ mettre WordPress à jour vers 6.9.5 ou 7.0.2 au minimum ;
✅ confirmer que la mise à jour s’est correctement terminée ;
✅ vérifier les comptes administrateurs, les fichiers récemment modifiés et les journaux du serveur ;
✅ rechercher d’éventuels fichiers PHP, plugins ou utilisateurs inconnus ;
✅ s’assurer que des sauvegardes propres et récentes sont disponibles.

En attendant la mise à jour, l’accès anonyme aux routes REST suivantes peut également être bloqué au niveau du WAF ou du serveur web :

/wp-json/batch/v1
?rest_route=/batch/v1

Point important : installer le correctif empêche une nouvelle exploitation, mais ne supprime pas une éventuelle compromission déjà présente. Si le site est resté exposé, une vérification minimale est donc nécessaire, même après la mise à jour.

Un site WordPress « qui fonctionne encore » n’est pas nécessairement un site sain : les attaquants cherchent souvent à rester discrets pour installer une porte dérobée, détourner le trafic, diffuser du spam ou préparer d’autres attaques...

🔍 wp2shell.com , pour vérifier si votre site est vulnérable.

Dans les news:
"WP2Shell - La faille qui permet de pirater WordPress sans aucun plugin"
👇
https://korben.info/wp2shell-exploits-prise-controle-wordpress.html

💬
⬇️
https://infosec.pub/post/49724018

#CyberVeille #WordPress

⚠️Alerte CERT-FR⚠️

Les vulnérabilités CVE-2026-60137 et CVE-2026-63030 affectent WordPress et permettent une exécution de code arbitraire à distance non authentifiée.
Une preuve de concept est disponible.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007/

wp2shell (CVE-2026-63030, CVE-2026-60137) allows unauth RCE in WordPress core (HIGH severity). Active exploitation reported. Patch to 6.9.5, 7.0.2, or 6.8.6. Block REST API batch endpoint if needed. Details: https://radar.offseq.com/threat/wp2shell-critical-wordpress-core-vulnerability-enabling-unauthenticated-rce-detection-and-mitigation-fccca7b8b6429718 #OffSeq #WordPress #RCE #Vulnerability

📈 CVE Published in last days (2026-07-13 - 2026-07-13)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 224
- High: 1087
- Medium: 754
- Low: 179
- None: 135

Status:
- : 75
- Analyzed: 539
- Awaiting Analysis: 531
- Deferred: 828
- Modified: 19
- Received: 236
- Rejected: 27
- Undergoing Analysis: 124

CISA KEVs:
- CISA-2026:0713 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0713)
- CISA-2026:0714 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0714)
- CISA-2026:0715 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0715)
- CISA-2026:0716 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0716)

Top CNAs:
- Microsoft Corporation: 576
- GitHub, Inc.: 418
- VulnCheck: 200
- VulDB: 162
- Patchstack: 149
- Adobe Systems Incorporated: 91
- MITRE: 77
- N/A: 75
- Wordfence: 59
- WPScan: 43

Top Affected Products:
- UNKNOWN: 1385
- Microsoft Windows Server 2025: 387
- Microsoft Windows 11 26h1: 382
- Microsoft Windows 11 24h2: 379
- Microsoft Windows 11 25h2: 379
- Microsoft Windows Server 2022: 324
- Microsoft Windows 10 21h2: 313
- Microsoft Windows 10 22h2: 313
- Microsoft Windows Server 2019: 310
- Microsoft Windows 10 1809: 310

Top EPSS Score:
- CVE-2026-50522 - 20.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-50522)
- CVE-2026-47992 - 19.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47992)
- CVE-2026-47996 - 18.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47996)
- CVE-2026-48356 - 17.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48356)
- CVE-2026-48332 - 11.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48332)
- CVE-2026-48320 - 9.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48320)
- CVE-2026-63030 - 8.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-63030)
- CVE-2026-48284 - 7.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48284)
- CVE-2026-50518 - 7.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-50518)
- CVE-2026-47999 - 7.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47999)

#ZEN #SecDB #InfoSec

wp2shell: a defender’s guide (CVE-2026-63030 + CVE-2026-60137) with a list of forensic artifacts, a compromise scanner WordPress plugin and a free Chrome/Edge/Firefox browser extension to in-browser check if a website has been patched. https://research.eye.security/wp2shell-defenders-guide/

🔵 THREAT INTELLIGENCE

Critical wp2shell WordPress flaws exploited to install webshells

Vulnerability | CRITICAL
CVEs: CVE-2026-60137, CVE-2026-63030

Hackers are exploiting the 'wp2shell' critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy persistent...

Full analysis:
https://www.yazoul.net/news/article/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells

#InfoSec #ZeroDay #SecurityOps

📰 CISA Adds Four Actively Exploited Flaws in DD-WRT, Langflow, WordPress

CISA adds 4 actively exploited vulnerabilities to its KEV catalog: CVE-2021-27137 (DD-WRT), CVE-2026-0770 (Langflow), and CVE-2026-63030 & CVE-2026-60137 (WordPress). Patching is urgent. #CISA #KEV #Vulnerability #PatchNow #WordPress

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/cisa-adds-four-actively-exploited-vulnerabilities-in-dd-wrt-langflow-wordpress-to-kev-catalog/?utm_s…

⚠️ THREAT ALERT: CVE-2026-60137 in WordPress Core enables unauthenticated SQL injection that chains for remote code execution! Active exploitation is confirmed. Get the forensic detection queries and hardening strategies you need to protect your web assets now. https://thecybermind.co/12b8

#CyberSecurity #InfoSec #WordPress #ThreatIntel

⚠️ THREAT ALERT: CVE-2026-60137 in WordPress Core enables unauthenticated SQL injection that chains for remote code execution! Active exploitation is confirmed. Get the forensic detection queries and hardening strategies you need to protect your web assets now. https://thecybermind.co/12b8

#CyberSecurity #InfoSec #WordPress #ThreatIntel

WordPressに認証不要でコード実行される緊急の脆弱性　即時更新を呼び掛け

https://www.itmedia.co.jp/news/articles/2607/21/news084.html

　WordPressの開発チームは7月17日（米国時間）、深刻な2件の脆弱性を修正したセキュリティリリース「WordPress 7.0.2」を公開した。

　1件は深刻度「Critical」（緊急）と評価された認証不要のリモートコード実行（RCE）の脆弱性（CVE-2026-63030）で、REST APIのバッチ処理エンドポイントを悪用されると、ログインやユーザーの操作なしに攻撃者が任意のコードを実行できる恐れがある。
もう1件は「High」（高）と評価されたSQLインジェクションの脆弱性（CVE-2026-60137）で、細工した入力によってデータベースへのクエリを改ざんされる可能性がある。なお、RCEはこのSQLインジェクションに起因しているという。

Critical wp2shell WordPress flaws exploited to install webshells

Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress Core to deploy...

🔗️ [Bleepingcomputer] https://link.is.it/KxezNe

🚨 [CISA-2026:0721] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0721)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2021-27137 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-27137)
- Name: DD-WRT Stack-Based Buffer Overflow Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: DD-WRT
- Product: DD-WRT
- Notes: This vulnerability affects a common open-source component, third-party library, proprietary implementation, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://svn.dd-wrt.com/changeset/45724 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-27137

⚠️ CVE-2026-0770 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-0770)
- Name: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/releases/tag/v1.9.0 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-0770

⚠️ CVE-2026-60137 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-60137)
- Name: WordPress Core SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: WordPress
- Product: Core
- Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137

⚠️ CVE-2026-63030 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-63030)
- Name: WordPress Core Interpretation Conflict Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: WordPress
- Product: Core
- Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260721 #cisa20260721 #cve_2021_27137 #cve_2026_0770 #cve_2026_60137 #cve_2026_63030 #cve202127137 #cve20260770 #cve202660137 #cve202663030

#IoC von #wp2shell suchen:

- Webserverlogs

`zgrep /batch/v1 *.log *.log.gz | egrep '45.79.167[.]238|34.81.132[.]62|79.177.131[.]206|15.157.135[.]170|94.100.52[.]128|172.235.128[.]52'`

- Wordpress-Verzeichnis

`find . -type f -print0 | xargs -0 md5sum | egrep '2a1410d8e2a8337ac2171cedea8c0fdc47c647a0|58eca847e9eae9e6b08cc211f1559817b71bc4cc|ebea44890f434d5d67ede22009a3f4bb5cac33f8|d9a220c8039f1c4d72cae7ccb8b3a33dec8815be|e9756e2338f84746007235e4cab7a70d5b3ca47f'`

https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

CVE ID: CVE-2026-60137
Vendor: WordPress
Product: Core
Date Added: 2026-07-21
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-60137

Broadcom has new advisories for two medium-severity vulnerabilities https://support.broadcom.com/web/ecx/security-advisory #Broadcom

CISA KEV updates:

- CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-27137

- CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-0770

- CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-63030

- CVE-2026-60137L WordPress Core SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-60137 #CISA #WordPress #vulnerability #infosec

wp2shell, a WordPress Core RCE chain (CVE-2026-63030, CVE-2026-60137), is exploited in the wild. Public PoC code is out. Patch WordPress now.

#wp2shell #WordPress #RCE #CVE202663030 #CVE202660137 #InfoSec #WebSecurity #PatchNow

https://securityonline.info/wp2shell-wordpress-core-rce/?utm_source=mastodon&utm_medium=jetpack_social

W cyberpodziemiu opublikowano exploity wykorzystujące krytyczne luki RCE typu „wp2shell” występujące przed uwierzytelnieniem, które dotyczą jądra WordPressa. W wersjach WordPressa 6.9.5 i 7.0.2 naprawiono cały łańcuch ataków typu wp2shell. Atak typu wp2shell składa się z dwóch luk – CVE-2026-63030 i CVE-2026-60137, które można połączyć w celu zdalnego wykonania kodu przed uwierzytelnieniem w instalacjach WordPressa w wersjach 6.9. i 7.0.

New.

Picus: CVE-2026-63030 and CVE-2026-60137 (wp2shell): WordPress RCE Explained https://www.picussecurity.com/resource/blog/cve-2026-63030-and-cve-2026-60137-wp2shell-wordpress-rce-explained #infosec #vulnerability #WordPress

⚠️ 📢 #Sicherheitswarnung: WordPress – Schwachstellen erlauben "Remote Code Execution"

Am 17. Juli 2026 wurde seitens #Wordpress eine Aktualisierung bekannt gegeben, die zwei #Schwachstellen in der Wordpress-Software behebt.

❗️ Die beiden Schwachstellen CVE-2026-60137 und CVE-2026-63030 ermöglichen einem nicht authentifizierten, entfernten Angreifer Code zur Ausführung zu bringen.

Mehr dazu hier: 👉️ https://www.bsi.bund.de/dok/1203360

@certbund

⚠️ Si vous administrez un site WordPress ou si vous connaissez quelqu’un qui en gère un faites passer l’information.

Une vulnérabilité critique baptisée WP2Shell touche directement le cœur de WordPress.

Cette fois, il ne s’agit pas d’un plugin abandonné ou d’un thème douteux : une installation standard peut être attaquée à distance, sans compte utilisateur, sans mot de passe et sans authentification préalable.

WP2Shell combine deux failles, CVE-2026-60137 et CVE-2026-63030, permettant à un attaquant d’exécuter du code sur le serveur et donc, potentiellement, de prendre le contrôle du site.

-> Des tentatives d’exploitation et des compromissions ont déjà été observées dans la nature.

Sont notamment concernées les versions :

➡️ WordPress 6.9.0 à 6.9.4
➡️ WordPress 7.0.0 à 7.0.1

Les correctifs sont disponibles dans les versions 6.9.5 et 7.0.2. WordPress a activé des mises à jour automatiques forcées en raison de la gravité de la faille, mais il ne faut pas supposer qu’elles ont forcément fonctionné : elles peuvent avoir été désactivées, bloquées par l’hébergeur ou empêchées par une configuration particulière.

À faire rapidement:

✅ vérifier la version réellement installée ;
✅ mettre WordPress à jour vers 6.9.5 ou 7.0.2 au minimum ;
✅ confirmer que la mise à jour s’est correctement terminée ;
✅ vérifier les comptes administrateurs, les fichiers récemment modifiés et les journaux du serveur ;
✅ rechercher d’éventuels fichiers PHP, plugins ou utilisateurs inconnus ;
✅ s’assurer que des sauvegardes propres et récentes sont disponibles.

En attendant la mise à jour, l’accès anonyme aux routes REST suivantes peut également être bloqué au niveau du WAF ou du serveur web :

/wp-json/batch/v1
?rest_route=/batch/v1

Point important : installer le correctif empêche une nouvelle exploitation, mais ne supprime pas une éventuelle compromission déjà présente. Si le site est resté exposé, une vérification minimale est donc nécessaire, même après la mise à jour.

Un site WordPress « qui fonctionne encore » n’est pas nécessairement un site sain : les attaquants cherchent souvent à rester discrets pour installer une porte dérobée, détourner le trafic, diffuser du spam ou préparer d’autres attaques...

🔍 wp2shell.com , pour vérifier si votre site est vulnérable.

Dans les news:
"WP2Shell - La faille qui permet de pirater WordPress sans aucun plugin"
👇
https://korben.info/wp2shell-exploits-prise-controle-wordpress.html

💬
⬇️
https://infosec.pub/post/49724018

#CyberVeille #WordPress

⚠️Alerte CERT-FR⚠️

Les vulnérabilités CVE-2026-60137 et CVE-2026-63030 affectent WordPress et permettent une exécution de code arbitraire à distance non authentifiée.
Une preuve de concept est disponible.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007/

wp2shell (CVE-2026-63030, CVE-2026-60137) allows unauth RCE in WordPress core (HIGH severity). Active exploitation reported. Patch to 6.9.5, 7.0.2, or 6.8.6. Block REST API batch endpoint if needed. Details: https://radar.offseq.com/threat/wp2shell-critical-wordpress-core-vulnerability-enabling-unauthenticated-rce-detection-and-mitigation-fccca7b8b6429718 #OffSeq #WordPress #RCE #Vulnerability

wp2shell: a defender’s guide (CVE-2026-63030 + CVE-2026-60137) with a list of forensic artifacts, a compromise scanner WordPress plugin and a free Chrome/Edge/Firefox browser extension to in-browser check if a website has been patched. https://research.eye.security/wp2shell-defenders-guide/

📰 CISA Adds Four Actively Exploited Flaws in DD-WRT, Langflow, WordPress

CISA adds 4 actively exploited vulnerabilities to its KEV catalog: CVE-2021-27137 (DD-WRT), CVE-2026-0770 (Langflow), and CVE-2026-63030 & CVE-2026-60137 (WordPress). Patching is urgent. #CISA #KEV #Vulnerability #PatchNow #WordPress

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/cisa-adds-four-actively-exploited-vulnerabilities-in-dd-wrt-langflow-wordpress-to-kev-catalog/?utm_s…

CISA Targets Langflow Flaw in Urgent Patch Directive

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent patch directive for a vulnerability in the Langflow visual framework, used to build AI agents, after recording over 220 exploitation attempts in just one day. This critical flaw, tracked as CVE-2026-0770, has already been exploited by multiple attackers, prompting…

https://osintsights.com/cisa-targets-langflow-flaw-in-urgent-patch-directive?utm_source=mastodon&utm_medium=social

#Cve20260770 #Langflow #AiAgents #KnownExploitedVulnerabilities #Kev

⚠️ CRITICAL THREAT: CVE-2026-0770 in Langflow enables remote code execution via untrusted control sphere inclusion. Active exploitation is confirmed. Get the forensic detection and input hardening strategies required to secure your AI pipelines today. https://thecybermind.co/aigl

#CyberSecurity #InfoSec #Langflow #AI #ThreatIntel

⚠️ CRITICAL THREAT: CVE-2026-0770 in Langflow enables remote code execution via untrusted control sphere inclusion. Active exploitation is confirmed. Get the forensic detection and input hardening strategies required to secure your AI pipelines today. https://thecybermind.co/aigl

#CyberSecurity #InfoSec #Langflow #AI #ThreatIntel

🚨 [CISA-2026:0721] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0721)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2021-27137 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-27137)
- Name: DD-WRT Stack-Based Buffer Overflow Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: DD-WRT
- Product: DD-WRT
- Notes: This vulnerability affects a common open-source component, third-party library, proprietary implementation, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://svn.dd-wrt.com/changeset/45724 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-27137

⚠️ CVE-2026-0770 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-0770)
- Name: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/releases/tag/v1.9.0 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-0770

⚠️ CVE-2026-60137 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-60137)
- Name: WordPress Core SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: WordPress
- Product: Core
- Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137

⚠️ CVE-2026-63030 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-63030)
- Name: WordPress Core Interpretation Conflict Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: WordPress
- Product: Core
- Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260721 #cisa20260721 #cve_2021_27137 #cve_2026_0770 #cve_2026_60137 #cve_2026_63030 #cve202127137 #cve20260770 #cve202660137 #cve202663030

CISA added four flaws to its KEV catalog, including WordPress RCE (CVE-2026-63030) and Langflow RCE (CVE-2026-0770). All are exploited in the wild.

#CISA #KEV #WordPress #Langflow #DDWRT #RCE #SQLInjection

https://securityonline.info/cisa-kev-four-exploited-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

CVE ID: CVE-2026-0770
Vendor: Langflow
Product: Langflow
Date Added: 2026-07-21
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-0770

Broadcom has new advisories for two medium-severity vulnerabilities https://support.broadcom.com/web/ecx/security-advisory #Broadcom

CISA KEV updates:

- CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-27137

- CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-0770

- CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-63030

- CVE-2026-60137L WordPress Core SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-60137 #CISA #WordPress #vulnerability #infosec

📰 CISA Adds Four Actively Exploited Flaws in DD-WRT, Langflow, WordPress

CISA adds 4 actively exploited vulnerabilities to its KEV catalog: CVE-2021-27137 (DD-WRT), CVE-2026-0770 (Langflow), and CVE-2026-63030 & CVE-2026-60137 (WordPress). Patching is urgent. #CISA #KEV #Vulnerability #PatchNow #WordPress

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/cisa-adds-four-actively-exploited-vulnerabilities-in-dd-wrt-langflow-wordpress-to-kev-catalog/?utm_s…

⚠️ CRITICAL THREAT: CVE-2021-27137 in DD-WRT allows unauthenticated remote code execution via UPnP. With active exploitation verified, edge defense is critical. Get the forensic detection and hardening strategies you need to secure your infrastructure. #CyberSecurity #InfoSec #DDWRT #Networking

https://thecybermind.co/5jv3

⚠️ CRITICAL THREAT: CVE-2021-27137 in DD-WRT allows unauthenticated remote code execution via UPnP. With active exploitation verified, edge defense is critical. Get the forensic detection and hardening strategies you need to secure your infrastructure. #CyberSecurity #InfoSec #DDWRT #Networking

https://thecybermind.co/5jv3

🚨 [CISA-2026:0721] CISA Adds 4 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0721)

CISA has added 4 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2021-27137 (https://secdb.nttzen.cloud/cve/detail/CVE-2021-27137)
- Name: DD-WRT Stack-Based Buffer Overflow Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: DD-WRT
- Product: DD-WRT
- Notes: This vulnerability affects a common open-source component, third-party library, proprietary implementation, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://svn.dd-wrt.com/changeset/45724 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2021-27137

⚠️ CVE-2026-0770 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-0770)
- Name: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: https://github.com/langflow-ai/langflow/releases/tag/v1.9.0 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-0770

⚠️ CVE-2026-60137 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-60137)
- Name: WordPress Core SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: WordPress
- Product: Core
- Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137

⚠️ CVE-2026-63030 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-63030)
- Name: WordPress Core Interpretation Conflict Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: WordPress
- Product: Core
- Notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260721 #cisa20260721 #cve_2021_27137 #cve_2026_0770 #cve_2026_60137 #cve_2026_63030 #cve202127137 #cve20260770 #cve202660137 #cve202663030

CVE ID: CVE-2021-27137
Vendor: DD-WRT
Product: DD-WRT
Date Added: 2026-07-21
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2021-27137

Broadcom has new advisories for two medium-severity vulnerabilities https://support.broadcom.com/web/ecx/security-advisory #Broadcom

CISA KEV updates:

- CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-27137

- CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-0770

- CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-63030

- CVE-2026-60137L WordPress Core SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-60137 #CISA #WordPress #vulnerability #infosec

🟠 CVE-2026-65315 - High (7.5)

Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65315/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65319 - High (7.5)

Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65319/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65319 - High (7.5)

Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65319/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65318 - High (8.6)

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65318/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65317 - High (8.6)

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a cra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65317/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-60926 - High severity privilege escalation in Oracle E-Business Suite Public Sector Payroll (12.2.3-12.2.15). CVSS 7.2. No patch available. Review access controls immediately. #CVE #Oracle #infosec

https://www.valtersit.com/cve/CVE-2026-60926/

CVE-2026-60785 - High-severity supply chain attack in Oracle iReceivables (E-Business Suite 12.2.3-12.2.15). Unauthenticated takeover via HTTP. CVSS 8.1. No patch available. Monitor and restrict access immediately. #CVE #Oracle #infosec

https://www.valtersit.com/cve/CVE-2026-60785/

CVE-2026-60799 - Oracle E-Business Suite (Compensation Workbench) info leak. Low-privilege HTTP exploit exposes critical data. CVSS 7.1. No patch yet. Restrict access now. #CVE #Oracle #infosec

https://www.valtersit.com/cve/CVE-2026-60799/

CVE-2026-60642 - High-severity DoS in Oracle WebCenter Content. Unauthenticated HTTP access. CVSS 7.6. No patch available. Mitigate immediately. #CVE #Oracle #infosec

https://www.valtersit.com/cve/CVE-2026-60642/

[1/3]

Most impactful security incidents / vulnerabilities reported between the last update (July 21‑22 2026) and today

1
• CVE‑2026‑60308
• Oracle Coherence (Core) – part of Oracle Fusion Middleware
• Remote, unauthenticated attacker can gain full control of the Coherence service (RCE / complete takeover).
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60308)
• Oracle [advisory](https://www.oracle.com/security-alerts/cpujul2026.html)

2
• CVE‑2026‑60306
• Oracle Coherence (Core)
• Same remote‑code‑execution / takeover scenario as above.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60306)

3
• CVE‑2026‑60300
• Oracle Coherence (Core)
• Remote unauthenticated takeover of the Coherence service.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60300)

4
• CVE‑2026‑60299
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60299)

5
• CVE‑2026‑60298
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60298)

6
• CVE‑2026‑60297
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60297)

7
• CVE‑2026‑60296
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60296)

8
• CVE‑2026‑60295 (not listed but implied by the series) – if present would follow same pattern; however, only the above IDs are confirmed in the supplied data.

#infosecnews

[1/3]

Most impactful security incidents / vulnerabilities reported between the last update (July 21‑22 2026) and today

1
• CVE‑2026‑60308
• Oracle Coherence (Core) – part of Oracle Fusion Middleware
• Remote, unauthenticated attacker can gain full control of the Coherence service (RCE / complete takeover).
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60308)
• Oracle [advisory](https://www.oracle.com/security-alerts/cpujul2026.html)

2
• CVE‑2026‑60306
• Oracle Coherence (Core)
• Same remote‑code‑execution / takeover scenario as above.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60306)

3
• CVE‑2026‑60300
• Oracle Coherence (Core)
• Remote unauthenticated takeover of the Coherence service.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60300)

4
• CVE‑2026‑60299
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60299)

5
• CVE‑2026‑60298
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60298)

6
• CVE‑2026‑60297
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60297)

7
• CVE‑2026‑60296
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60296)

8
• CVE‑2026‑60295 (not listed but implied by the series) – if present would follow same pattern; however, only the above IDs are confirmed in the supplied data.

#infosecnews

[1/3]

Most impactful security incidents / vulnerabilities reported between the last update (July 21‑22 2026) and today

1
• CVE‑2026‑60308
• Oracle Coherence (Core) – part of Oracle Fusion Middleware
• Remote, unauthenticated attacker can gain full control of the Coherence service (RCE / complete takeover).
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60308)
• Oracle [advisory](https://www.oracle.com/security-alerts/cpujul2026.html)

2
• CVE‑2026‑60306
• Oracle Coherence (Core)
• Same remote‑code‑execution / takeover scenario as above.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60306)

3
• CVE‑2026‑60300
• Oracle Coherence (Core)
• Remote unauthenticated takeover of the Coherence service.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60300)

4
• CVE‑2026‑60299
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60299)

5
• CVE‑2026‑60298
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60298)

6
• CVE‑2026‑60297
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60297)

7
• CVE‑2026‑60296
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60296)

8
• CVE‑2026‑60295 (not listed but implied by the series) – if present would follow same pattern; however, only the above IDs are confirmed in the supplied data.

#infosecnews

[1/3]

Most impactful security incidents / vulnerabilities reported between the last update (July 21‑22 2026) and today

1
• CVE‑2026‑60308
• Oracle Coherence (Core) – part of Oracle Fusion Middleware
• Remote, unauthenticated attacker can gain full control of the Coherence service (RCE / complete takeover).
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60308)
• Oracle [advisory](https://www.oracle.com/security-alerts/cpujul2026.html)

2
• CVE‑2026‑60306
• Oracle Coherence (Core)
• Same remote‑code‑execution / takeover scenario as above.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60306)

3
• CVE‑2026‑60300
• Oracle Coherence (Core)
• Remote unauthenticated takeover of the Coherence service.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60300)

4
• CVE‑2026‑60299
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60299)

5
• CVE‑2026‑60298
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60298)

6
• CVE‑2026‑60297
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60297)

7
• CVE‑2026‑60296
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60296)

8
• CVE‑2026‑60295 (not listed but implied by the series) – if present would follow same pattern; however, only the above IDs are confirmed in the supplied data.

#infosecnews

[1/3]

Most impactful security incidents / vulnerabilities reported between the last update (July 21‑22 2026) and today

1
• CVE‑2026‑60308
• Oracle Coherence (Core) – part of Oracle Fusion Middleware
• Remote, unauthenticated attacker can gain full control of the Coherence service (RCE / complete takeover).
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60308)
• Oracle [advisory](https://www.oracle.com/security-alerts/cpujul2026.html)

2
• CVE‑2026‑60306
• Oracle Coherence (Core)
• Same remote‑code‑execution / takeover scenario as above.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60306)

3
• CVE‑2026‑60300
• Oracle Coherence (Core)
• Remote unauthenticated takeover of the Coherence service.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60300)

4
• CVE‑2026‑60299
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60299)

5
• CVE‑2026‑60298
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60298)

6
• CVE‑2026‑60297
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60297)

7
• CVE‑2026‑60296
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60296)

8
• CVE‑2026‑60295 (not listed but implied by the series) – if present would follow same pattern; however, only the above IDs are confirmed in the supplied data.

#infosecnews

CVE-2026-60656 - Authentication bypass in Oracle WebCenter Content. Low-privilege network access leads to full takeover. CVSS 8.8. No patch yet. Mitigate immediately. #CVE #Oracle #infosec

https://www.valtersit.com/cve/CVE-2026-60656/

[1/3]

Most impactful security incidents / vulnerabilities reported between the last update (July 21‑22 2026) and today

1
• CVE‑2026‑60308
• Oracle Coherence (Core) – part of Oracle Fusion Middleware
• Remote, unauthenticated attacker can gain full control of the Coherence service (RCE / complete takeover).
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60308)
• Oracle [advisory](https://www.oracle.com/security-alerts/cpujul2026.html)

2
• CVE‑2026‑60306
• Oracle Coherence (Core)
• Same remote‑code‑execution / takeover scenario as above.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60306)

3
• CVE‑2026‑60300
• Oracle Coherence (Core)
• Remote unauthenticated takeover of the Coherence service.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60300)

4
• CVE‑2026‑60299
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60299)

5
• CVE‑2026‑60298
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60298)

6
• CVE‑2026‑60297
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60297)

7
• CVE‑2026‑60296
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60296)

8
• CVE‑2026‑60295 (not listed but implied by the series) – if present would follow same pattern; however, only the above IDs are confirmed in the supplied data.

#infosecnews

[1/3]

Most impactful security incidents / vulnerabilities reported between the last update (July 21‑22 2026) and today

1
• CVE‑2026‑60308
• Oracle Coherence (Core) – part of Oracle Fusion Middleware
• Remote, unauthenticated attacker can gain full control of the Coherence service (RCE / complete takeover).
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60308)
• Oracle [advisory](https://www.oracle.com/security-alerts/cpujul2026.html)

2
• CVE‑2026‑60306
• Oracle Coherence (Core)
• Same remote‑code‑execution / takeover scenario as above.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60306)

3
• CVE‑2026‑60300
• Oracle Coherence (Core)
• Remote unauthenticated takeover of the Coherence service.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60300)

4
• CVE‑2026‑60299
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60299)

5
• CVE‑2026‑60298
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60298)

6
• CVE‑2026‑60297
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60297)

7
• CVE‑2026‑60296
• Oracle Coherence (Core)
• Remote unauthenticated takeover via TCP/HTTP.
• 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0
• CVE [API](https://cveawg.mitre.org/api/cve/CVE-2026-60296)

8
• CVE‑2026‑60295 (not listed but implied by the series) – if present would follow same pattern; however, only the above IDs are confirmed in the supplied data.

#infosecnews

Oracle's July 2026 patch fixes 11 Oracle WebLogic Server vulnerabilities. CVE-2026-60206 rates CVSS 9.9 and allows full server takeover. Patch now.

#OracleWebLogic #CVE202660206 #WebLogicServer #OracleCPU #RCE #InfoSec

https://securityonline.info/oracle-weblogic-server-vulnerability-cve-2026-60206/?utm_source=mastodon&utm_medium=jetpack_social

Oracle's July 2026 patch fixes 11 Oracle WebLogic Server vulnerabilities. CVE-2026-60206 rates CVSS 9.9 and allows full server takeover. Patch now.

#OracleWebLogic #CVE202660206 #WebLogicServer #OracleCPU #RCE #InfoSec

https://securityonline.info/oracle-weblogic-server-vulnerability-cve-2026-60206/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-16221 - High (7.5)

Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, und...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16221/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-8983: Autel Maxi Charger Single ≤1.03.51 is affected by a CRITICAL flaw — hard-coded token bypasses authentication, exposing management endpoints. Restrict access & monitor for abuse. Patch status unknown. https://radar.offseq.com/threat/autel-maxi-charger-single-firmware-through-v10351-contains-a-hard-coded-authentication-token-that-cb2fec544a5f031e #OffSeq #CVE20268983 #IoTSecurity

🔴 CVE-2026-65057 - Critical (9.3)

Keep (commit 91c75e0) contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65057/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65056 - High (8.2)

mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visit_page tool, which only validates the UR...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-64877 - Critical (9.6)

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-64877/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-51027 - Critical (9.9)

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51027/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Gitea <1.27.0 has a CRITICAL flaw (CVE-2026-56750): Compromised Remember-Me tokens are not fully invalidated, letting attackers keep access indefinitely. Disable Remember-Me or monitor sessions. Details: https://radar.offseq.com/threat/gitea-remember-me-token-theft-not-invalidating-attacker-session-cve-2026-56750-48de19920dd712bf #OffSeq #Gitea #CVE202656750 #infosec

Gitea <1.27.0 has a CRITICAL flaw (CVE-2026-56750): Compromised Remember-Me tokens are not fully invalidated, letting attackers keep access indefinitely. Disable Remember-Me or monitor sessions. Details: https://radar.offseq.com/threat/gitea-remember-me-token-theft-not-invalidating-attacker-session-cve-2026-56750-48de19920dd712bf #OffSeq #Gitea #CVE202656750 #infosec

🟠 CVE-2026-55084 - High (8.8)

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the
`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-16412: CRITICAL memory safety issues in Firefox ESR 140.12 & 152 allow code execution, sandbox escape, info disclosure. Public exploits exist, but no in-the-wild attacks. Patch to 153/ESR 140.13. https://radar.offseq.com/threat/cve-2026-16412-vulnerability-in-mozilla-firefox-4b126d3842b74077 #OffSeq #Firefox #Vuln #Security

🟠 CVE-2026-62228 - High (8.8)

OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different gateway and node environments. Attackers can ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62228/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SolarWinds patched three critical Serv-U vulnerabilities (CVE-2026-28307/28308/28321). They allow privilege escalation and RCE. Update Serv-U to 2026.3.

#SolarWinds #ServU #PrivilegeEscalation #RCE #IDOR #Cybersecurity #Vulnerability

http://securityonline.info/solarwinds-serv-u-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

Nvidia update.

Security Bulletin: CVE-2026-24232: NVIDIA Transformers4Rec - July 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5869 #Nvidia

Dell has an update for a vulnerability affecting a dizzying number of CVEs.

Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR) Security Update for Multiple Third-Party Component Vulnerabilities https://www.dell.com/support/kbdoc/en-us/000488837/dsa-2026-311-dell-storage-resource-manager-srm-and-dell-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities #Dell #infosec #vulnerability

🟠 CVE-2026-44508 - High (8.1)

Rsync is a file-copying tool that uses a delta-transfer algorithm to synchronize remote and local files. In versions prior to 3.4.3, the receiver's compressed-token decoder accumulated a 32-bit signed counter without checking for overflow. A mali...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44508/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Ubuntu Vulnerability Exposes Local Users to Root Access Risk

A newly discovered vulnerability, CVE-2026-8933, puts users of Ubuntu Desktop 24.04, 25.10, and 26.04 at risk of full root access, allowing any local user to gain unrestricted control on default installs. This high-severity flaw can be easily exploited by a local, unprivileged user, making immediate attention crucial.

https://osintsights.com/ubuntu-vulnerability-exposes-local-users-to-root-access-risk?utm_source=mastodon&utm_medium=social

#UbuntuVulnerability #Cve20268933 #Qualys #Linux #LocalPrivilegeEscalation

Local Privilege Escalation in set-capabilities versions of snap-confine (CVE-2026-8933) https://lobste.rs/s/w7qez9 #linux #security
https://cdn2.qualys.com/advisory/2026/07/21/snap-confine-set-capabilities.txt

CVE-2026-8933 is a snap-confine privilege escalation flaw. It gives any user root on default Ubuntu Desktop 26.04, 25.10, and 24.04. Update snapd now.

#snapconfine #CVE20268933 #Ubuntu #PrivilegeEscalation #LPE #Linux #Qualys

http://securityonline.info/snap-confine-cve-2026-8933/?utm_source=mastodon&utm_medium=jetpack_social

Local Privilege Escalation in set-capabilities versions of snap-confine (CVE-2026-8933)

https://seclists.org/oss-sec/2026/q3/192

CVE-2026-13142 | CRITICAL: Social Login, Passkeys, Magic Link & Email OTP WordPress plugin (pre-1.4.1) allows OTP brute-force due to no rate limiting + plaintext storage. Admin takeover possible. Disable or restrict plugin use until patched. https://radar.offseq.com/threat/cve-2026-13142-cwe-269-improper-privilege-management-in-social-login-passkeys-magic-link-email-otp-82bfc0c2a799f534 #OffSeq #WordPress #Vuln

🟠 CVE-2026-47255 - High (8.2)

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47255/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-1617: CRITICAL SQL injection (CWE-89, CVSS 9.8) impacts Turkmesh Turkhotspot 5651 Loglama v5.1.2. No patch — restrict service access & monitor vendor for updates. Full system compromise possible. https://radar.offseq.com/threat/cve-2026-1617-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-f3444856e07fc06d #OffSeq #CVE2026_1617 #infosec #SQLi

CVE-2026-13439: CRITICAL vuln in Easy Form Builder (WordPress) allows unauth'd attackers to reset any user password — including admins — via public session IDs & nonce endpoint. Site takeover risk. Restrict endpoints, monitor resets. https://radar.offseq.com/threat/cve-2026-13439-cwe-269-improper-privilege-management-in-hassantafreshi-easy-form-builder-by-e77ced952b5f8053 #OffSeq #CVE202613439 #WordPress

CVE-2026-15899 (CRITICAL): Use-after-free in Chrome’s CameraCapture on Mac (<150.0.7871.128) enables remote sandbox escape. Update now to 150.0.7871.128. https://radar.offseq.com/threat/cve-2026-15899-use-after-free-in-google-chrome-4986d6558d1d6769 #OffSeq #CVE202615899 #Chrome #infosec

CVE-2026-15901: CRITICAL use-after-free in Chrome <150.0.7871.128 allows remote heap corruption via crafted HTML. No active exploits, patch status unclear — monitor advisories. https://radar.offseq.com/threat/cve-2026-15901-use-after-free-in-google-chrome-8afb124627400a01 #OffSeq #Chrome #Vuln #InfoSec

CVE-2026-64625 (CRITICAL): OS command injection in WWBN AVideo <29.0 via Live plugin's on_publish.php. Bypasses escapeshellarg(), enabling remote code execution. Restrict access & upgrade if possible. https://radar.offseq.com/threat/cve-2026-64625-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-injection-2085999102bd753d #OffSeq #CVE202664625 #WWBNAVideo #infosec

🔴 CVE-2026-64625 - Critical (9.8)

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-64625/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56452 - High (7.5)

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.

The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56452/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-64624 - High (7.8)

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive opt...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-64624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63108 - High (8.8)

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attackers to bypass allowlist/denylist enforcement by nesting command substitutions inside parameter expansion defaults. The command...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63108/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-59873: Decompression DoS Via Unlimited Input In node-tar, 90M Weekly Downloads Affected
#CVE_2026_59873
https://www.ox.security/blog/cve-2026-59873-decompression-dos-via-unlimited-input-in-node-tar-90m-weekly-downloads-affected/

🔴 CVE-2026-63766 - Critical (9.8)

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attacker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63766/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-63731 - High (7.7)

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63731/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-64619 - High (7.5)

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verifi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-64619/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-63767 - Critical (9.8)

ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63767/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-35198 - Critical (9)

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35198/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-57309 (CRITICAL, CVSS 9.3): Windu CMS 4.1 suffers from a blind SQL injection via HTTP header URL path. No patch yet — restrict exposed endpoints and monitor for abnormal DB activity. Details: https://radar.offseq.com/threat/cve-2026-57309-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-69fa2f89e7c44ad0 #OffSeq #SQLi #Vuln #CVE202657309

🟠 CVE-2026-54910 - High (7.7)

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54910/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

@cpansec How do I get incorrect/misleading information in a CVE fixed?

Specifically, CVE-2026-13577: "[...] silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable" should be "silently falls back to a built-in rand-derived session id when either Math::Random::ISAAC::XS or Crypt::URandom are unavailable."
Or perhaps better: "silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available."

@cpansec How do I get incorrect/misleading information in a CVE fixed?

Specifically, CVE-2026-13577: "[...] silently falls back to a built-in rand-derived session id when both Math::Random::ISAAC::XS and Crypt::URandom are unavailable" should be "silently falls back to a built-in rand-derived session id when either Math::Random::ISAAC::XS or Crypt::URandom are unavailable."
Or perhaps better: "silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available."

CVE-2026-13577 | HIGH severity in CROMEDOME Dancer2 ≤2.1.0: Predictable session IDs if CSPRNG modules are missing. Install Math::Random::ISAAC::XS/Crypt::URandom to mitigate. Full info: https://radar.offseq.com/threat/cve-2026-13577-cwe-340-generation-of-predictable-numbers-or-identifiers-in-cromedome-dancer2-858dec6ffe258cee #OffSeq #CVE202613577 #infosec #Perl

CVE-2026-63831: Linux kernel mac802154 llsec vuln (HIGH) could cause data corruption & kernel crashes via unsafe crypto ops on shared skb buffers. Update to patched kernel for stability. More: https://radar.offseq.com/threat/in-the-linux-kernel-the-following-vulnerability-has-been-resolved-mac802154-llsec-add-skbcowdata-9cf2707b26af2cc3 #OffSeq #Linux #CVE202663831 #Infosec

🟠 CVE-2026-63090 - High (8.8)

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63090/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

I'm more and more becoming convinced that CVE-2026-63795 is a joke/op/statement by the Linux CNA...

https://nvd.nist.gov/vuln/detail/cve-2026-63795

#cve202663795 #cve #linux #cve_2026_63795

keras-team/keras v3.15.0 suffers a HIGH severity deserialization flaw (CVE-2026-12484). Unsafe use of TorchModuleWrapper.from_config can lead to code execution via malicious PyTorch pickle files. Enforce safe deserialization or avoid untrusted configs. https://radar.offseq.com/threat/cve-2026-12484-cwe-502-deserialization-of-untrusted-data-in-keras-team-keras-teamkeras-e9d80dbe8b756225 #OffSeq #Keras #Infosec #CVE2026_12484

CVE-2026-12484 - Insecure Deserialization in Keras-Team. Unsafe PyTorch pickle loading in torch.load via TorchModuleWrapper.from_config. CVSS 7.8. Patch unknown, restrict usage immediately. #CVE #infosec #AIsecurity

https://www.valtersit.com/cve/CVE-2026-12484/

🟠 CVE-2026-12484 - High (7.8)

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-16242 (CRITICAL, CVSS 9.4) affects Red Hat Logging Subsystem for OpenShift: missing agent auth in Konnectivity proxy-server lets remote attackers intercept/control plane traffic. Restrict endpoint access & check https://radar.offseq.com/threat/cve-2026-16242-missing-authentication-for-critical-function-in-red-hat-logging-subsystem-for-red-hat-e02d26f300d35775 #OffSeq #RedHat #CVE202626242

OVH patched CVE-2026-53359, a critical KVM flaw, across tens of thousands of hosts in under 10 days without warning most clients first.

#OVHcloud #CVE202653359 #KVM #LinuxKernel #CloudSecurity

https://securityonline.info/ovh-cve-2026-53359-kvm-patch/?utm_source=mastodon&utm_medium=jetpack_social

Turns out, OVH had to patch all their hypervisors because of a vulnerability in KVM. This did lead to service disruptions to their customers.

https://blog.ovhcloud.com/cve-2026-53359-januscape-patching-campaign-lessons-learned-from-remediating-a-kvm-flaw-across-tens-of-thousands-of-machines/
- - -
Il se trouve, OVH a eu à corriger une vulnérabilité dans KVM sur tous leurs hyperviseurs. Ceci a entraîné des interruptions de service chez leur clientèle

https://blog.ovhcloud.com/campagne-de-patch-de-la-cve-2026-53359-januscape-retour-dexperience-sur-le-traitement-dune-faille-kvm-sur-plusieurs-dizaines-de-milliers-de-machines/

#OVH #Montréal

🟠 CVE-2026-13765 - High (7.5)

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer. This makes it possible for unauthenti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62386 - High (7.5)

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are lo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62386/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-11961 - High (8.1)

The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user rol...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-11961/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-13352 - High (8.8)

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed_m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62227 - High (7.7)

OpenClaw 2026.4.14 before 2026.5.26 contain a server-side request forgery vulnerability in browser snapshot routes that fail to validate post-navigation destinations. Attackers with lower-trust access can bypass OpenClaw policy checks to reach net...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62227/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-62241 - Critical (9.1)

clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId value...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62241/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62234 - High (8.1)

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62234/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚪️ Zoom for Windows patched a critical vulnerability

🗨️ Zoom’s developers have released updates for their Windows clients and SDK that address the critical vulnerability CVE-2026-53412. The bug allowed an unauthenticated attacker to remotely take over a victim’s account and received a CVSS score of 9.8. The issue was…

🔗 https://hackmag.com/news/zoom-patch?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

#news

⚠️ EXECUTIVE ALERT: CVE-2026-39808 enables OS command injection on Fortinet FortiSandbox. With active exploitation confirmed, this is a Tier 1 risk to your infrastructure. Is your organization prepared to defend its perimeter? Get the board-ready risk assessment and playbook today. https://thecybermind.co/7ou0

#CISO #InfoSec

⚠️ CRITICAL THREAT: CVE-2026-39808 in Fortinet FortiSandbox is being actively exploited. Attackers are leveraging OS command injection for remote code execution. Is your SOC ready? Get the forensic detection queries and hardening playbooks to lock down your perimeter. https://thecybermind.co/v66d

#CyberSecurity #InfoSec #Fortinet

⚠️ EXECUTIVE ALERT: CVE-2026-25089 targets FortiSandbox with critical remote code execution. With active exploitation confirmed, this is a Tier 1 disruption. Is your organization compliant with CISA mandates? Access our board-ready risk assessment and remediation framework today. https://thecybermind.co/w3pg

#CISO #CyberRisk

⚠️ CRITICAL THREAT: CVE-2026-25089 in FortiSandbox allows unauthenticated remote code execution. With active exploitation confirmed, immediate hardening is required. Deploy these compensating controls now to lock down your perimeter. https://thecybermind.co/mxq2

#CyberSecurity #InfoSec #Fortinet #ThreatIntel #CVE2026

⚠️Alerte CERT-FR⚠️

Les vulnérabilités CVE-2026-50522 et CVE-2026-58644 permettent une exécution de code arbitraire à distance non authentifiée sur SharePoint et sont activement exploitées.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-008/

⚠️Alerte CERT-FR⚠️

Les vulnérabilités CVE-2026-50522 et CVE-2026-58644 permettent une exécution de code arbitraire à distance non authentifiée sur SharePoint et sont activement exploitées.

https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-008/

⚠️ CRITICAL THREAT: CVE-2026-58644 targets Microsoft SharePoint via deserialization. Active exploitation is verified. Is your perimeter secured? Get the forensic detection queries and hardening playbooks you need to defend your infrastructure now. https://thecybermind.co/9pxn

#CyberSecurity #InfoSec #SharePoint #CVE2026

Geopolitical: US forces launched new airstrikes against Iran following military deaths in Jordan; shipping in the Strait of Hormuz is disrupted after a cargo ship attack.

Technology: The EU ordered Google to open Android to rival AI assistants and share search data. Cvent announced a $1 billion investment in AI for event management.

Cybersecurity: A critical Microsoft SharePoint Server RCE zero-day (CVE-2026-58644) is being actively exploited. A federal audit revealed significant gaps in US aviation cybersecurity oversight.

#AnonNews_irc #Cybersecurity #Technology

⚠️ CRITICAL: SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

UTA0533 has been actively exploiting two zero-day vulnerabilities in SonicWall SMA 1000 series VPN appliances since June 22, 2026, before vendor disclosure. The attacker chains CVE-2026-15409 and CVE-2026-15410 to achieve unauthenticated RCE, privilege escalation, and persistence via custom malware…

https://threatnoir.com/focus

#infosec #cybersecurity

ASUS security advisories cover seven flaws. CVE-2026-13385 (CVSS 9.5) lets MITM attackers run commands on CN SKU routers. Update firmware now.

#ASUS #ASUSWRT #RouterSecurity #CVE #InfoSec

https://securityonline.info/asus-security-advisories/?utm_source=mastodon&utm_medium=jetpack_social

Apache OpenMeetings vulnerability CVE-2026-49488 lets room moderators perform arbitrary file read and steal server secrets. Upgrade to version 9.1.0.

#ApacheOpenMeetings #PathTraversal #CVE202649488 #OpenSource #InfoSec

https://securityonline.info/openmeetings-file-read/?utm_source=mastodon&utm_medium=jetpack_social

Three Apache Fineract SQL injection flaws (CVE-2026-57821, CVE-2026-56287, CVE-2026-35152) let authenticated users exfiltrate data. Upgrade to 1.15.0.

#ApacheFineract #SQLInjection #CVE #CoreBanking #InfoSec

http://securityonline.info/apache-fineract-sql-injection/?utm_source=mastodon&utm_medium=jetpack_social

Three Apache Fineract SQL injection flaws (CVE-2026-57821, CVE-2026-56287, CVE-2026-35152) let authenticated users exfiltrate data. Upgrade to 1.15.0.

#ApacheFineract #SQLInjection #CVE #CoreBanking #InfoSec

http://securityonline.info/apache-fineract-sql-injection/?utm_source=mastodon&utm_medium=jetpack_social

Three Apache Fineract SQL injection flaws (CVE-2026-57821, CVE-2026-56287, CVE-2026-35152) let authenticated users exfiltrate data. Upgrade to 1.15.0.

#ApacheFineract #SQLInjection #CVE #CoreBanking #InfoSec

http://securityonline.info/apache-fineract-sql-injection/?utm_source=mastodon&utm_medium=jetpack_social

📈 CVE Published in last days (2026-07-13 - 2026-07-13)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 224
- High: 1087
- Medium: 754
- Low: 179
- None: 135

Status:
- : 75
- Analyzed: 539
- Awaiting Analysis: 531
- Deferred: 828
- Modified: 19
- Received: 236
- Rejected: 27
- Undergoing Analysis: 124

CISA KEVs:
- CISA-2026:0713 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0713)
- CISA-2026:0714 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0714)
- CISA-2026:0715 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0715)
- CISA-2026:0716 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0716)

Top CNAs:
- Microsoft Corporation: 576
- GitHub, Inc.: 418
- VulnCheck: 200
- VulDB: 162
- Patchstack: 149
- Adobe Systems Incorporated: 91
- MITRE: 77
- N/A: 75
- Wordfence: 59
- WPScan: 43

Top Affected Products:
- UNKNOWN: 1385
- Microsoft Windows Server 2025: 387
- Microsoft Windows 11 26h1: 382
- Microsoft Windows 11 24h2: 379
- Microsoft Windows 11 25h2: 379
- Microsoft Windows Server 2022: 324
- Microsoft Windows 10 21h2: 313
- Microsoft Windows 10 22h2: 313
- Microsoft Windows Server 2019: 310
- Microsoft Windows 10 1809: 310

Top EPSS Score:
- CVE-2026-50522 - 20.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-50522)
- CVE-2026-47992 - 19.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47992)
- CVE-2026-47996 - 18.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47996)
- CVE-2026-48356 - 17.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48356)
- CVE-2026-48332 - 11.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48332)
- CVE-2026-48320 - 9.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48320)
- CVE-2026-63030 - 8.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-63030)
- CVE-2026-48284 - 7.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48284)
- CVE-2026-50518 - 7.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-50518)
- CVE-2026-47999 - 7.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47999)

#ZEN #SecDB #InfoSec

@R1Rail
Au cas où, j'ai trouvé un lien sans pop-up GenAI : https://www.it-connect.fr/nginx-cve-2026-42533-faille-critique-map-regex/

Ça a l'air sérieux comme faille en tout cas.

@un_bourguignon ah je ne l'ai pas eu...

l'important c'est CVE-2026-42533 un RCE sans authentification, et POC annoncé pour le 5 août.

F5 patches a critical NGINX CVE-2026-42533 vulnerability causing remote code execution. Learn how to update your server and secure your configuration.

#NGINX #CVE202642533 #CyberSecurity #Vulnerability

https://meterpreter.org/nginx-cve-2026-42533-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

Postei no BR-Linux to avisando, e é sobre hora do upgrade.

FALHA CRÍTICA NO NGINX PODE TIRAR O SERVIDOR DO AR E ESTÁ NO CÓDIGO HÁ 15 ANOS

A vulnerabilidade CVE-2026-42533 no NGINX pode permitir que um invasor remoto e não autenticado sobrecarregue um buffer, levando a uma negação de serviço (DoS) e, teoricamente, à possibilidade de execução remota de código.

https://br-linux.org/2026/01/falha-critica-no-nginx-pode-tirar-o-servidor-do-ar-e-esta-no-codigo-ha-15-anos.html

NGINX – CVE-2026-42533 : cette faille peut faire planter votre serveur Web https://www.it-connect.fr/nginx-cve-2026-42533-faille-critique-map-regex/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Nginx #Web

CVE-2026-42533: Critical NGINX Bug Could Turn HTTP Requests Into Server Takeovers
#CVE_2026_42533
https://securityaffairs.com/195674/hacking/cve-2026-42533-critical-nginx-bug-could-turn-http-requests-into-server-takeovers.html

🏆 New Achievement! Two Passes, One Coffin!

We are gathered here today to mourn nginx's worker process, which died as it lived: faithfully measuring a buffer in one pass, then obediently writing something much larger into it on the next. CVE-2026-42533 is a heap buffer overflow triggered by crafted HTTP requests against a specific regex map configuration — no authentication required. The worker crashes. (1/3)

CVE-2026-42533 Exposes Critical Pre-Auth nginx RCE Flaw

A newly disclosed security flaw, CVE-2026-42533, has revealed a critical Pre-Auth nginx vulnerability that could allow attackers to achieve...

🔗️ [Thecyberexpress] https://link.is.it/pvxhto

15-Year-Old NGINX Vulnerability Lets Attackers Crash Workers and May Enable Remote Code Execution

https://thecybersecguru.com/news/cve-2026-42533-nginx-rce-vulnerability/

A TP-Link Kasa vulnerability (CVE-2026-9770) lets local attackers steal admin credentials via a hardcoded key. Patch your EC70 and EC71 firmware now.

#TPLink #Kasa #CVE20269770 #IoTSecurity #Cameras #ManInTheMiddle

https://meterpreter.org/tp-link-kasa-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

📈 CVE Published in last days (2026-07-13 - 2026-07-13)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 224
- High: 1087
- Medium: 754
- Low: 179
- None: 135

Status:
- : 75
- Analyzed: 539
- Awaiting Analysis: 531
- Deferred: 828
- Modified: 19
- Received: 236
- Rejected: 27
- Undergoing Analysis: 124

CISA KEVs:
- CISA-2026:0713 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0713)
- CISA-2026:0714 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0714)
- CISA-2026:0715 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0715)
- CISA-2026:0716 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0716)

Top CNAs:
- Microsoft Corporation: 576
- GitHub, Inc.: 418
- VulnCheck: 200
- VulDB: 162
- Patchstack: 149
- Adobe Systems Incorporated: 91
- MITRE: 77
- N/A: 75
- Wordfence: 59
- WPScan: 43

Top Affected Products:
- UNKNOWN: 1385
- Microsoft Windows Server 2025: 387
- Microsoft Windows 11 26h1: 382
- Microsoft Windows 11 24h2: 379
- Microsoft Windows 11 25h2: 379
- Microsoft Windows Server 2022: 324
- Microsoft Windows 10 21h2: 313
- Microsoft Windows 10 22h2: 313
- Microsoft Windows Server 2019: 310
- Microsoft Windows 10 1809: 310

Top EPSS Score:
- CVE-2026-50522 - 20.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-50522)
- CVE-2026-47992 - 19.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47992)
- CVE-2026-47996 - 18.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47996)
- CVE-2026-48356 - 17.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48356)
- CVE-2026-48332 - 11.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48332)
- CVE-2026-48320 - 9.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48320)
- CVE-2026-63030 - 8.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-63030)
- CVE-2026-48284 - 7.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48284)
- CVE-2026-50518 - 7.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-50518)
- CVE-2026-47999 - 7.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47999)

#ZEN #SecDB #InfoSec

📈 CVE Published in last days (2026-07-13 - 2026-07-13)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 224
- High: 1087
- Medium: 754
- Low: 179
- None: 135

Status:
- : 75
- Analyzed: 539
- Awaiting Analysis: 531
- Deferred: 828
- Modified: 19
- Received: 236
- Rejected: 27
- Undergoing Analysis: 124

CISA KEVs:
- CISA-2026:0713 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0713)
- CISA-2026:0714 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0714)
- CISA-2026:0715 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0715)
- CISA-2026:0716 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0716)

Top CNAs:
- Microsoft Corporation: 576
- GitHub, Inc.: 418
- VulnCheck: 200
- VulDB: 162
- Patchstack: 149
- Adobe Systems Incorporated: 91
- MITRE: 77
- N/A: 75
- Wordfence: 59
- WPScan: 43

Top Affected Products:
- UNKNOWN: 1385
- Microsoft Windows Server 2025: 387
- Microsoft Windows 11 26h1: 382
- Microsoft Windows 11 24h2: 379
- Microsoft Windows 11 25h2: 379
- Microsoft Windows Server 2022: 324
- Microsoft Windows 10 21h2: 313
- Microsoft Windows 10 22h2: 313
- Microsoft Windows Server 2019: 310
- Microsoft Windows 10 1809: 310

Top EPSS Score:
- CVE-2026-50522 - 20.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-50522)
- CVE-2026-47992 - 19.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47992)
- CVE-2026-47996 - 18.03 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47996)
- CVE-2026-48356 - 17.90 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48356)
- CVE-2026-48332 - 11.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48332)
- CVE-2026-48320 - 9.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48320)
- CVE-2026-63030 - 8.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-63030)
- CVE-2026-48284 - 7.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-48284)
- CVE-2026-50518 - 7.36 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-50518)
- CVE-2026-47999 - 7.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-47999)