CVE-2026-87719 GitLab EE: authed Duo Chat user can leak Advanced Search configs and credentials via crafted GraphQL subscription, CVSS 9.9. No patch confirmed. Update now.
https://www.valtersit.com/cve/CVE-2026-87719/
#CVE #GitLab #infosec

CRITICAL (CVSS 9.8): CVE-2026-76461 in Cisco AsyncOS for Secure Email Gateway lets unauthenticated attackers execute commands as root via crafted emails. Patch status unknown — monitor Cisco’s updates. https://radar.offseq.com/threat/a-vulnerability-in-the-email-parsing-of-cisco-asyncos-software-for-cisco-secure-email-gateway-could-a5a1b3247d786df4 #OffSeq #Cisco #Vulnerability #EmailSecurity

CVE-2026-76461 (CVSS 9.8) is a Cisco Secure Email Gateway vulnerability exploited in the wild. SQL injection grants root command execution. Patch now.

#Cisco #EmailSecurity #CVE202676461 #SQLInjection #RCE #ExploitedInTheWild #AsyncOS #InfoSec #PatchNow #RootAccess

https://securityonline.info/cve-2026-76461-cisco-email-gateway-rce/?utm_source=mastodon&utm_medium=jetpack_social

No one else seems to have noticed the Cisco exploited zero-day:

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability

https://www.cisa.gov/news-events/alerts/2026/09/14/cisa-adds-one-known-exploited-vulnerability-catalog

#CISA #KEV #Cisco #zeroday #CVE

🚨 [CISA-2026:0914] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0914)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-76461 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76461)
- Name: Cisco Secure Email Gateway SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Email Gateway
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76461

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260914 #cisa20260914 #cve_2026_76461 #cve202676461

CRITICAL CISA KEV ALERT: CVE-2026-76461 targets Cisco Secure Email Gateway via SQL injection, granting root-level RCE. Active exploitation verified. Access our TSUITE brief for SIEM queries and hardening steps to secure your email perimeter.

https://thecybermind.co/al1f

CVE ID: CVE-2026-76461
Vendor: Cisco
Product: Secure Email Gateway
Date Added: 2026-09-14
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76461

Welcome to Monday and two new advisories from Cisco.

CRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

CRITICAL: CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

Two more critical vulnerabilities on the 9th and the 11th https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

@cR0w

ayy lmao Cisco CVE-2026-76461
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

#cve #cisco #zeroday #eitw

CRITICAL (CVSS 9.8): CVE-2026-76461 in Cisco AsyncOS for Secure Email Gateway lets unauthenticated attackers execute commands as root via crafted emails. Patch status unknown — monitor Cisco’s updates. https://radar.offseq.com/threat/a-vulnerability-in-the-email-parsing-of-cisco-asyncos-software-for-cisco-secure-email-gateway-could-a5a1b3247d786df4 #OffSeq #Cisco #Vulnerability #EmailSecurity

CVE-2026-76461 (CVSS 9.8) is a Cisco Secure Email Gateway vulnerability exploited in the wild. SQL injection grants root command execution. Patch now.

#Cisco #EmailSecurity #CVE202676461 #SQLInjection #RCE #ExploitedInTheWild #AsyncOS #InfoSec #PatchNow #RootAccess

https://securityonline.info/cve-2026-76461-cisco-email-gateway-rce/?utm_source=mastodon&utm_medium=jetpack_social

Since no one seems to have noticed the Cisco exploited zero-day:

CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability

https://www.cisa.gov/news-events/alerts/2026/09/14/cisa-adds-one-known-exploited-vulnerability-catalog

#CISA #KEV #Cisco #zeroday #CVE

🚨 [CISA-2026:0914] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0914)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-76461 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-76461)
- Name: Cisco Secure Email Gateway SQL Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Cisco
- Product: Secure Email Gateway
- Notes: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-76461

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260914 #cisa20260914 #cve_2026_76461 #cve202676461

CRITICAL CISA KEV ALERT: CVE-2026-76461 targets Cisco Secure Email Gateway via SQL injection, granting root-level RCE. Active exploitation verified. Access our TSUITE brief for SIEM queries and hardening steps to secure your email perimeter.

https://thecybermind.co/al1f

CVE ID: CVE-2026-76461
Vendor: Cisco
Product: Secure Email Gateway
Date Added: 2026-09-14
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-76461

Welcome to Monday and two new advisories from Cisco.

CRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

CRITICAL: CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

Two more critical vulnerabilities on the 9th and the 11th https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

@cR0w

ayy lmao Cisco CVE-2026-76461
A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.

In September 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

#cve #cisco #zeroday #eitw

Welcome to Monday and two new advisories from Cisco.

CRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

CRITICAL: CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

Two more critical vulnerabilities on the 9th and the 11th https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

@cR0w

Welcome to Monday and two new advisories from Cisco.

CRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

CRITICAL: CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

Two more critical vulnerabilities on the 9th and the 11th https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

@cR0w

🟠 CVE-2026-90493 - High (8.8)

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The impacted element is an unknown function of the file idmwfp.sys of the component Kernel Driver. The manipulation results in improper access controls...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90493/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Tonec Internet Download Manager <=6.42.63 hit by CRITICAL vuln (CVE-2026-90493) in idmwfp.sys — improper access controls enable local privilege escalation. Public exploit code, no patch yet. Restrict local access & monitor. https://radar.offseq.com/threat/cve-2026-90493-improper-access-controls-in-tonec-internet-download-manager-a788ce95502ef3ad #OffSeq #CVE202690493 #Vuln #Cybersecurity

EFM ipTIME C200E v1.094 suffers CRITICAL OS command injection (CVE-2026-90847, CVSS 9.4) via iux_set.cgi. Remotely exploitable, public exploit available. Restrict device access and monitor. https://radar.offseq.com/threat/cve-2026-90847-os-command-injection-in-efm-iptime-c200e-1c30057b126bbbf4 #OffSeq #Vulnerability #IoTSecurity #CVE

EFM ipTIME C200E v1.094 suffers CRITICAL OS command injection (CVE-2026-90847, CVSS 9.4) via iux_set.cgi. Remotely exploitable, public exploit available. Restrict device access and monitor. https://radar.offseq.com/threat/cve-2026-90847-os-command-injection-in-efm-iptime-c200e-1c30057b126bbbf4 #OffSeq #Vulnerability #IoTSecurity #CVE

🟠 CVE-2026-91771 - High (8.8)

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91771/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91771 - High (8.8)

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91771/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91200 - High (8.8)

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91200/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91200 - High (8.8)

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91200/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-12944 (CRITICAL, CVSS 9.6) affects IBM Langflow OSS 1.0.0 – 1.10.0. Attackers can execute arbitrary Python as root via SSRF, steal AWS creds, and move laterally. Patch is available — validate remediation. https://radar.offseq.com/threat/cve-2026-12944-cwe-918-server-side-request-forgery-ssrf-in-ibm-langflow-oss-98110564771040c9 #OffSeq #SSRF #IBM #CloudSecurity

🔴 CVE-2026-12944 - Critical (9.6)

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12944/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-12944 (CRITICAL, CVSS 9.6) affects IBM Langflow OSS 1.0.0 – 1.10.0. Attackers can execute arbitrary Python as root via SSRF, steal AWS creds, and move laterally. Patch is available — validate remediation. https://radar.offseq.com/threat/cve-2026-12944-cwe-918-server-side-request-forgery-ssrf-in-ibm-langflow-oss-98110564771040c9 #OffSeq #SSRF #IBM #CloudSecurity

🔴 CVE-2026-12944 - Critical (9.6)

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12944/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91144 - High (7.5)

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared ba...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91144/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91144 - High (7.5)

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared ba...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91144/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82028 - High (8.8)

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82028/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82028 - High (8.8)

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82028/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89023 - High (8.6)

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89023/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89023 - High (8.6)

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. Attackers can retrieve stor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89023/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-53713 - Critical (9.1)

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53713/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-53713 - Critical (9.1)

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua does not collapse redu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-53713/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88793 - High (8.8)

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88793 - High (8.8)

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85129 - High (8.8)

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85129/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-85129 - High (8.8)

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85129/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-77005 - Critical (9.6)

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77005/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80494 - High (8.6)

The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82845 - Critical (9.9)

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82845/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-87888 - High (8)

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administra...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87888/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-85681 - Critical (9.8)

The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unaut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-85681/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-85681 (CRITICAL): WP Component plugin ≤2.2.4 allows unauthenticated option overwrites, risking full WordPress site takeover. Single-site installs are exposed. Check vendor advisory for mitigation steps: https://radar.offseq.com/threat/cve-2026-85681-cwe-269-improper-privilege-management-in-wp-component-ee74cec7c7b526ed #OffSeq #WordPress #Vuln #BlueTeam

🟠 CVE-2026-90537 - High (8.2)

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90537/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-78330 | CRITICAL: Apache Syncope vuln allows admin escalation if JWKS is exposed and JWT auth used. Affects 3.0.0-M0 – 3.0.16, 4.0.0-M0 – 4.0.7, 4.1.0-M0 – 4.1.2. Upgrade to 4.0.8/4.1.3 to mitigate. Details: https://radar.offseq.com/threat/incorrect-privilege-assignment-vulnerability-in-apache-syncope-cve-2026-78330-b2c023a1d947f76b #OffSeq #Vulnerability #ApacheSyncope

CVE-2026-78330 | CRITICAL: Apache Syncope vuln allows admin escalation if JWKS is exposed and JWT auth used. Affects 3.0.0-M0 – 3.0.16, 4.0.0-M0 – 4.0.7, 4.1.0-M0 – 4.1.2. Upgrade to 4.0.8/4.1.3 to mitigate. Details: https://radar.offseq.com/threat/incorrect-privilege-assignment-vulnerability-in-apache-syncope-cve-2026-78330-b2c023a1d947f76b #OffSeq #Vulnerability #ApacheSyncope

CVE-2026-90606: HIGH-severity buffer overflow in Totolink A3002MU Hh-B20211125.1046 (boa/formIpv6Setup). Public exploit disclosed. RCE or DoS possible. Restrict access & monitor IPv6 setup. No patch yet. https://radar.offseq.com/threat/a-security-vulnerability-has-been-detected-in-totolink-a3002mu-hh-b202111251046-cve-2026-90606-6a6dad4a128a1845 #OffSeq #Vuln #IoTSecurity #BufferOverflow

🔴 CVE-2026-90606 - Critical (9.9)

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument static_ipv6 leads to buffer ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90606/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-90606: CRITICAL buffer overflow in Totolink A3002MU (Hh-B20211125.1046). Remote attackers can exploit static_ipv6 in /boafrm/formIpv6Setup. Exploit is public — review device exposure now. https://radar.offseq.com/threat/cve-2026-90606-buffer-overflow-in-totolink-a3002mu-ff1e560ec5dedad6 #OffSeq #CVE202690606 #RouterSecurity #NetSec

CVE-2026-90606: HIGH-severity buffer overflow in Totolink A3002MU Hh-B20211125.1046 (boa/formIpv6Setup). Public exploit disclosed. RCE or DoS possible. Restrict access & monitor IPv6 setup. No patch yet. https://radar.offseq.com/threat/a-security-vulnerability-has-been-detected-in-totolink-a3002mu-hh-b202111251046-cve-2026-90606-6a6dad4a128a1845 #OffSeq #Vuln #IoTSecurity #BufferOverflow

🔴 CVE-2026-90606 - Critical (9.9)

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument static_ipv6 leads to buffer ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90606/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-90606: CRITICAL buffer overflow in Totolink A3002MU (Hh-B20211125.1046). Remote attackers can exploit static_ipv6 in /boafrm/formIpv6Setup. Exploit is public — review device exposure now. https://radar.offseq.com/threat/cve-2026-90606-buffer-overflow-in-totolink-a3002mu-ff1e560ec5dedad6 #OffSeq #CVE202690606 #RouterSecurity #NetSec

🔴 CVE-2026-90680 - Critical (9.9)

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings of the component HNAP1. The manipulation of the argument PAddress/SubnetMask/Gateway re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-90680 - Critical (9.9)

A security flaw has been discovered in D-Link DIR-823G 1.0.2B05_20181207. The impacted element is the function strcpy of the file /HNAP1/SetStaticRouteSettings of the component HNAP1. The manipulation of the argument PAddress/SubnetMask/Gateway re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90680/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-90605 - Critical (9.9)

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90605/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-90605 - Critical (9.9)

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90605/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90510 - High (8.3)

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/drom...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90510 - High (8.3)

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/drom...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-78006: The Events Calendar plugin ≤6.17.4 has a CRITICAL RCE flaw. Unauthenticated attackers can run code via comment handling — disable event comments until patched. Review vendor advisories. https://radar.offseq.com/threat/the-the-events-calendar-plugin-for-wordpress-is-vulnerable-to-remote-code-execution-in-all-versions-up-6446d1c8dfcb6a24 #OffSeq #WordPress #CVE202678006 #RCE

CVE-2026-78006: CRITICAL RCE in The Events Calendar plugin (<=6.17.4) for WordPress. Unauthenticated attackers can exploit comments to run code on the server. Disable event comments now & check for patches. https://radar.offseq.com/threat/cve-2026-78006-cwe-502-deserialization-of-untrusted-data-in-stellarwp-the-events-calendar-efa20e86741ba4b3 #OffSeq #WordPress #RCE #Vuln

🔴 CVE-2026-78006 - Critical (9.8)

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78006/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65838 - High (8.2)

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-65838 - High (8.2)

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-65838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57126 - High (8.5)

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57126/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57126 - High (8.5)

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57126/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91080 - High (7.5)

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91080 - High (7.5)

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90768 - High (8.1)

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90768 - High (8.1)

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The UnrealIRCd security issue from yesterday was assigned CVE-2026-90668. Admins on older versions could apply a hot-patch to fix the issue without restart.

We have been doing that at UnrealIRCd for more than 20 years now, so I wrote a story on my personal blog about how effective it is, and the times it did not work: https://www.vulnscan.org/why-hot-patching-is-awesome/

#IRC #infosec

🟠 CVE-2026-90668 - High (7.5)

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91079 - High (8.5)

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91079/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91079 - High (8.5)

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91079/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90946 - High (7.5)

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90946/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90946 - High (7.5)

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90946/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Looks like Microsoft has a couple of new flaws.

NEW and CRITICAL: CVE-2026-85921: Windows Secure Kernel Mode Elevation of Privilege Vulnerabilityhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85921

NEW and CRITICAL: CVE-2026-85921: Windows Secure Kernel Mode Elevation of Privilege Vulnerability New https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85921 #infosec #Microsoft #vulnerability #Windows

Looks like Microsoft has a couple of new flaws.

NEW and CRITICAL: CVE-2026-85921: Windows Secure Kernel Mode Elevation of Privilege Vulnerabilityhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85921

NEW and CRITICAL: CVE-2026-85921: Windows Secure Kernel Mode Elevation of Privilege Vulnerability New https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85921 #infosec #Microsoft #vulnerability #Windows

Welcome to Monday and two new advisories from Cisco.

CRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

CRITICAL: CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

Two more critical vulnerabilities on the 9th and the 11th https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

@cR0w

Welcome to Monday and two new advisories from Cisco.

CRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

CRITICAL: CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

Two more critical vulnerabilities on the 9th and the 11th https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

@cR0w

Welcome to Monday and two new advisories from Cisco.

CRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

CRITICAL: CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

Two more critical vulnerabilities on the 9th and the 11th https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

@cR0w

Welcome to Monday and two new advisories from Cisco.

CRITICAL: CVE-2026-20353, CVE-2026-76440, and CVE-2026-76441: Cisco Secure Email Gateway and Secure Email and Web Manager Security Hardening Release: September 2026 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hardening-esa-dfCrfXkm

CRITICAL: CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX

Two more critical vulnerabilities on the 9th and the 11th https://sec.cloudapps.cisco.com/security/center/publicationListing.x @TalosSecurity #Cisco #infosec #vulnerability

@cR0w

🔴 CVE-2026-90945 - Critical (9.8)

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90945/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Go fuck with some crawlers.

https://nvd.nist.gov/vuln/detail/cve-2026-90945

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

🔴 CVE-2026-90945 - Critical (9.8)

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90945/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Go fuck with some crawlers.

https://nvd.nist.gov/vuln/detail/cve-2026-90945

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

🟠 CVE-2026-90777 - High (8.8)

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deseri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90777/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90777 - High (8.8)

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files. Attackers can craft malicious checkpoint files that execute code during deseri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90777/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90772 - High (7.6)

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90772/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90772 - High (7.6)

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90772/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-59178 - Critical (9.8)

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier versions, and the legac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59178/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-59178 - Critical (9.8)

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earlier versions, and the legac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59178/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-90648: HIGH severity vuln in wasm2c (WebAssembly wabt <=1.0.41). Unchecked calloc() return enables sandbox escape & code exec if allocation fails — mainly on 32-bit/memory-limited systems. Patch status pending. https://radar.offseq.com/threat/cve-2026-90648-cwe-252-unchecked-return-value-in-webassembly-wabt-365471fbebafc772 #OffSeq #WebAssembly #CVE202690648

CVE-2026-78159: The Events Calendar <=6.17.3 for WordPress has a CRITICAL RCE flaw via parse_array(). Unauthenticated code execution if comments on tribe_events posts are enabled. Disable comments as interim mitigation. https://radar.offseq.com/threat/the-the-events-calendar-plugin-for-wordpress-is-vulnerable-to-remote-code-execution-in-all-versions-up-1ecd7d8aa73f934d #OffSeq #WordPress #RCE #CVE202678159

CVE-2026-78159: CRITICAL RCE in The Events Calendar (<=6.17.3). Unauthenticated attackers can run arbitrary code via crafted comments. Disable comments on tribe_events posts to mitigate. CVSS 9.8. Details: https://radar.offseq.com/threat/cve-2026-78159-cwe-94-improper-control-of-generation-of-code-code-injection-in-stellarwp-the-events-c0d168b99a9315ff #OffSeq #WordPress #Infosec #RCE

🔴 CVE-2026-78159 - Critical (9.8)

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-arr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78159/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89697 - Critical (9.1)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()
can inspect the dentry. This ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-89697 - Critical (9.1)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()

The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()
can inspect the dentry. This ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89704 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: sample writeback error cursor before async COPY loop

_nfsd_copy_file_range() samples dst->f_wb_err into "since"
after the copy loop, then uses it to detect writeback error...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89704 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: sample writeback error cursor before async COPY loop

_nfsd_copy_file_range() samples dst->f_wb_err into "since"
after the copy loop, then uses it to detect writeback error...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89704/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-89461 Linux kernel max17040 power supply race on suspend. Work callback can keep running and requeue itself after suspend, causing use-after-suspend. No CVSS, still unpatched. Update kernel when fix lands. #CVE #Linux https://www.valtersit.com/cve/CVE-2026-89461/

CVE-2026-80970 Linux kernel ALSA FCP ioctl leaks uninitialised kmalloc memory to userspace via copy_to_user. Info disclosure, no CVSS or patch yet. Patch or restrict ioctl access. https://www.valtersit.com/cve/CVE-2026-80970/ #CVE #infosec #Linux

CVE-2026-80912: Linux kernel SELinux flaw—a NULL deref via an unclaimed class value can crash the system. CVSS: N/A, unpatched. If you run SELinux, review your policy and wait for the fix. Patch ASAP when available. https://www.valtersit.com/cve/CVE-2026-80912/ #CVE #Linux #infos

Hiperdino REST API v1.0 (CVE-2026-12258) has a CRITICAL info disclosure flaw (CVSS 9.2): attackers with a static bearer token can enumerate user contact info via the 'customer/check' endpoint. No patch yet. Restrict token access & monitor usage. https://radar.offseq.com/threat/cve-2026-12258-cwe-284-improper-access-control-in-hiperdino-rest-api-827f2edf6294f9bd #OffSeq #infosec #APIsecurity

Hiperdino REST API v1.0 (CVE-2026-12258) has a CRITICAL info disclosure flaw (CVSS 9.2): attackers with a static bearer token can enumerate user contact info via the 'customer/check' endpoint. No patch yet. Restrict token access & monitor usage. https://radar.offseq.com/threat/cve-2026-12258-cwe-284-improper-access-control-in-hiperdino-rest-api-827f2edf6294f9bd #OffSeq #infosec #APIsecurity

🟠 CVE-2026-88802 - High (7.5)

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88802/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88802 - High (7.5)

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88802/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-81648 - Critical (10)

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-81648 - Critical (10)

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-74933 - High (8.8)

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-74933/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-74933 - High (8.8)

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-74933/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89736 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_audio: Fix use-after-free on sound card disconnect

g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
card teardown and immediately frees the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89736/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89736 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: u_audio: Fix use-after-free on sound card disconnect

g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
card teardown and immediately frees the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89736/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89750 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing/user_events: Clear copied tracing state before fork duplication

dup_task_struct() copies user_event_mm from the parent into the child,
without grabbing a reference to it...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89750 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing/user_events: Clear copied tracing state before fork duplication

dup_task_struct() copies user_event_mm from the parent into the child,
without grabbing a reference to it...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89750/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89744 - High (8.4)

In the Linux kernel, the following vulnerability has been resolved:

device property: fix infinite loop in fwnode_for_each_child_node()

When iterate over children of a fwnode that has a secondary fwnode,
fwnode_get_next_child_node() can enter an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89744 - High (8.4)

In the Linux kernel, the following vulnerability has been resolved:

device property: fix infinite loop in fwnode_for_each_child_node()

When iterate over children of a fwnode that has a secondary fwnode,
fwnode_get_next_child_node() can enter an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89706 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Reset write verifier when async COPY writeback fails

Async COPY captures nn->writeverf at request time and reports it to
the client via CB_OFFLOAD after the worker kthread...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89706/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89706 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Reset write verifier when async COPY writeback fails

Async COPY captures nn->writeverf at request time and reports it to
the client via CB_OFFLOAD after the worker kthread...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89706/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 ZcopyReaper (CVE-2026-43502) has been identified as a notable vulnerability.

In the Linux kernel, the following vulnerability has been resolved:

net/rds: handle zerocopy send cleanup before the message is queued

A zerocopy send can fail after user pages have been pinned but before
the message is attached to the sending socket.

The purge path currently infers zerocopy state from rm->m_rs, so an
unqueued message can be cleaned up as if it owned normal payload pages.
However, zerocopy ownership is really determined by the presence of
op_mmp_znotifier, regardless of whether the message has reached the
socket queue.

Capture op_mmp_znotifier up front in rds_message_purge() and use it as
the cleanup discriminator. If the message is already associated with a
socket, keep the existing completion path. Otherwise, drop the pinned
page accounting directly and release the notifier before putting the
payload pages.

This keeps early send failure cleanup consistent with the zerocopy
lifetime rules without changing the normal queued completion path.

ℹ️ Additional information on ZEN SecDB 👉 https://secdb.nttzen.cloud/cve/detail/CVE-2026-43502

#Infosec #ZcopyReaper #Linux #Kernel #LPE #CVE202643502
#NTTData #ZEN #SecDB

🚨 ZcopyReaper (CVE-2026-43502) has been identified as a notable vulnerability.

In the Linux kernel, the following vulnerability has been resolved:

net/rds: handle zerocopy send cleanup before the message is queued

A zerocopy send can fail after user pages have been pinned but before
the message is attached to the sending socket.

The purge path currently infers zerocopy state from rm->m_rs, so an
unqueued message can be cleaned up as if it owned normal payload pages.
However, zerocopy ownership is really determined by the presence of
op_mmp_znotifier, regardless of whether the message has reached the
socket queue.

Capture op_mmp_znotifier up front in rds_message_purge() and use it as
the cleanup discriminator. If the message is already associated with a
socket, keep the existing completion path. Otherwise, drop the pinned
page accounting directly and release the notifier before putting the
payload pages.

This keeps early send failure cleanup consistent with the zerocopy
lifetime rules without changing the normal queued completion path.

ℹ️ Additional information on ZEN SecDB 👉 https://secdb.nttzen.cloud/cve/detail/CVE-2026-43502

#Infosec #ZcopyReaper #Linux #Kernel #LPE #CVE202643502
#NTTData #ZEN #SecDB

CVE-2026-90919: ModelTC LightLLM <=1.2.0 faces CRITICAL RCE risk. Unauthenticated /visual_register WebSocket lets attackers send malicious pickle data, leading to code execution. Patch or restrict access fast. https://radar.offseq.com/threat/cve-2026-90919-deserialization-of-untrusted-data-in-modeltc-lightllm-99a91583cd9500c2 #OffSeq #CVE202690919 #RCE #LightLLM

CVE-2026-90919: ModelTC LightLLM <=1.2.0 faces CRITICAL RCE risk. Unauthenticated /visual_register WebSocket lets attackers send malicious pickle data, leading to code execution. Patch or restrict access fast. https://radar.offseq.com/threat/cve-2026-90919-deserialization-of-untrusted-data-in-modeltc-lightllm-99a91583cd9500c2 #OffSeq #CVE202690919 #RCE #LightLLM

⚪️ Developers Urge Immediate Fix for Critical GitLab Vulnerability

🗨️ GitLab engineers have released patches for the critical CVE-2026-85706 vulnerability, which received the maximum CVSS score of 10 and allows an unauthenticated attacker to read arbitrary files on a server. Security researchers warn that attackers began attempting to exploit the…

🔗 https://hackmag.com/news/gitlab-patch?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

#news

CRITICAL CISA KEV ALERT: CVE-2026-85706 targets GitLab CE/EE via path traversal in the repository commits API. Active exploitation verified. Access our TSUITE brief for SIEM detection queries and compensating controls to protect your CI/CD pipeline and isolate your secrets.

https://thecybermind.co/pcid

GitLab CVE-2026-85706: A Critical Zero-Authentication Flaw Is Now Being Exploited in the Wild + Video

GitLab CVE-2026-85706: A Critical Zero-Authentication Flaw Is Now Being Exploited in the Wild Introduction: A GitLab Warning That Security Teams Cannot Ignore A critical GitLab vulnerability has rapidly moved from a newly patched security issue to an active exploitation concern. Tracked as CVE-2026-85706, the flaw carries the maximum CVSS score of 10.0 and affects…

https://undercodenews.com/gitlab-cve-2026-85706-a-critical-zero-authentication-flaw-is-now-being-exploited-in-the-wild-video/?utm_source=mastodon&utm_medium=jetpack_social

New.

Rapid7: CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild/ @Rapid7Official #infosec #GitLab #vulnerability

⚠️GitLab : CVE-2026-85706 est activement exploitée.

Une faille critique de traversée de répertoires permet à un attaquant non authentifié de lire des fichiers arbitraires sur le serveur.

Encore une vulnérabilité qui prend des chemins de traverse…
../../../../etc/ :dumpster_fire_gif: 👀

-->GitLab auto-hébergé exposé sur Internet : mise à jour rapide recommandée.

Correctifs : 19.1.8, 19.2.6 et 19.3.2.

La faille a déjà rejoint le catalogue KEV de la CISA, et ça commence clairement à renifler autour : watchTowr et plusieurs honeypots ont déjà vu passer des tentatives de probing.

Onyphe recense une bonne centaine d’instances vulnérables en CH aujourd'hui...

#CyberVeille #GitLab #CVE202685706

CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
#CVE_2026_85706
https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild/

GitLab Faces a Critical Security Emergency as CVE-2026-85706 Enters the CISA Exploited Vulnerabilities List + Video

Introduction: A GitLab Warning That Administrators Cannot Afford to Ignore A maximum-severity vulnerability in self-hosted GitLab installations has moved from a serious security concern to an urgent patching priority after researchers detected apparent exploitation attempts in the wild. The flaw, tracked as CVE-2026-85706, can allow an unauthenticated…

https://undercodenews.com/gitlab-faces-a-critical-security-emergency-as-cve-2026-85706-enters-the-cisa-exploited-vulnerabilities-list-video/?utm_source=mastodon&utm_medium=jetpack_social

Recent reports confirm a critical GitLab zero-day (CVE-2026-85706) exploited within 24 hours, alongside new EU Cyber Resilience Act mandates for 24-hour vulnerability reporting. Operational technology (OT) sectors face emerging ransomware threats. Meanwhile, leading AI developers advocate for a slowdown in development due to safety concerns, prompting market shifts. Geopolitically, the BRICS summit addressed rising global tensions and the "weaponization of technology."

#Cybersecurity #TechNews #Geopolitics

GitLab Flaw Exploited in Wild, Prompting Urgent Patch Push

A critical GitLab bug, CVE-2026-85706, is under active exploitation, putting sensitive files at risk of exposure due to a path traversal vulnerability that allows unauthenticated users to access arbitrary files. GitLab has urgently pushed a patch to fix the flaw, affecting versions CE/EE 18.7 to 19.3.2.

https://osintsights.com/gitlab-flaw-exploited-in-wild-prompting-urgent-patch-push?utm_source=mastodon&utm_medium=social

#Gitlab #Cve202685706 #PathTraversal #VulnerabilityExploitation #EmergingThreats

📢 [VULN] GitLab : mise à jour de sécurité critique CVE-2026-85706

GitLab a publié le 10 septembre des mises à jour de sécurité. Ce patch critique concerne les versions enterprise et communautaire. Les versions 19.3.2, 19.2.8 et 19.1.8 corrigent un important bug et plusieurs failles de sécurité. GitLab recommande la mise à jour.

🔗 https://www.programmez.com/actualites/gitlab-mise-jour-de-securite-critique-40109
💬 discussion : https://infosec.pub/post/52275402
#CVE #Cyberveille

CVE-2026-85706 GitLab CE/EE: unauthenticated arbitrary file read via commits API, CVSS 10. Affects 18.7 up to 19.1.8, 19.2.6, 19.3.2. No patch confirmed yet, restrict access now. https://www.valtersit.com/cve/CVE-2026-85706/ #CVE #GitLab #infosec

Hackers Exploit GitLab Flaw in Active Attacks

Hackers are actively exploiting a critical GitLab flaw, CVE-2026-85706, that allows them to read sensitive information like credentials and secrets with just a single HTTP request. This vulnerability enables attackers to access arbitrary files, potentially exposing long-lived secrets and confidential data.

https://osintsights.com/hackers-exploit-gitlab-flaw-in-active-attacks?utm_source=mastodon&utm_medium=social

#Gitlab #Cve202685706 #PathTraversal #VulnerabilityExploitation #EmergingThreats

📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability

GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow

🔗 https://cyber.netsecops.io/articles/gitlab-urges-patching-of-critical-cvss-10-path-traversal-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

GitLab CVE-2026-85706: Critical CVSS 100 Flaw Is Already Being Probed in the Wild + Video

GitLab CVE-2026-85706: Critical CVSS 10.0 Path Traversal Flaw Puts Sensitive Files at Risk A Maximum-Severity Warning for GitLab Administrators A dangerous new GitLab vulnerability has moved from disclosure to real-world reconnaissance with remarkable speed. Tracked as CVE-2026-85706, the flaw carries the maximum CVSS score of 10.0 and affects the repository commits API in…

https://undercodenews.com/gitlab-cve-2026-85706-critical-cvss-100-flaw-is-already-being-probed-in-the-wild-video/?utm_source=mastodon&utm_medium=jetpack_social

⚪️ Developers Urge Immediate Fix for Critical GitLab Vulnerability

🗨️ GitLab engineers have released patches for the critical CVE-2026-85706 vulnerability, which received the maximum CVSS score of 10 and allows an unauthenticated attacker to read arbitrary files on a server. Security researchers warn that attackers began attempting to exploit the…

🔗 https://hackmag.com/news/gitlab-patch?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

#news

CRITICAL CISA KEV ALERT: CVE-2026-85706 targets GitLab CE/EE via path traversal in the repository commits API. Active exploitation verified. Access our TSUITE brief for SIEM detection queries and compensating controls to protect your CI/CD pipeline and isolate your secrets.

https://thecybermind.co/pcid

New.

Rapid7: CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild/ @Rapid7Official #infosec #GitLab #vulnerability

⚠️GitLab : CVE-2026-85706 est activement exploitée.

Une faille critique de traversée de répertoires permet à un attaquant non authentifié de lire des fichiers arbitraires sur le serveur.

Encore une vulnérabilité qui prend des chemins de traverse…
../../../../etc/ :dumpster_fire_gif: 👀

-->GitLab auto-hébergé exposé sur Internet : mise à jour rapide recommandée.

Correctifs : 19.1.8, 19.2.6 et 19.3.2.

La faille a déjà rejoint le catalogue KEV de la CISA, et ça commence clairement à renifler autour : watchTowr et plusieurs honeypots ont déjà vu passer des tentatives de probing.

Onyphe recense une bonne centaine d’instances vulnérables en CH aujourd'hui...

#CyberVeille #GitLab #CVE202685706

CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild
#CVE_2026_85706
https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild/

Recent reports confirm a critical GitLab zero-day (CVE-2026-85706) exploited within 24 hours, alongside new EU Cyber Resilience Act mandates for 24-hour vulnerability reporting. Operational technology (OT) sectors face emerging ransomware threats. Meanwhile, leading AI developers advocate for a slowdown in development due to safety concerns, prompting market shifts. Geopolitically, the BRICS summit addressed rising global tensions and the "weaponization of technology."

#Cybersecurity #TechNews #Geopolitics

2026-W37 — Weekly Threat Roundup

🤖 AI is no longer just a defender's tool: state-sponsored groups and criminals weaponized Claude, ChatGPT, and OpenAI agents to automate exploitation, rebuild malware, and generate one million personalized phishing emails in three days.
🔓 GitLab's CVSS 10.0 path traversal flaw (CVE-2026-85706) wa…

https://threatnoir.com/weekly/2026-w37

#infosec #cybersecurity #threatintel

🤖 AI generated summary

GitLab CVE-2026-85706 is a maximum-severity path traversal in the repository commits API enabling unauthenticated arbitrary file read on self-managed servers. CISA added it to KEV with a three-day deadline, signaling active exploitation risk. Patch immediately and review for anomalous access to credentials and secrets. #GitLab #CisaKev #InfoSec

https://cyberworldops.eu/en/gitlab-path-traversal-flaw-enters-cisa-kev-with-three-day-patch

That is a faster turnaround than most people's pizza delivery.

Patch GitLab immediately to remediate CVE-2026-85706 — your self-managed server is the featured product in someone else's highlight reel.

Reward: Complimentary sponsorship credit from Deferred Maintenance Inc. Your inaction keeps them in business.

https://www.securityweek.com/gitlab-vulnerability-exploited-one-day-after-disclosure/

#GitLab #CyberSecurity #ZeroDay #PathTraversal #CVE #PatchedOrPerish (2/2)

🏆 New Achievement! Speed-Run Sponsored by Your Unpatched GitLab!

This achievement is brought to you by Deferred Maintenance Inc. — when you absolutely, positively need unauthenticated strangers reading every file on your server within a single HTTP request. CVE-2026-85706 scored a perfect ten out of ten on the CVSS scale, because some bugs don't do half measures. GitLab dropped patches on a Thursday. By Friday, WatchTowr was already watching wild exploitation probes roll in. One day. (1/2)

📰 GitLab Patches Critical CVSS 10.0 Path Traversal Vulnerability

GitLab releases emergency patches for a critical CVSS 10.0 path traversal flaw (CVE-2026-85706). Unauthenticated attackers can read arbitrary files. Active scanning detected. Upgrade self-managed instances NOW. #GitLab #CVE #CyberSecurity #PatchNow

🔗 https://cyber.netsecops.io/articles/gitlab-urges-patching-of-critical-cvss-10-path-traversal-flaw/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

🚨 Detection for the actively exploited GitLab vulnerability tagged as CVE-2026-85706 (CVSS 10.0) available here:
https://github.com/projectdiscovery/nuclei-templates/pull/17231/changes

PoC for unauthenticated arbitrary file read on Gitlab https://github.com/guneykabel/cve-2026-85706

VLC Media Player Flaws Allow Heap Corruption and Sensitive Data Disclosure

VideoLAN reports two vulnerabilities in VLC Media Player (CVE-2026-56711 and CVE-2026-73324) that allow attackers to corrupt heap memory or leak sensitive data via crafted PNG files and RTSP streams.

**If you use VLC Media Player (any version from 3.0.0 to 3.0.23), update it to the latest patched version as soon as VideoLAN releases it. Until you've updated, don't open media files, playlists, or RTSP streaming links that come from people or websites you don't know and trust.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/vlc-media-player-flaws-allow-heap-corruption-and-sensitive-data-disclosure-6-k-q-2-9/gD2P6Ple2L

VLC Media Player Flaws Allow Heap Corruption and Sensitive Data Disclosure

VideoLAN reports two vulnerabilities in VLC Media Player (CVE-2026-56711 and CVE-2026-73324) that allow attackers to corrupt heap memory or leak sensitive data via crafted PNG files and RTSP streams.

**If you use VLC Media Player (any version from 3.0.0 to 3.0.23), update it to the latest patched version as soon as VideoLAN releases it. Until you've updated, don't open media files, playlists, or RTSP streaming links that come from people or websites you don't know and trust.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/vlc-media-player-flaws-allow-heap-corruption-and-sensitive-data-disclosure-6-k-q-2-9/gD2P6Ple2L

VLC Media Player hit by two critical security flaws: heap corruption and memory disclosure putting millions at risk

https://thecybersecguru.com/news/vlc-media-player-vulnerabilities-cve-2026-56711-cve-2026-73324/

🟠 CVE-2026-16482 - High (7.5)

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied param...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16482/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89746 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free with same-name named triggers

When two hist triggers on different events are registered with the same
name=, the second one reuses the first as named...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89746/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89746 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free with same-name named triggers

When two hist triggers on different events are registered with the same
name=, the second one reuses the first as named...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89746/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89696 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return
success with fh_dentry and fh_export bo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89696/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89696 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref

When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return
success with fh_dentry and fh_export bo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89696/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89684 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix cpntf publish race in nfs4_init_cp_state

nfs4_alloc_init_cpntf_state() published the new cpntf entry into the
s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89684/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89684 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix cpntf publish race in nfs4_init_cp_state

nfs4_alloc_init_cpntf_state() published the new cpntf entry into the
s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89684/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-89504 Linux kernel regulator as3722 use-after-free via premature of_node_put, dangling of_node pointer. CVSS N/A, no patch yet. Audit your kernels and apply fixes as soon as they land. https://www.valtersit.com/cve/CVE-2026-89504/ #CVE #Linux #infosec

CVE-2026-89488: use-after-free in Linux openvswitch CT limit teardown. Unprivileged user can trigger slab-UAF in ovs_ct_execute(). CVSS N/A, no patch yet. Update immediately. https://www.valtersit.com/cve/CVE-2026-89488/ #CVE #Linux #infosec

D-Link DWR-M921 v1.1.52 is vulnerable to CRITICAL OS command injection (CVE-2026-90703, CVSS 9.4). No patch yet, public exploit out. Restrict access & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-90703-os-command-injection-in-d-link-dwr-m921-f9739a3ef4495656 #OffSeq #CVE #RouterSecurity #Infosec

D-Link DWR-M921 v1.1.52 is vulnerable to CRITICAL OS command injection (CVE-2026-90703, CVSS 9.4). No patch yet, public exploit out. Restrict access & monitor logs. Details: https://radar.offseq.com/threat/cve-2026-90703-os-command-injection-in-d-link-dwr-m921-f9739a3ef4495656 #OffSeq #CVE #RouterSecurity #Infosec

🔴 CVE-2026-90607 - Critical (9.9)

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90607/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Totolink A3002MU routers hit by CRITICAL (CVSS 9.4) buffer overflow (CVE-2026-90607) in formNewSchedule. Public exploit code available. Restrict remote access & monitor systems until a patch is released. https://radar.offseq.com/threat/cve-2026-90607-buffer-overflow-in-totolink-a3002mu-f5be31acbfac3e1f #OffSeq #CVE202690607 #RouterSecurity #Infosec

🔴 CVE-2026-90607 - Critical (9.9)

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90607/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Totolink A3002MU routers hit by CRITICAL (CVSS 9.4) buffer overflow (CVE-2026-90607) in formNewSchedule. Public exploit code available. Restrict remote access & monitor systems until a patch is released. https://radar.offseq.com/threat/cve-2026-90607-buffer-overflow-in-totolink-a3002mu-f5be31acbfac3e1f #OffSeq #CVE202690607 #RouterSecurity #Infosec

🔴 CVE-2026-90608 - Critical (9.9)

A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manipulation of the argument service_type causes buffer overflow. It is possible...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90608/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-90608: Totolink A3002MU routers have a CRITICAL buffer overflow (CVSS 9.4) in /boafrm/formPortFw. Exploit code is public; RCE possible. No patch — restrict external access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-90608-buffer-overflow-in-totolink-a3002mu-43328ea907451224 #OffSeq #CVE202690608 #RouterSecurity

🔴 CVE-2026-90608 - Critical (9.9)

A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manipulation of the argument service_type causes buffer overflow. It is possible...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90608/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-90608: Totolink A3002MU routers have a CRITICAL buffer overflow (CVSS 9.4) in /boafrm/formPortFw. Exploit code is public; RCE possible. No patch — restrict external access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-90608-buffer-overflow-in-totolink-a3002mu-43328ea907451224 #OffSeq #CVE202690608 #RouterSecurity

🟠 CVE-2026-33963 - High (7.5)

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffer overflow occurs when a malformed message is sent to the camera driver, causing a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33963/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33963 - High (7.5)

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680. A stack-based buffer overflow occurs when a malformed message is sent to the camera driver, causing a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33963/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 New security advisory:

CVE-2026-31278 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-31278-biostar-2-leaks-ad-service-credentials-poc

by Yazoul AI

#InfoSec #ZeroDay #ThreatIntel

🟠 CVE-2026-31278 - High (7.7)

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31278 - High (7.7)

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23789 - High (7.8)

An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23789 - High (7.8)

An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 2600, 1680, W920, W930, and W1000. A double-free vulnerability in the Exynos MFC encoder driv...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

PaperCut Attacker (Russian Linked) Uses AI Agents to Compromise 440 Instances

러시아어권으로 추정되는 공격자가 PaperCut NG/MF의 인증 우회·RCE 체인(CVE-2026-81578, CVE-2026-82078)을 악용해 48개국 395개 조직의 최소 440개 인스턴스를 침해한 것으로 보고됐다. 공격자는 OpenAI Codex, DeepSeek 모델, Hindsight의 지속 메모리, AionUi 멀티 에이전트 작업 공간을 결합해 취약점 분석부터 익스플로잇 수정, 표적 분류, 재시도, AD 정찰까지 자동화했으며, 실제 공격 개시 후 2...

https://www.swapupdate.in/papercut-attacker-uses-hundreds-of-ai-agents-to-compromise-440-instances/

🟠 CVE-2026-37008 - High (8.1)

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete obj...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-37008/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-37008 - High (8.1)

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete obj...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-37008/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29811 - High (7.7)

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29811/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29811 - High (7.7)

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29811/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90783 - High (7.8)

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an unde...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90783/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90783 - High (7.8)

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic. Attackers can craft a malicious AVI file with oversized entry counts that cause an unde...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90783/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-90775: HIGH severity vuln in PostGIS address_standardizer (≤3.7.0) allows out-of-bounds read via unvalidated Weight parameter, crashing PostgreSQL backend (DoS). Patch status pending — monitor vendor updates. https://radar.offseq.com/threat/cve-2026-90775-out-of-bounds-read-in-postgis-addressstandardizer-b09887107f7082c5 #OffSeq #PostGIS #Vuln

CVE-2026-90775: HIGH severity vuln in PostGIS address_standardizer (≤3.7.0) allows out-of-bounds read via unvalidated Weight parameter, crashing PostgreSQL backend (DoS). Patch status pending — monitor vendor updates. https://radar.offseq.com/threat/cve-2026-90775-out-of-bounds-read-in-postgis-addressstandardizer-b09887107f7082c5 #OffSeq #PostGIS #Vuln

🟠 CVE-2026-90779 - High (7.5)

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90779/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90779 - High (7.5)

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90779/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90778 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag para...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90778 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag para...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90776 - High (7.5)

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90776/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90776 - High (7.5)

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90776/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90780 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90780/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90780 - High (7.5)

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes. Unauthenticated remote attackers can send crafted SIP messages ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90780/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90769 - High (7.7)

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90769 - High (7.7)

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90774 - High (7.5)

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90774/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90774 - High (7.5)

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90774/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-90770 - High (8.8)

Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90770/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack