OpenClaw – CVE-2026-25253 : un lien malveillant suffit à exécuter du code à distance en 1-clic https://www.it-connect.fr/openclaw-cve-2026-25253-un-lien-malveillant-suffit-a-executer-du-code-a-distance-en-1-clic/ #ActuCybersécurité #Cybersécurité #IA

depthfirst | 1-Click RCE To Steal Your Moltbot Data and Keys (CVE-2026-25253)

https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys

#databreach #vulnerability #exploit #openclaw #moltbot

Here's a summary of the latest global, technology, and cybersecurity news from the last 24-48 hours:

**Global:** US-Iran talks on a nuclear deal are progressing, though Iran warned of regional war if attacked (Feb 1-2). A Russian drone strike killed 15 mineworkers in Dnipro, Ukraine (Feb 1).

**Tech/Cybersecurity:** ETSI launched a new, globally applicable cybersecurity standard for AI models (ETSI EN 304 223, Feb 2). A critical remote code execution (RCE) flaw in the OpenClaw AI assistant (CVE-2026-25253) was disclosed (Feb 2). AI-driven cyber threats are escalating, and Microsoft's extensive AI infrastructure spending is raising Wall Street concerns (Jan 30 - Feb 2).

#News #Anonymous #AnonNews_irc

🟠 CVE-2026-25253 - High (8.8)

OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25253/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

OpenClaw – CVE-2026-25253 : un lien malveillant suffit à exécuter du code à distance en 1-clic https://www.it-connect.fr/openclaw-cve-2026-25253-un-lien-malveillant-suffit-a-executer-du-code-a-distance-en-1-clic/ #ActuCybersécurité #Cybersécurité #IA

depthfirst | 1-Click RCE To Steal Your Moltbot Data and Keys (CVE-2026-25253)

https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys

#databreach #vulnerability #exploit #openclaw #moltbot

Here's a summary of the latest global, technology, and cybersecurity news from the last 24-48 hours:

**Global:** US-Iran talks on a nuclear deal are progressing, though Iran warned of regional war if attacked (Feb 1-2). A Russian drone strike killed 15 mineworkers in Dnipro, Ukraine (Feb 1).

**Tech/Cybersecurity:** ETSI launched a new, globally applicable cybersecurity standard for AI models (ETSI EN 304 223, Feb 2). A critical remote code execution (RCE) flaw in the OpenClaw AI assistant (CVE-2026-25253) was disclosed (Feb 2). AI-driven cyber threats are escalating, and Microsoft's extensive AI infrastructure spending is raising Wall Street concerns (Jan 30 - Feb 2).

#News #Anonymous #AnonNews_irc

🟠 CVE-2026-25253 - High (8.8)

OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25253/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20402 - High (7.5)

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. Use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20402/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20402 - High (7.5)

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. Use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20402/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20409 - High (7.8)

In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Pat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20409/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20409 - High (7.8)

In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Pat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20409/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20404 - High (7.5)

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. Use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20404 - High (7.5)

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. Use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20404 - High (7.5)

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. Use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20404 - High (7.5)

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. Use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20422 - High (7.5)

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. Use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20422 - High (7.5)

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. Use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24071 - Critical (9.3)

It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The connection handler...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24071 - Critical (9.3)

It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The connection handler...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24071 - Critical (9.3)

It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The connection handler...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24071 - Critical (9.3)

It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting client to verify its code signature. This is considered insecure and can be exploited by PID reuse attacks. The connection handler...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-9974 - High (8.8)

The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged aut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-9974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-9974 - High (8.8)

The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged aut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-9974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-9974 - High (8.8)

The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged aut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-9974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-9974 - High (8.8)

The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged aut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-9974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15030 - Critical (9.8)

The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15030/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-15030 - Critical (9.8)

The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-15030/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47358 - High (7.8)

Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47358/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47358 - High (7.8)

Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47358/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47399 - High (7.8)

Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47399 - High (7.8)

Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20408 - High (8)

In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20408/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20408 - High (8)

In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20408/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20419 - High (7.5)

In wlan AP/STA firmware, there is a possible system becoming irresponsive due to an uncaught exception. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20419/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20419 - High (7.5)

In wlan AP/STA firmware, there is a possible system becoming irresponsive due to an uncaught exception. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20419/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1117 - High (8.2)

A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_genera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1117/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1117 - High (8.2)

A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_genera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1117/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1531 - High (8.1)

A flaw was found in foreman_kubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set. This insecure default allows a remote attacker, capable of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1531/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1531 - High (8.1)

A flaw was found in foreman_kubevirt. When configuring the connection to OpenShift, the system disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set. This insecure default allows a remote attacker, capable of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1531/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24788 - High (8.8)

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24788/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24788 - High (8.8)

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24788/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25201 - High (8.8)

An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server.
This issue affects MagicINFO 9 Server: less than 21.1090.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25201/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25201 - High (8.8)

An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server.
This issue affects MagicINFO 9 Server: less than 21.1090.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25201/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-5319 - Critical (9.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Information and Communication Technologies Industry and Trade Ltd. Co. Efficiency Management System allows SQL Injection.This issue affects ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-5319/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-5319 - Critical (9.8)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Information and Communication Technologies Industry and Trade Ltd. Co. Efficiency Management System allows SQL Injection.This issue affects ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-5319/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25022 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Blind SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.16.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25022/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25022 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Blind SQL Injection.This issue affects KiviCare: from n/a through <= 3.6.16.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25022/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-6397 - High (8.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ankara Hosting Website Design Website Software allows Reflected XSS.This issue affects Website Software: through 03022026. 

NOTE: The ve...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-6397/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-6397 - High (8.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ankara Hosting Website Design Website Software allows Reflected XSS.This issue affects Website Software: through 03022026. 

NOTE: The ve...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-6397/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-7760 - High (7.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ofisimo Web-Based Software Technologies Association Web Package Flora allows XSS Through HTTP Headers.This issue affects Association Web P...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-7760/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-7760 - High (7.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ofisimo Web-Based Software Technologies Association Web Package Flora allows XSS Through HTTP Headers.This issue affects Association Web P...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-7760/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67848 - High (8.1)

A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the us...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67848/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67848 - High (8.1)

A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the us...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67848/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67853 - High (7.5)

A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67853/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67853 - High (7.5)

A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enumerate or guess user credentials, facilitating brute-force attacks ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67853/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-8461 - High (7.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Seres Software syWEB allows Reflected XSS.This issue affects syWEB: through 03022026. 

NOTE: The vendor was contacted early about this d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8461/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-8461 - High (7.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Seres Software syWEB allows Reflected XSS.This issue affects syWEB: through 03022026. 

NOTE: The vendor was contacted early about this d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8461/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #programmingAtKukei https://masto.kukei.eu/browse/programming category:
- Claude Code at Microsoft and the rise of AI coding assistants; OpenAI Codex app for macOS.
- OpenClaw/Moltbot vulnerabilities and security concerns around AI agents.
- Ingress-Nginx deprecation and multiple Kubernetes security exploits.
- CVE-2026-25142: SandboxJS JavaScript sandboxing library high-severity flaw.
- CVE-2026-1730: [1/2]

🔴 CVE-2026-25142 - Critical (10)

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25142/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25142 - Critical (10)

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25142/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24694 - High (7.8)

The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute arbitrary code with the privileges of the application.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24694/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24694 - High (7.8)

The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute arbitrary code with the privileges of the application.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24694/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-66480 - Critical (9.8)

Wildfire IM is an instant messaging and real-time audio/video solution. Prior to 1.4.3, a critical vulnerability exists in the im-server component related to the file upload functionality found in com.xiaoleilu.loServer.action.UploadFileAction. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-66480 - Critical (9.8)

Wildfire IM is an instant messaging and real-time audio/video solution. Prior to 1.4.3, a critical vulnerability exists in the im-server component related to the file upload functionality found in com.xiaoleilu.loServer.action.UploadFileAction. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23997 - High (8)

FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where hist...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23997/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23997 - High (8)

FacturaScripts is open-source enterprise resource planning and accounting software. In 2025.71 and earlier, a Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Observations field. The flaw occurs in the History view, where hist...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23997/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25059 - High (8.8)

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25059 - High (8.8)

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, the application contains path traversal vulnerability in multiple file operation handlers in server/handles/fsmanage.go. Filename components in req.Names are directly concatenated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25137 - Critical (9.1)

The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and downloa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25137/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25137 - Critical (9.1)

The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and downloa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25137/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Security Advisory: Database and filestore publicly accessible with default Odoo configuration (CVE-2026-25137)

https://discourse.nixos.org/t/security-advisory-database-and-filestore-publicly-accessible-with-default-odoo-configuration-cve-2026-25137/74894

#security #nixpkgs #nixos

CISA has updated the KEV catalogue.

- CVE-2019-19006: Sangoma FreePBX Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2019-19006

- CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-64328

- CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-39935 #CISA #infosec #GitLab #vulnerability

CVE ID: CVE-2025-64328
Vendor: Sangoma
Product: FreePBX
Date Added: 2026-02-03
Notes: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw ; https://nvd.nist.gov/vuln/detail/CVE-2025-64328
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-64328

CISA has updated the KEV catalogue.

- CVE-2019-19006: Sangoma FreePBX Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2019-19006

- CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-64328

- CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-39935 #CISA #infosec #GitLab #vulnerability

CVE ID: CVE-2025-64328
Vendor: Sangoma
Product: FreePBX
Date Added: 2026-02-03
Notes: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw ; https://nvd.nist.gov/vuln/detail/CVE-2025-64328
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-64328

FortiGuard Labs analyses EncystPHP, a weaponized web shell delivering remote command execution, persistence and further web shell deployment. It spreads by exploiting FreePBX vulnerability CVE-2025-64328 and is linked to the INJ3CTOR3 actor. https://www.fortinet.com/blog/threat-research/unveiling-the-weaponized-web-shell-encystphp

CISA has updated the KEV catalogue.

- CVE-2019-19006: Sangoma FreePBX Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2019-19006

- CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-64328

- CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-39935 #CISA #infosec #GitLab #vulnerability

CVE ID: CVE-2021-39935
Vendor: GitLab
Product: Community and Enterprise Editions
Date Added: 2026-02-03
Notes: https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2021-39935
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2021-39935

CISA has updated the KEV catalogue.

- CVE-2019-19006: Sangoma FreePBX Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2019-19006

- CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-64328

- CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-39935 #CISA #infosec #GitLab #vulnerability

CVE ID: CVE-2021-39935
Vendor: GitLab
Product: Community and Enterprise Editions
Date Added: 2026-02-03
Notes: https://about.gitlab.com/releases/2021/12/06/security-release-gitlab-14-5-2-released/ ; https://nvd.nist.gov/vuln/detail/CVE-2021-39935
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2021-39935

CISA has updated the KEV catalogue.

- CVE-2019-19006: Sangoma FreePBX Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2019-19006

- CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-64328

- CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-39935 #CISA #infosec #GitLab #vulnerability

CVE ID: CVE-2019-19006
Vendor: Sangoma
Product: FreePBX
Date Added: 2026-02-03
Notes: https://wiki.freepbx.org/display/FOP/2019-11-20%2BRemote%2BAdmin%2BAuthentication%2BBypass ; https://nvd.nist.gov/vuln/detail/CVE-2019-19006
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2019-19006

CISA has updated the KEV catalogue.

- CVE-2019-19006: Sangoma FreePBX Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2019-19006

- CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-64328

- CVE-2021-39935: GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability https://www.cve.org/CVERecord?id=CVE-2021-39935 #CISA #infosec #GitLab #vulnerability

CVE ID: CVE-2019-19006
Vendor: Sangoma
Product: FreePBX
Date Added: 2026-02-03
Notes: https://wiki.freepbx.org/display/FOP/2019-11-20%2BRemote%2BAdmin%2BAuthentication%2BBypass ; https://nvd.nist.gov/vuln/detail/CVE-2019-19006
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2019-19006

🟠 CVE-2026-25060 - High (8.1)

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in inter...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25060/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25060 - High (8.1)

OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in inter...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25060/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24763 - High (8.8)

OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw’s Docker sandbox execution mechanism due to unsafe handling of the PATH environment v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24763/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24763 - High (8.8)

OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw’s Docker sandbox execution mechanism due to unsafe handling of the PATH environment v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24763/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24763 - High (8.8)

OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw’s Docker sandbox execution mechanism due to unsafe handling of the PATH environment v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24763/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24763 - High (8.8)

OpenClaw (formerly Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw’s Docker sandbox execution mechanism due to unsafe handling of the PATH environment v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24763/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24737 - High (8.1)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24737/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24737 - High (8.1)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24737/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24737 - High (8.1)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24737/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24737 - High (8.1)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24737/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-23515 - Critical (9.9)

Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23515/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-23515 - Critical (9.9)

Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23515/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22778 - Critical (9.8)

vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22778 - Critical (9.8)

vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1375 - High (8.1)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `cou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1375/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1375 - High (8.1)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `cou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1375/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24465 - Critical (9.8)

Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices. A crafted packet may lead to arbitrary code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24465/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-24465 - Critical (9.8)

Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices. A crafted packet may lead to arbitrary code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24465/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-8456 - High (7.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kod8 Software Technologies Trade Ltd. Co. Kod8 Individual and SME Website allows Reflected XSS.This issue affects Kod8 Individual and SME ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8456/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-8456 - High (7.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kod8 Software Technologies Trade Ltd. Co. Kod8 Individual and SME Website allows Reflected XSS.This issue affects Kod8 Individual and SME ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8456/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Blip blop, I'm a #mastobot.
Here is a summary (in beta) of the latest posts in #programmingAtKukei https://masto.kukei.eu/browse/programming category:
- Claude Code at Microsoft and the rise of AI coding assistants; OpenAI Codex app for macOS.
- OpenClaw/Moltbot vulnerabilities and security concerns around AI agents.
- Ingress-Nginx deprecation and multiple Kubernetes security exploits.
- CVE-2026-25142: SandboxJS JavaScript sandboxing library high-severity flaw.
- CVE-2026-1730: [1/2]

🟠 CVE-2026-1730 - High (8.8)

The OS DataHub Maps plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'OS_DataHub_Maps_Admin::add_file_and_ext' function in all versions up to, and including, 1.8.3. This makes it possible fo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1730/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1730 - High (8.8)

The OS DataHub Maps plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'OS_DataHub_Maps_Admin::add_file_and_ext' function in all versions up to, and including, 1.8.3. This makes it possible fo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1730/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-8590 - High (7.5)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Directory Indexing.This issue affects SKSPro: through 07012026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-8590 - High (7.5)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Directory Indexing.This issue affects SKSPro: through 07012026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8590/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-8589 - High (7.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Reflected XSS.This issue affects SKSPro: through 07012026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8589/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-8589 - High (7.6)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows Reflected XSS.This issue affects SKSPro: through 07012026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8589/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20407 - High (8.8)

In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20407/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20407 - High (8.8)

In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20407/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20406 - High (7.5)

In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20406/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20406 - High (7.5)

In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20406/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20421 - High (7.5)

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. Use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20421/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20421 - High (7.5)

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. Use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20421/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20420 - High (7.5)

In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20420/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20420 - High (7.5)

In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20420/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-63649 - High (7.5)

An out-of-bounds read in the http_parser_transfer_encoding_chunked function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST request to the server.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-63649/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-63649 - High (7.5)

An out-of-bounds read in the http_parser_transfer_encoding_chunked function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST request to the server.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-63649/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20403 - High (7.5)

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20403/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20403 - High (7.5)

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20403/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20405 - High (7.5)

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20405/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20405 - High (7.5)

In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20405/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71007 - High (7.5)

An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71007/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71007 - High (7.5)

An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71007/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71007 - High (7.5)

An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71007/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0599 - High (7.5)

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Mark...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0599/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-0599 - High (7.5)

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploit unbounded external image fetching during input validation in VLM mode. The issue arises when the router scans inputs for Mark...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0599/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20411 - High (7.8)

In cameraisp, there is a possible escalation of privilege due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20411 - High (7.8)

In cameraisp, there is a possible escalation of privilege due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1530 - High (8.1)

A flaw was found in fog-kubevirt. This vulnerability allows a remote attacker to perform a Man-in-the-Middle (MITM) attack due to disabled certificate validation. This enables the attacker to intercept and potentially alter sensitive communication...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1530/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1530 - High (8.1)

A flaw was found in fog-kubevirt. This vulnerability allows a remote attacker to perform a Man-in-the-Middle (MITM) attack due to disabled certificate validation. This enables the attacker to intercept and potentially alter sensitive communication...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1530/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

‼️AISLE Goes 12-for-12 on OpenSSL Vulnerability Detection

CVEs Published: January 27th, 2026

High and Moderate Severity Flaws:

▪️CVE-2025-15467: Stack Buffer Overflow in CMS AuthEnvelopedData Parsing (High): A vulnerability with the potential to enable remote code execution under specific conditions

▪️CVE-2025-11187: PBMAC1 Parameter Validation in PKCS#12 (Moderate): Missing validation that could trigger a stack-based buffer overflow

Low Severity Flaws:

▪️CVE-2025-15468: Crash in QUIC protocol cipher handling
▪️CVE-2025-15469: Silent truncation bug affecting post-quantum signature algorithms (ML-DSA)
▪️CVE-2025-66199: Memory exhaustion via TLS 1.3 certificate compression
▪️CVE-2025-68160: Memory corruption in line-buffering (affects code back to OpenSSL 1.0.2)
▪️CVE-2025-69418: Encryption flaw in OCB mode on hardware-accelerated paths
▪️CVE-2025-69419: Memory corruption in PKCS#12 character encoding
▪️CVE-2025-69420: Crash in TimeStamp Response verification
▪️CVE-2025-69421: Crash in PKCS#12 decryption
▪️CVE-2026-22795: Crash in PKCS#12 parsing
▪️CVE-2026-22796: Crash in PKCS#7 signature verification (affects code back to OpenSSL 1.0.2)

"When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs.

Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk."

Writeup: https://aisle.com/blog/aisle-discovered-12-out-of-12-openssl-vulnerabilities

‼️AISLE Goes 12-for-12 on OpenSSL Vulnerability Detection

CVEs Published: January 27th, 2026

High and Moderate Severity Flaws:

▪️CVE-2025-15467: Stack Buffer Overflow in CMS AuthEnvelopedData Parsing (High): A vulnerability with the potential to enable remote code execution under specific conditions

▪️CVE-2025-11187: PBMAC1 Parameter Validation in PKCS#12 (Moderate): Missing validation that could trigger a stack-based buffer overflow

Low Severity Flaws:

▪️CVE-2025-15468: Crash in QUIC protocol cipher handling
▪️CVE-2025-15469: Silent truncation bug affecting post-quantum signature algorithms (ML-DSA)
▪️CVE-2025-66199: Memory exhaustion via TLS 1.3 certificate compression
▪️CVE-2025-68160: Memory corruption in line-buffering (affects code back to OpenSSL 1.0.2)
▪️CVE-2025-69418: Encryption flaw in OCB mode on hardware-accelerated paths
▪️CVE-2025-69419: Memory corruption in PKCS#12 character encoding
▪️CVE-2025-69420: Crash in TimeStamp Response verification
▪️CVE-2025-69421: Crash in PKCS#12 decryption
▪️CVE-2026-22795: Crash in PKCS#12 parsing
▪️CVE-2026-22796: Crash in PKCS#7 signature verification (affects code back to OpenSSL 1.0.2)

"When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs.

Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk."

Writeup: https://aisle.com/blog/aisle-discovered-12-out-of-12-openssl-vulnerabilities

‼️AISLE Goes 12-for-12 on OpenSSL Vulnerability Detection

CVEs Published: January 27th, 2026

High and Moderate Severity Flaws:

▪️CVE-2025-15467: Stack Buffer Overflow in CMS AuthEnvelopedData Parsing (High): A vulnerability with the potential to enable remote code execution under specific conditions

▪️CVE-2025-11187: PBMAC1 Parameter Validation in PKCS#12 (Moderate): Missing validation that could trigger a stack-based buffer overflow

Low Severity Flaws:

▪️CVE-2025-15468: Crash in QUIC protocol cipher handling
▪️CVE-2025-15469: Silent truncation bug affecting post-quantum signature algorithms (ML-DSA)
▪️CVE-2025-66199: Memory exhaustion via TLS 1.3 certificate compression
▪️CVE-2025-68160: Memory corruption in line-buffering (affects code back to OpenSSL 1.0.2)
▪️CVE-2025-69418: Encryption flaw in OCB mode on hardware-accelerated paths
▪️CVE-2025-69419: Memory corruption in PKCS#12 character encoding
▪️CVE-2025-69420: Crash in TimeStamp Response verification
▪️CVE-2025-69421: Crash in PKCS#12 decryption
▪️CVE-2026-22795: Crash in PKCS#12 parsing
▪️CVE-2026-22796: Crash in PKCS#7 signature verification (affects code back to OpenSSL 1.0.2)

"When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs.

Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk."

Writeup: https://aisle.com/blog/aisle-discovered-12-out-of-12-openssl-vulnerabilities

‼️AISLE Goes 12-for-12 on OpenSSL Vulnerability Detection

CVEs Published: January 27th, 2026

High and Moderate Severity Flaws:

▪️CVE-2025-15467: Stack Buffer Overflow in CMS AuthEnvelopedData Parsing (High): A vulnerability with the potential to enable remote code execution under specific conditions

▪️CVE-2025-11187: PBMAC1 Parameter Validation in PKCS#12 (Moderate): Missing validation that could trigger a stack-based buffer overflow

Low Severity Flaws:

▪️CVE-2025-15468: Crash in QUIC protocol cipher handling
▪️CVE-2025-15469: Silent truncation bug affecting post-quantum signature algorithms (ML-DSA)
▪️CVE-2025-66199: Memory exhaustion via TLS 1.3 certificate compression
▪️CVE-2025-68160: Memory corruption in line-buffering (affects code back to OpenSSL 1.0.2)
▪️CVE-2025-69418: Encryption flaw in OCB mode on hardware-accelerated paths
▪️CVE-2025-69419: Memory corruption in PKCS#12 character encoding
▪️CVE-2025-69420: Crash in TimeStamp Response verification
▪️CVE-2025-69421: Crash in PKCS#12 decryption
▪️CVE-2026-22795: Crash in PKCS#12 parsing
▪️CVE-2026-22796: Crash in PKCS#7 signature verification (affects code back to OpenSSL 1.0.2)

"When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs.

Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk."

Writeup: https://aisle.com/blog/aisle-discovered-12-out-of-12-openssl-vulnerabilities

‼️AISLE Goes 12-for-12 on OpenSSL Vulnerability Detection

CVEs Published: January 27th, 2026

High and Moderate Severity Flaws:

▪️CVE-2025-15467: Stack Buffer Overflow in CMS AuthEnvelopedData Parsing (High): A vulnerability with the potential to enable remote code execution under specific conditions

▪️CVE-2025-11187: PBMAC1 Parameter Validation in PKCS#12 (Moderate): Missing validation that could trigger a stack-based buffer overflow

Low Severity Flaws:

▪️CVE-2025-15468: Crash in QUIC protocol cipher handling
▪️CVE-2025-15469: Silent truncation bug affecting post-quantum signature algorithms (ML-DSA)
▪️CVE-2025-66199: Memory exhaustion via TLS 1.3 certificate compression
▪️CVE-2025-68160: Memory corruption in line-buffering (affects code back to OpenSSL 1.0.2)
▪️CVE-2025-69418: Encryption flaw in OCB mode on hardware-accelerated paths
▪️CVE-2025-69419: Memory corruption in PKCS#12 character encoding
▪️CVE-2025-69420: Crash in TimeStamp Response verification
▪️CVE-2025-69421: Crash in PKCS#12 decryption
▪️CVE-2026-22795: Crash in PKCS#12 parsing
▪️CVE-2026-22796: Crash in PKCS#7 signature verification (affects code back to OpenSSL 1.0.2)

"When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs.

Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk."

Writeup: https://aisle.com/blog/aisle-discovered-12-out-of-12-openssl-vulnerabilities

🟠 CVE-2026-20412 - High (7.8)

In cameraisp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20412/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20412 - High (7.8)

In cameraisp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20412/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24070 - High (8.8)

During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permissions, is de...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24070/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24070 - High (8.8)

During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helper2`, which is used by Native Access to trigger functions via XPC communication like copy-file, remove or set-permissions, is de...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24070/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

‼️AISLE Goes 12-for-12 on OpenSSL Vulnerability Detection

CVEs Published: January 27th, 2026

High and Moderate Severity Flaws:

▪️CVE-2025-15467: Stack Buffer Overflow in CMS AuthEnvelopedData Parsing (High): A vulnerability with the potential to enable remote code execution under specific conditions

▪️CVE-2025-11187: PBMAC1 Parameter Validation in PKCS#12 (Moderate): Missing validation that could trigger a stack-based buffer overflow

Low Severity Flaws:

▪️CVE-2025-15468: Crash in QUIC protocol cipher handling
▪️CVE-2025-15469: Silent truncation bug affecting post-quantum signature algorithms (ML-DSA)
▪️CVE-2025-66199: Memory exhaustion via TLS 1.3 certificate compression
▪️CVE-2025-68160: Memory corruption in line-buffering (affects code back to OpenSSL 1.0.2)
▪️CVE-2025-69418: Encryption flaw in OCB mode on hardware-accelerated paths
▪️CVE-2025-69419: Memory corruption in PKCS#12 character encoding
▪️CVE-2025-69420: Crash in TimeStamp Response verification
▪️CVE-2025-69421: Crash in PKCS#12 decryption
▪️CVE-2026-22795: Crash in PKCS#12 parsing
▪️CVE-2026-22796: Crash in PKCS#7 signature verification (affects code back to OpenSSL 1.0.2)

"When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs.

Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk."

Writeup: https://aisle.com/blog/aisle-discovered-12-out-of-12-openssl-vulnerabilities

🟠 CVE-2025-47359 - High (7.8)

Memory Corruption when multiple threads simultaneously access a memory free API.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47359 - High (7.8)

Memory Corruption when multiple threads simultaneously access a memory free API.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47398 - High (7.8)

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47398 - High (7.8)

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47398/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47397 - High (7.8)

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47397/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-47397 - High (7.8)

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47397/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-14914 - High (7.6)

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-14914 - High (7.6)

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences resulting in an overwrite of files leading to arbitrary code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-14914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13986 - High (7.5)

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Login Page: from 0.0.0 before 1.1.3.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13986/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1637 - High (8.8)

A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function fromAdvSetMacMtuWan of the file /goform/AdvSetMacMtuWan. The manipulation leads to stack-based buffer overflow. Remote exploitation of the attack is pos...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1637/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1761 - High (8.6)

A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart H...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1761/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1761 - High (8.6)

A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by sending a specially crafted multipart H...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1761/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20418 - High (8.8)

In Thread, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR004...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20418 - High (8.8)

In Thread, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR004...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20418 - High (8.8)

In Thread, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR004...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20418 - High (8.8)

In Thread, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR004...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20418/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-8587 - High (8.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows SQL Injection.This issue affects SKSPro: through 07012026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8587/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-8587 - High (8.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSPro allows SQL Injection.This issue affects SKSPro: through 07012026.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-8587/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-61140 - Critical (9.8)

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-61140/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-46691 - High (7.8)

Dell PremierColor Panel Driver, versions prior to 1.0.0.1 A01, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-46691/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25200 - Critical (9.8)

A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover

This issue affects MagicINFO 9 Server: less than 21.1090.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25200/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25200 - Critical (9.8)

A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can result in account takeover

This issue affects MagicINFO 9 Server: less than 21.1090.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25200/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25202 - Critical (9.8)

The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than 21.1090.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25202/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25202 - Critical (9.8)

The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue affects MagicINFO 9 Server: less than 21.1090.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25202/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69662 - High (8.6)

SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69662/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-62348 - High (7.8)

Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintended code execution under the context of the Salt process.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-62348/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-25130 - Critical (9.6)

Cybersecurity AI (CAI) is a framework for AI Security. In versions up to and including 0.5.10, the CAI (Cybersecurity AI) framework contains multiple argument injection vulnerabilities in its function tools. User-controlled input is passed directl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25130/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25153 - High (7.7)

Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities for TechDocs. In versions of @backstage/plugin-techdocs-node prior to 1.13.11 and 1.14.1, when TechDocs is c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25153/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-01-26 - 2026-02-02)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 860

Severity:
- Critical: 96
- High: 295
- Medium: 375
- Low: 18
- None: 76

Status:
- : 6
- Analyzed: 70
- Awaiting Analysis: 299
- Modified: 1
- Received: 245
- Rejected: 18
- Undergoing Analysis: 221

Top CNAs:
- VulnCheck: 171
- GitHub, Inc.: 128
- VulDB: 74
- MITRE: 61
- Government Technology Agency of Singapore Cyber Security Group (GovTech CSG): 48
- Wordfence: 43
- kernel.org: 38
- Spanish National Cybersecurity Institute, S.A. (INCIBE): 28
- SEC Consult Vulnerability Lab: 20
- IBM Corporation: 18

Top Affected Products:
- UNKNOWN: 771
- Discourse: 13
- Flexense Disk Pulse Enterprise: 11
- Flexense Sync Breeze Enterprise Server: 11
- Tenda W30e Firmware: 10
- Oisf Suricata: 7
- Pnpm: 5
- Gpac: 4
- Fabian Online Examination System: 3
- Sangfor Operation And Maintenance Security Management System: 3

Top EPSS Score:
- CVE-2016-15057 - 32.46 % (https://secdb.nttzen.cloud/cve/detail/CVE-2016-15057)
- CVE-2026-1281 - 14.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1281)
- CVE-2026-24858 - 3.14 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24858)
- CVE-2026-21509 - 2.83 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21509)
- CVE-2026-1547 - 2.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1547)
- CVE-2026-1601 - 2.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1601)
- CVE-2026-1687 - 1.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1687)
- CVE-2026-1689 - 1.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1689)
- CVE-2026-1723 - 0.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1723)
- CVE-2025-40551 - 0.87 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-40551)

🟠 CVE-2025-68662 - High (7.6)

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestination could allow bypassing SSRF protections under certain conditions. This issue is patched...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-68662/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-51958 - Critical (9.8)

aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postaction.php.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-51958/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-01-26 - 2026-02-02)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 860

Severity:
- Critical: 96
- High: 295
- Medium: 375
- Low: 18
- None: 76

Status:
- : 6
- Analyzed: 70
- Awaiting Analysis: 299
- Modified: 1
- Received: 245
- Rejected: 18
- Undergoing Analysis: 221

Top CNAs:
- VulnCheck: 171
- GitHub, Inc.: 128
- VulDB: 74
- MITRE: 61
- Government Technology Agency of Singapore Cyber Security Group (GovTech CSG): 48
- Wordfence: 43
- kernel.org: 38
- Spanish National Cybersecurity Institute, S.A. (INCIBE): 28
- SEC Consult Vulnerability Lab: 20
- IBM Corporation: 18

Top Affected Products:
- UNKNOWN: 771
- Discourse: 13
- Flexense Disk Pulse Enterprise: 11
- Flexense Sync Breeze Enterprise Server: 11
- Tenda W30e Firmware: 10
- Oisf Suricata: 7
- Pnpm: 5
- Gpac: 4
- Fabian Online Examination System: 3
- Sangfor Operation And Maintenance Security Management System: 3

Top EPSS Score:
- CVE-2016-15057 - 32.46 % (https://secdb.nttzen.cloud/cve/detail/CVE-2016-15057)
- CVE-2026-1281 - 14.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1281)
- CVE-2026-24858 - 3.14 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24858)
- CVE-2026-21509 - 2.83 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21509)
- CVE-2026-1547 - 2.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1547)
- CVE-2026-1601 - 2.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1601)
- CVE-2026-1687 - 1.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1687)
- CVE-2026-1689 - 1.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1689)
- CVE-2026-1723 - 0.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1723)
- CVE-2025-40551 - 0.87 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-40551)

🟠 CVE-2026-1686 - High (8.8)

A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig in the library /lib/cste_modules/app.so. Performing a manipulation of the argument apcliSsid results in buffer overflow. It is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-1686 - High (8.8)

A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig in the library /lib/cste_modules/app.so. Performing a manipulation of the argument apcliSsid results in buffer overflow. It is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-01-26 - 2026-02-02)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 860

Severity:
- Critical: 96
- High: 295
- Medium: 375
- Low: 18
- None: 76

Status:
- : 6
- Analyzed: 70
- Awaiting Analysis: 299
- Modified: 1
- Received: 245
- Rejected: 18
- Undergoing Analysis: 221

Top CNAs:
- VulnCheck: 171
- GitHub, Inc.: 128
- VulDB: 74
- MITRE: 61
- Government Technology Agency of Singapore Cyber Security Group (GovTech CSG): 48
- Wordfence: 43
- kernel.org: 38
- Spanish National Cybersecurity Institute, S.A. (INCIBE): 28
- SEC Consult Vulnerability Lab: 20
- IBM Corporation: 18

Top Affected Products:
- UNKNOWN: 771
- Discourse: 13
- Flexense Disk Pulse Enterprise: 11
- Flexense Sync Breeze Enterprise Server: 11
- Tenda W30e Firmware: 10
- Oisf Suricata: 7
- Pnpm: 5
- Gpac: 4
- Fabian Online Examination System: 3
- Sangfor Operation And Maintenance Security Management System: 3

Top EPSS Score:
- CVE-2016-15057 - 32.46 % (https://secdb.nttzen.cloud/cve/detail/CVE-2016-15057)
- CVE-2026-1281 - 14.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1281)
- CVE-2026-24858 - 3.14 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24858)
- CVE-2026-21509 - 2.83 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21509)
- CVE-2026-1547 - 2.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1547)
- CVE-2026-1601 - 2.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1601)
- CVE-2026-1687 - 1.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1687)
- CVE-2026-1689 - 1.54 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1689)
- CVE-2026-1723 - 0.94 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1723)
- CVE-2025-40551 - 0.87 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-40551)

🟠 CVE-2026-25128 - High (7.5)

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.3.6 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-4686 - High (8.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. Online Exam and Assessment allows SQL Injection.This issue affects On...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-4686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-4686 - High (8.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry and Trade Ltd. Co. Online Exam and Assessment allows SQL Injection.This issue affects On...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-4686/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#infosec #linux #vulnerability

Un fallo de seguridad (exploit) encontrado recientemente expuso casi 800.000 servicios a Telnet a nivel mundial.

Según la Base de Datos de Vulnerabilidad Nacional (NVD) el exploit CVE-2026-24061 afecta a las versiones 1.9.3 a 2.7.

Estás versiones permiten al cliente pasar un valor de la variable de entorno USER al servidor e iniciar sesión como usuario root omitiendo la autenticación.

1/2

New #synology #DSM Version: 7.3.2-86009 Update 1 is out.

This is a security patch:

Fixed Issues
- Fixed a security vulnerability regarding telnetd (CVE-2026-24061).

https://www.synology.com/en-global/releaseNote/DSM

#selfhosting #selfhosted #homelab

Un accès root en une seule commande : cette faille dans GNU InetUtils menace les accès Telnet https://www.it-connect.fr/faille-cve-2026-24061-inetutils-telnet/ #ActuCybersécurité #Cybersécurité #Vulnérabilité

⚪ 800,000 Telnet servers are vulnerable to remote attacks

🗨️ Shadowserver Foundation analysts are tracking nearly 800,000 IP addresses amid the active exploitation of a critical vulnerability, CVE-2026-24061, in the GNU InetUtils telnetd server component.

🔗 https://hackmag.com/news/telnetd?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

#news

Nearly 800,000 #Telnet servers exposed to remote attacks

The security flaw (CVE-2026-24061) already has a proof-of-concept exploit, impacts GNU InetUtils versions 1.9.3 (released in 2015) through 2.7, and was patched in version 2.8 (released on January 20).

https://www.bleepingcomputer.com/news/security/nearly-800-000-telnet-servers-exposed-to-remote-attacks/

Hikvision Wireless Access Points Vulnerability Exposes Networks to Remote Command Execution

Hikvision has recently revealed a critical security flaw affecting several models of its wireless access points, putting organizations at risk of remote command execution attacks. The vulnerability, officially tracked as CVE-2026-0709, allows authenticated attackers to send malicious commands to compromised devices, potentially gaining full control over the network…

https://undercodenews.com/hikvision-wireless-access-points-vulnerability-exposes-networks-to-remote-command-execution/

🔴 CVE-2026-1699 - Critical (10)

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary cod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1699/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack