🟠 CVE-2026-34394 - High (8.1)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34394/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34394 - High (8.1)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's admin plugin configuration endpoint (admin/save.json.php) lacks any CSRF token validation. There is no call to isGlobalTokenValid() or verifyToken() before processi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34394/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-32957 - High (8.7)

baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, which is then automatically extracted. A PHP file inside the archive is included using require_once without...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-32957/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-21861: CRITICAL OS command injection in baserCMS < 5.2.3. Admins can execute arbitrary system commands via core update. Patch to 5.2.3+ ASAP to prevent full compromise. https://radar.offseq.com/threat/cve-2026-21861-cwe-78-improper-neutralization-of-s-7b86deef #OffSeq #baserCMS #CVE2026_21861 #infosec #patching

🔴 CVE-2026-21861 - Critical (9.1)

baserCMS is a website development framework. Prior to version 5.2.3, baserCMS contains an OS command injection vulnerability in the core update functionality. An authenticated administrator can execute arbitrary OS commands on the server due to im...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

baserCMS < 5.2.3 hit by CRITICAL OS command injection (CVE-2026-30880, CVSS 9.2). Remote unauthenticated RCE possible via installer. Patch to 5.2.3+ now or restrict installer access! https://radar.offseq.com/threat/cve-2026-30880-cwe-78-improper-neutralization-of-s-5ac38c48 #OffSeq #baserCMS #Vuln #infosec

CVE ID: CVE-2026-5281
Vendor: Google
Product: Dawn
Date Added: 2026-04-01
Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-5281
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5281

🟠 CVE-2026-5281 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Google on Tuesday released security updates for its Chrome web browser to address 21 vulnerabilities, including a zero-day flaw that it said has been exploited in the wild.

https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html

CVE-2026-5281 (Use after free in Dawn) included with this is a zero day

Amongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.

Amongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.

Upstream release notes have been published. This release includes fixes for 21 CVES. Google is aware that an exploit for CVE-2026-5281 exists in the wild. chromereleases.googleblog.com/2026/03/stab...

RE: https://bsky.app/profile/did:plc:6ol7vfhxcbk3ylrlbbioxlav/post/3mifg4rzfh22x

Stable Channel Update for Desk...

CVE ID: CVE-2026-5281
Vendor: Google
Product: Dawn
Date Added: 2026-04-01
Notes: This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-5281
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5281

🟠 CVE-2026-5281 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-5281 (Use after free in Dawn) included with this is a zero day

Amongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.

Amongst other security improvements from Chromium upstream it includes a fix for CVE-2026-5281 (Use after free in Dawn), which has a known exploit in the wild.

Upstream release notes have been published. This release includes fixes for 21 CVES. Google is aware that an exploit for CVE-2026-5281 exists in the wild. chromereleases.googleblog.com/2026/03/stab...

RE: https://bsky.app/profile/did:plc:6ol7vfhxcbk3ylrlbbioxlav/post/3mifg4rzfh22x

Stable Channel Update for Desk...

🟠 CVE-2026-34506 - High (7.5)

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty group...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34506/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34506 - High (7.5)

OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty group...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34506/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33576 - Critical (9.8)

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rej...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33576/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35056 - High (8.8)

XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71282 - High (7.5)

XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain information about the server's directory structure.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71278 - High (8.8)

XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5, potentially allowing client applications to gain access beyond thei...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34162 - Critical (10)

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-sup...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34162/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34163 - High (7.7)

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP (Model Context Protocol) tools endpoints (/api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool) accept a user-supplied URL parameter and make server-s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34163/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34453 - High (7.5)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters boo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33949 - High (8.1)

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33949/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33949 - High (8.1)

Tina is a headless content management system. Prior to version 2.2.2, a path traversal vulnerability in @tinacms/graphql allows unauthenticated users to write and overwrite arbitrary files within the project root. This is achieved by manipulating ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33949/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

And (drum roll) .... here it is. Grab a coffee, Cisco's having a bad hair day.

New.

Critical: CVE-2026-20160: Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-cli-execution-cHUcWuNr

Also new:

Critical: CVE-2026-20093: Cisco Integrated Management Controller Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn

Three high-severity entries:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-improp-auth-mUwFWUU3

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt

Four medium-severity entries toward the end of today's list: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #Cisco #vulnerability

@cR0w

And (drum roll) .... here it is. Grab a coffee, Cisco's having a bad hair day.

New.

Critical: CVE-2026-20160: Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-cli-execution-cHUcWuNr

Also new:

Critical: CVE-2026-20093: Cisco Integrated Management Controller Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn

Three high-severity entries:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-improp-auth-mUwFWUU3

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt

Four medium-severity entries toward the end of today's list: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #Cisco #vulnerability

@cR0w

And (drum roll) .... here it is. Grab a coffee, Cisco's having a bad hair day.

New.

Critical: CVE-2026-20160: Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-cli-execution-cHUcWuNr

Also new:

Critical: CVE-2026-20093: Cisco Integrated Management Controller Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn

Three high-severity entries:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-improp-auth-mUwFWUU3

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt

Four medium-severity entries toward the end of today's list: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #Cisco #vulnerability

@cR0w

And (drum roll) .... here it is. Grab a coffee, Cisco's having a bad hair day.

New.

Critical: CVE-2026-20160: Cisco Smart Software Manager On-Prem Arbitrary Command Execution Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssm-cli-execution-cHUcWuNr

Also new:

Critical: CVE-2026-20093: Cisco Integrated Management Controller Authentication Bypass Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-auth-bypass-AgG2BxTn

Three high-severity entries:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-epnm-improp-auth-mUwFWUU3

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-xRAnOuO8

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cimc-cmd-inj-3hKN3bVt

Four medium-severity entries toward the end of today's list: https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #infosec #Cisco #vulnerability

@cR0w

🟠 CVE-2026-5278 - High (8.8)

Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5278 - High (8.8)

Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5284 - High (7.5)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5284 - High (7.5)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5288 - Critical (9.6)

Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5288 - Critical (9.6)

Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5289 - Critical (9.6)

Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5289 - Critical (9.6)

Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5290 - Critical (9.6)

Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5290 - Critical (9.6)

Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5277 - High (7.5)

Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5277 - High (7.5)

Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5275 - High (8.8)

Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5275 - High (8.8)

Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5274 - High (8.8)

Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5274 - High (8.8)

Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5274/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5272 - High (8.8)

Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5272/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5272 - High (8.8)

Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5272/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5087 - High (7.5)

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.

PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5087/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5087 - High (7.5)

PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for Perl generates random bytes insecurely.

PAGI::Middleware::Session::Store::Cookie attempts to read bytes from the /dev/urandom device directly. If that fails (for example, on s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5087/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4748 - High (7.5)

A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4748 - High (7.5)

A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates. Only the first of such rules is actually l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4748/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3308 - High (7.8)

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds writ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3308/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3308 - High (7.8)

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdf_load_image_imp' function. This allows a heap out-of-bounds writ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3308/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34430 - High (8.8)

ByteDance Deer-Flow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34430/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34430 - High (8.8)

ByteDance Deer-Flow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based validation using shell features such...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34430/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33373 - High (8.8)

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state tr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33373 - High (8.8)

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A Cross-Site Request Forgery (CSRF) vulnerability exists in Zimbra Web Client due to the issuance of authentication tokens without CSRF protection during certain account state tr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-29014 - Critical (9.8)

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-29014 - Critical (9.8)

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5292 - High (8.8)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5292 - High (8.8)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-2696: HIGH severity flaw in Export All URLs WP plugin (<5.1) leaks private post URLs via brute-forcible CSV files in uploads/. No auth needed. Upgrade ASAP & restrict dir access! https://radar.offseq.com/threat/cve-2026-2696-cwe-200-information-exposure-in-expo-c6c7420f #OffSeq #WordPress #CVE20262696

🚨 CVE-2026-2696: HIGH severity flaw in Export All URLs WP plugin (<5.1) leaks private post URLs via brute-forcible CSV files in uploads/. No auth needed. Upgrade ASAP & restrict dir access! https://radar.offseq.com/threat/cve-2026-2696-cwe-200-information-exposure-in-expo-c6c7420f #OffSeq #WordPress #CVE20262696

🟠 CVE-2026-5286 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-5286: HIGH severity use-after-free in Chrome’s Dawn component <146.0.7680.178. Remote code execution possible via crafted HTML. Patch now to stay protected! https://radar.offseq.com/threat/cve-2026-5286-use-after-free-in-google-chrome-34aabe80 #OffSeq #Chrome #Vuln #InfoSec

🟠 CVE-2026-5286 - High (8.8)

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-5286: HIGH severity use-after-free in Chrome’s Dawn component <146.0.7680.178. Remote code execution possible via crafted HTML. Patch now to stay protected! https://radar.offseq.com/threat/cve-2026-5286-use-after-free-in-google-chrome-34aabe80 #OffSeq #Chrome #Vuln #InfoSec

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35092 - High (7.5)

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a remote, unauthenticated attacker to send crafted User Datagram Protocol (UDP) packets. This can cause the service to crash, leadi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35091 - High (8.2)

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35091/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5282 - High (8.1)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5282 - High (8.1)

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-4747
🧐

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747): https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

Discussion: http://news.ycombinator.com/item?id=47597119

📰 Today's Top 20 Hacker News Stories (Sorted by Score) 📰
----------------------------------------
🔖 Title: Claude Code Unpacked : A visual guide
🔗 URL: https://ccunpacked.dev/
👍 Score: [944]
💬 Discussion: https://news.ycombinator.com/item?id=47597085
----------------------------------------
🔖 Title: CERN levels up with new superconducting karts
🔗 URL: https://home.cern/news/news/engineering/cern-levels-new-superconducting-karts
👍 Score: [343]
💬 Discussion: https://news.ycombinator.com/item?id=47597935
----------------------------------------
🔖 Title: EmDash – a spiritual successor to WordPress that solves plugin security
🔗 URL: https://blog.cloudflare.com/emdash-wordpress/
👍 Score: [245]
💬 Discussion: https://news.ycombinator.com/item?id=47602832
----------------------------------------
🔖 Title: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)
🔗 URL: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
👍 Score: [198]
💬 Discussion: https://news.ycombinator.com/item?id=47597119
----------------------------------------
🔖 Title: Is BGP safe yet?
🔗 URL: https://isbgpsafeyet.com/
👍 Score: [196]
💬 Discussion: https://news.ycombinator.com/item?id=47600382
----------------------------------------
🔖 Title: Show HN: CLI to order groceries via reverse-engineered REWE API (Haskell)
🔗 URL: https://github.com/yannick-cw/korb
👍 Score: [177]
💬 Discussion: https://news.ycombinator.com/item?id=47571183
----------------------------------------
🔖 Title: NASA Artemis II moon mission live launch broadcast
🔗 URL: https://plus.nasa.gov/scheduled-video/nasas-artemis-ii-crew-launches-to-the-moon-official-broadcast/
👍 Score: [139]
💬 Discussion: https://news.ycombinator.com/item?id=47603657
----------------------------------------
🔖 Title: The OpenAI Graveyard: All the Deals and Products That Haven't Happened
🔗 URL: https://www.forbes.com/sites/phoebeliu/2026/03/31/openai-graveyard-deals-and-products-havent-happened-openai/
👍 Score: [132]
💬 Discussion: https://news.ycombinator.com/item?id=47602565
----------------------------------------
🔖 Title: Intuiting Pratt Parsing
🔗 URL: https://louis.co.nz/2026/03/26/pratt-parsing.html
👍 Score: [121]
💬 Discussion: https://news.ycombinator.com/item?id=47573450
----------------------------------------
🔖 Title: StepFun 3.5 Flash is #1 cost-effective model for OpenClaw tasks (300 battles)
🔗 URL: https://app.uniclaw.ai/arena?tab=costEffectiveness&via=hn
👍 Score: [80]
💬 Discussion: https://news.ycombinator.com/item?id=47602879
----------------------------------------
🔖 Title: Random numbers, Persian code: A mysterious signal transfixes radio sleuths
🔗 URL: https://www.rferl.org/a/mystery-numbers-station-persian-signal-iran-war/33700659.html
👍 Score: [74]
💬 Discussion: https://news.ycombinator.com/item?id=47599510
----------------------------------------
🔖 Title: Consider the Greenland Shark (2020)
🔗 URL: https://www.lrb.co.uk/the-paper/v42/n09/katherine-rundell/consider-the-greenland-shark
👍 Score: [68]
💬 Discussion: https://news.ycombinator.com/item?id=47539945
----------------------------------------
🔖 Title: The Document Foundation ejects its core developers
🔗 URL: https://www.collaboraonline.com/blog/tdf-ejects-its-core-developers/
👍 Score: [67]
💬 Discussion: https://news.ycombinator.com/item?id=47599305
----------------------------------------
🔖 Title: What Is Copilot Exactly?
🔗 URL: https://idiallo.com/blog/what-is-copilot-exactly
👍 Score: [62]
💬 Discussion: https://news.ycombinator.com/item?id=47603231
----------------------------------------
🔖 Title: AI for American-Produced Cement and Concrete
🔗 URL: https://engineering.fb.com/2026/03/30/data-center-engineering/ai-for-american-produced-cement-and-concrete/
👍 Score: [57]
💬 Discussion: https://news.ycombinator.com/item?id=47603737
----------------------------------------
🔖 Title: Show HN: Real-time dashboard for Claude Code agent teams
🔗 URL: https://github.com/simple10/agents-observe
👍 Score: [44]
💬 Discussion: https://news.ycombinator.com/item?id=47602986
----------------------------------------
🔖 Title: Show HN: Zerobox – Sandbox any command with file and network restrictions
🔗 URL: https://github.com/afshinm/zerobox
👍 Score: [36]
💬 Discussion: https://news.ycombinator.com/item?id=47574871
----------------------------------------
🔖 Title: Ada and Spark on ARM Cortex-M – A Tutorial with Arduino and Nucleo Examples
🔗 URL: http://inspirel.com/articles/Ada_On_Cortex.html
👍 Score: [36]
💬 Discussion: https://news.ycombinator.com/item?id=47552144
----------------------------------------
🔖 Title: Randomness on Apple Platforms (2024)
🔗 URL: https://blog.xoria.org/randomness-on-apple-platforms/
👍 Score: [34]
💬 Discussion: https://news.ycombinator.com/item?id=47543205
----------------------------------------

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747) - https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#hackernews

Wow, #Claude, you wrote a remote kernel #RCE with a root shell for FreeBSD? 🙄 I’m sure this groundbreaking achievement will be a thrilling bedtime story for security experts everywhere. 🤦‍♂️ Meanwhile, GitHub is still doing cartwheels about #AI writing better code so we can break it even faster. 💥
https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md #FreeBSD #cybersecurity #coding #HackerNews #ngated

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#HackerNews #FreeBSD #RCE #Security #CVE-2026-4747 #RootShell #CyberSecurity

Claude wrote a full FreeBSD remote kernel RCE with root shell

https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#freebsd #github

https://github.com/califio/publications/tree/main/MADBugs/CVE-2026-4747
🧐

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

Link: https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md
Discussion: https://news.ycombinator.com/item?id=47597119

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

Wow, #Claude, you wrote a remote kernel #RCE with a root shell for FreeBSD? 🙄 I’m sure this groundbreaking achievement will be a thrilling bedtime story for security experts everywhere. 🤦‍♂️ Meanwhile, GitHub is still doing cartwheels about #AI writing better code so we can break it even faster. 💥
https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md #FreeBSD #cybersecurity #coding #HackerNews #ngated

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#HackerNews #FreeBSD #RCE #Security #CVE-2026-4747 #RootShell #CyberSecurity

Claude wrote a full FreeBSD remote kernel RCE with root shell

https://github.com/califio/publications/blob/main/MADBugs/CVE-2026-4747/write-up.md

#freebsd #github

@AmenZwa
MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)
https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747) https://lobste.rs/s/hsykbh #freebsd #security #vibecoding
https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747) https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

Claude Wrote a Full #FreeBSD Remote Kernel #RCE with Root Shell (CVE-2026-4747): https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

🔴 CVE-2026-3256 - Critical (9.8)

HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids.

HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3256 - Critical (9.8)

HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids.

HTTP::Session defaults to using HTTP::Session::ID::SHA1 to generate session ids using a SHA-1 hash seeded with the built-in rand function, the high r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-2275 - Critical (9.6)

The CrewAI CodeInterpreter tool falls back to SandboxPython when it cannot reach Docker, which can enable RCE through arbitrary C function calling.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2275/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29925 - High (7.7)

Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29925 - High (7.7)

Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29924 - High (7.6)

Grav CMS v1.7.x and before is vulnerable to XML External Entity (XXE) through the SVG file upload functionality in the admin panel and File Manager plugin.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29924/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29953 - High (7.5)

SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert function in file plugins/postgres/lib/column.go.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29953/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29954 - High (7.6)

In KubePlus 4.1.4, the mutating webhook and kubeconfiggenerator components have an SSRF vulnerability when processing the chartURL field of ResourceComposition resources. The field is only URL-encoded without validating the target address. More cr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29954/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30077 - High (7.5)

OpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures result in a crash. But the crash is consistent for particular inputs. An example input in hex stream is 80 00 00 0E 00 00 01 00 0F 80 02 02 40 00 58 0...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30077/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29872 - High (8.2)

A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). The affected Streamlit-based GitHub MCP Agent stores user-supplied API tokens in process-w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29872/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 New security advisory:

CVE-2026-34361 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-34361-hapi-fhir-auth-token-theft

#Cybersecurity #VulnerabilityManagement #CyberSec

🔴 CVE-2026-34361 - Critical (9.3)

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34361/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34504 - High (8.3)

OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal URLs. A malicious or compromised fal relay can exploit unguarded imag...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34504/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24164 - High (8.8)

NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24164/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-0596 - Critical (9.6)

A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0596/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-0596 - Critical (9.6)

A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0596/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34243 - Critical (9.8)

wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34243/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34243 - Critical (9.8)

wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34243/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30309 - High (7.8)

InfCode's terminal auto-execution module contains a critical command filtering vulnerability that renders its blacklist security mechanism completely ineffective. The predefined blocklist fails to cover native high-risk commands in Windows PowerSh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30309/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5204 - High (8.8)

A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15618 - Critical (9.1)

Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key.

Business::OnlinePayment::StoredTransaction generates a secret key by using a MD5 hash of a single call to the built-in rand function, which is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15618/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34214 - High (7.7)

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34214 - High (7.7)

Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32920 - Critical (9.8)

OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32920/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32916 - High (7.7)

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32916/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32982 - High (7.5)

OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are em...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-10551 - High (8.7)

A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-10551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-10551 - High (8.7)

A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-10551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-10553 - High (8.7)

A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-10553/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34070 - High (7.5)

LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34070/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34070 - High (7.5)

LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34070/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34070 - High (7.5)

LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34070/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32716 - High (8.1)

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the Enforcer incorrectly validates scope paths by using a simple prefix match (startswith). This allows a token with access to a specific path (e.g., /joh...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32716/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34042 - High (8.2)

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the inte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4020 - High (7.5)

The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4. This is due to a REST API endpoint registered at /wp-json/gravitysmtp/v1/tests/mock-data with a permission_callback ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4020/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-4257 in Contact Form by Supsystic (all versions) enables unauth RCE via SSTI (Twig). No patch yet. Disable plugin or block endpoints ASAP. Details: https://radar.offseq.com/threat/cve-2026-4257-cwe-94-improper-control-of-generatio-c9e2f160 #OffSeq #WordPress #CVE20264257 #SSTI #RCE

🔴 CVE-2026-4257 - Critical (9.8)

The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is due to the plugin using the Twig `Twig_Loader_St...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4257/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5155 - High (8.8)

A vulnerability was found in Tenda CH22 1.0.0.1. This affects the function fromAdvSetWan of the file /goform/AdvSetWan of the component Parameter Handler. The manipulation of the argument wanmode results in stack-based buffer overflow. The attack ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34557 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within group ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34557/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34557 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within group ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34557/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5152 - High (8.8)

A vulnerability was detected in Tenda CH22 1.0.0.1. Impacted is the function formCreateFileName of the file /goform/createFileName. Performing a manipulation of the argument fileNameMit results in stack-based buffer overflow. The attack may be ini...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5152 - High (8.8)

A vulnerability was detected in Tenda CH22 1.0.0.1. Impacted is the function formCreateFileName of the file /goform/createFileName. Performing a manipulation of the argument fileNameMit results in stack-based buffer overflow. The attack may be ini...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35093 - High (8.8)

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or user configuration directories can bypass security restrictions. This allows the attacker to run unauthorized code with the sam...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15484 - Critical (9.1)

The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15484 - Critical (9.1)

The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, enabling complete read/write access to store resources like products, coupons, an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Authentication Bypass in Anritsu Remote Spectrum Monitors Left Unpatched

CISA and Anritsu report a critical authentication bypass vulnerability (CVE-2026-3356) affecting all versions of its Remote Spectrum Monitors, which the company does not plan to patch. The flaw allows unauthenticated remote attackers to take full control of the devices, potentially disrupting critical communications and defense infrastructure.

**Since Anritsu will not patch this critical flaw, these devices are permanently insecure. Make sure to isolate them from the internet and all untrusted networks. Ideally, consider replacing them with hardware that supports modern authentication standards because no isolation is perfect.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-in-anritsu-remote-spectrum-monitors-left-unpatched-d-4-h-z-o/gD2P6Ple2L

⚡️ CVE-2026-3356 (CVSS 9.3): Anritsu MS27100A lacks authentication for management — remote attackers can access & control all versions. No patch yet. Urgent: segment networks & restrict access! https://radar.offseq.com/threat/cve-2026-3356-cwe-306-missing-authentication-for-c-80869dad #OffSeq #CVE20263356 #IoTSecurity #Infosec

Critical Authentication Bypass in Anritsu Remote Spectrum Monitors Left Unpatched

CISA and Anritsu report a critical authentication bypass vulnerability (CVE-2026-3356) affecting all versions of its Remote Spectrum Monitors, which the company does not plan to patch. The flaw allows unauthenticated remote attackers to take full control of the devices, potentially disrupting critical communications and defense infrastructure.

**Since Anritsu will not patch this critical flaw, these devices are permanently insecure. Make sure to isolate them from the internet and all untrusted networks. Ideally, consider replacing them with hardware that supports modern authentication standards because no isolation is perfect.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-in-anritsu-remote-spectrum-monitors-left-unpatched-d-4-h-z-o/gD2P6Ple2L

⚡️ CVE-2026-3356 (CVSS 9.3): Anritsu MS27100A lacks authentication for management — remote attackers can access & control all versions. No patch yet. Urgent: segment networks & restrict access! https://radar.offseq.com/threat/cve-2026-3356-cwe-306-missing-authentication-for-c-80869dad #OffSeq #CVE20263356 #IoTSecurity #Infosec

⚠️ CVE-2026-23898: HIGH-severity flaw in Joomla! CMS (4.0.0-5.4.3, 6.0.0-6.0.3) lets admin-level attackers delete arbitrary files, risking DoS or system compromise. Patch ASAP, restrict high-priv accounts, monitor for deletions. https://radar.offseq.com/threat/cve-2026-23898-cwe-73-destructive-file-deletion-an-4b16a48a #OffSeq #Joomla #Vuln

⚠️ CVE-2026-23898: HIGH-severity flaw in Joomla! CMS (4.0.0-5.4.3, 6.0.0-6.0.3) lets admin-level attackers delete arbitrary files, risking DoS or system compromise. Patch ASAP, restrict high-priv accounts, monitor for deletions. https://radar.offseq.com/threat/cve-2026-23898-cwe-73-destructive-file-deletion-an-4b16a48a #OffSeq #Joomla #Vuln

🟠 CVE-2026-5211 - High (8.8)

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 202602...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5211 - High (8.8)

A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 202602...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34367 - High (7.6)

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation mod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34367/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34367 - High (7.6)

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.2.0, a Server-Side Request Forgery (SSRF) vulnerability exists in the Invoice PDF generation mod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34367/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5213 - High (8.8)

A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5213 - High (8.8)

A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34448 - Critical (9)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -> Asset ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34448/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34448 - Critical (9)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From -> Asset ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34448/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL alert: CVE-2026-34448 in SiYuan (<3.6.2) enables stored XSS, escalating to OS command execution via unsafe Electron configs. Patch to 3.6.2+ & tighten app security! Details: https://radar.offseq.com/threat/cve-2026-34448-cwe-79-improper-neutralization-of-i-36bc82a3 #OffSeq #SiYuan #CVE202634448 #XSS #infosec

🟠 CVE-2025-13855 - High (7.6)

IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13855/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13855 - High (7.6)

IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13855/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3779 - High (7.8)

The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted documents to trigger a use-after-free when the calculation runs and can potentially lead to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3779/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32726 - High (8.1)

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass in path-based scope validation. The enforcer used a simple string-prefix comparison w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32726/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32726 - High (8.1)

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass in path-based scope validation. The enforcer used a simple string-prefix comparison w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32726/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32725 - High (8.3)

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path fr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32725/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5190 - High (7.5)

Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted ev...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5190/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26060 - High (8.8)

Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic could allow previously issued password reset tokens to remain valid after a user changes their password. As a result, a stale ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26060/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71281 - High (8.8)

XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter first-word match for methods accessible through callbacks and variable method calls in templates, potential...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3775 - High (7.8)

The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privileged users and is not strictly restricted to trusted system locations. Because these l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3775/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71279 - Critical (9.8)

XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromise the security of Passkey-based authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5214 - High (8.8)

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-34558 in ci4ms (<0.31.0.0) — Stored DOM XSS in Methods Management lets attackers inject persistent JS into admin panels. Patch to 0.31.0.0+ ASAP! Details: https://radar.offseq.com/threat/cve-2026-34558-cwe-79-improper-neutralization-of-i-198231a4 #OffSeq #XSS #Vuln #AppSec

🔴 CVE-2026-34558 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Me...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34558 - Critical (9.1)

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Me...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34558/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34585 - High (8.6)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a vulnerability allows crafted block attribute values to bypass server-side attribute escaping when an HTML entity is mixed with raw special characters. An attacker can embe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34585/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33578 - Critical (9.8)

OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33578/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33578 - Critical (9.8)

OpenClaw before 2026.3.28 contains a sender policy bypass vulnerability in the Google Chat and Zalouser extensions where route-level group allowlist policies silently downgrade to open policy. Attackers can exploit this policy resolution flaw to b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33578/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33577 - Critical (9.8)

OpenClaw before 2026.3.28 contains an insufficient scope validation vulnerability in the node pairing approval path that allows low-privilege operators to approve nodes with broader scopes. Attackers can exploit missing callerScopes validation in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33577/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34503 - High (7.5)

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34503/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34449 - Critical (9.6)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-C...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34449/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34449 - Critical (9.6)

SiYuan is a personal knowledge management system. Prior to version 3.6.2, a malicious website can achieve Remote Code Execution (RCE) on any desktop running SiYuan by exploiting the permissive CORS policy (Access-Control-Allow-Origin: * + Access-C...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34449/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-34449: CRITICAL RCE in SiYuan (<3.6.2) via permissive CORS. Visiting a malicious site while SiYuan runs allows OS-level code exec. Patch to 3.6.2+ ASAP! https://radar.offseq.com/threat/cve-2026-34449-cwe-942-permissive-cross-domain-pol-0cb7b35e #OffSeq #SiYuan #CVE202634449 #RCE #InfoSec

🟠 CVE-2026-34381 - High (7.5)

Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34381/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34381 - High (7.5)

Admidio is an open-source user management solution. From version 5.0.0 to before version 5.0.8, Admidio relies on adm_my_files/.htaccess to deny direct HTTP access to uploaded documents. The Docker image ships with AllowOverride None in the Apache...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34381/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34240 - High (7.5)

JOSE is a Javascript Object Signing and Encryption (JOSE) library. Prior to version 0.3.5+1, a vulnerability in jose could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk). Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34240/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32727 - High (8.1)

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.7, the Enforcer is vulnerable to a path traversal attack where an attacker can use dot-dot (..) in the scope claim of a token to escape the intended director...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32727/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-32714 - Critical (9.8)

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (su...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32714/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 CRITICAL: CVE-2026-30877 in baserCMS (<5.2.3) enables admin users to execute arbitrary OS commands via update functionality (CWE-78). Patch to 5.2.3+ immediately! https://radar.offseq.com/threat/cve-2026-30877-cwe-78-improper-neutralization-of-s-36a348b4 #OffSeq #baserCMS #CVE202630877 #infosec

🔴 CVE-2026-30877 - Critical (9.1)

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30877/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30877 - Critical (9.1)

baserCMS is a website development framework. Prior to version 5.2.3, there is an OS command injection vulnerability in the update functionality. Due to this issue, an authenticated user with administrator privileges in baserCMS can execute arbitra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30877/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4851 - Critical (9.8)

GRID::Machine versions through 0.127 for Perl allows arbitrary code execution via unsafe deserialization.

GRID::Machine provides Remote Procedure Calls (RPC) over SSH for Perl. The client connects to remote hosts to execute code on them. A compro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4851/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Authentication Bypass in PX4 Autopilot Allows Remote Drone Takeover

PX4 Autopilot version v1.16.0 is vulnerable to a critical authentication bypass (CVE-2026-1579) that allows unauthenticated attackers to execute arbitrary shell commands via the MAVLink protocol. This flaw enables full system takeover of drones and autonomous vehicles used in defense and transportation.

**If you use PX4 Autopilot, you must enable MAVLink 2.0 message signing to prevent unauthorized command execution. Without this cryptographic check, anyone who can reach your drone's communication interface can take full control of the aircraft.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-authentication-bypass-in-px4-autopilot-allows-remote-drone-takeover-h-o-k-m-n/gD2P6Ple2L

🔴 CVE-2026-1579 - Critical (9.8)

The MAVLink communication protocol does not require cryptographic
authentication by default. When MAVLink 2.0 message signing is not
enabled, any message -- including SERIAL_CONTROL, which provides
interactive shell access -- can be sent by an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1579/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack