📈 CVE Published in last 7 days (2026-04-20 - 2026-04-27)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1459

Severity:
- Critical: 124
- High: 358
- Medium: 586
- Low: 70
- None: 321

Status:
- : 40
- Analyzed: 313
- Awaiting Analysis: 570
- Deferred: 238
- Modified: 9
- Received: 124
- Rejected: 23
- Undergoing Analysis: 142

Top CNAs:
- GitHub, Inc.: 326
- kernel.org: 257
- VulnCheck: 119
- VulDB: 114
- Oracle: 102
- MITRE: 69
- Wordfence: 67
- Canonical Ltd.: 46
- Mozilla Corporation: 42
- N/A: 40

Top Affected Products:
- UNKNOWN: 1040
- Openclaw: 42
- Mozilla Firefox: 39
- Mozilla Thunderbird: 38
- Oracle Mysql Server: 25
- Wwbn Avideo: 18
- Flowiseai Flowise: 18
- Uutils Coreutils: 14
- Silextechnology Sd-330ac Firmware: 11
- Gitlab: 11

Top EPSS Score:
- CVE-2026-5965 - 6.34 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5965)
- CVE-2026-41179 - 5.98 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41179)
- CVE-2026-40887 - 4.56 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-40887)
- CVE-2026-38834 - 3.22 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-38834)
- CVE-2026-41176 - 2.79 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41176)
- CVE-2026-21571 - 1.10 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21571)
- CVE-2026-6799 - 1.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6799)
- CVE-2026-24467 - 0.76 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24467)
- CVE-2026-41472 - 0.67 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41472)
- CVE-2019-25714 - 0.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2019-25714)

CRITICAL: Chrome <147.0.7727.138 on Windows is vulnerable to a use-after-free in Accessibility (CVE-2026-7344). Allows sandbox escape after renderer compromise. Patch now to mitigate risk. https://radar.offseq.com/threat/cve-2026-7344-use-after-free-in-google-chrome-1aabf4b9 #OffSeq #Chrome #Vuln #Cybersecurity

CRITICAL: Chrome <147.0.7727.138 on Windows is vulnerable to a use-after-free in Accessibility (CVE-2026-7344). Allows sandbox escape after renderer compromise. Patch now to mitigate risk. https://radar.offseq.com/threat/cve-2026-7344-use-after-free-in-google-chrome-1aabf4b9 #OffSeq #Chrome #Vuln #Cybersecurity

⚠️ CRITICAL: CVE-2026-7343 in Chrome (Windows <147.0.7727.138) is a use-after-free in Views that could allow renderer sandbox escape. Patch ASAP to mitigate. No known exploits yet. https://radar.offseq.com/threat/cve-2026-7343-use-after-free-in-google-chrome-6725c92f #OffSeq #Chrome #Vulnerability #Security

⚠️ CRITICAL: CVE-2026-7343 in Chrome (Windows <147.0.7727.138) is a use-after-free in Views that could allow renderer sandbox escape. Patch ASAP to mitigate. No known exploits yet. https://radar.offseq.com/threat/cve-2026-7343-use-after-free-in-google-chrome-6725c92f #OffSeq #Chrome #Vulnerability #Security

🟠 CVE-2026-42167 - High (8.1)

mod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42167 - High (8.1)

mod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41873 - Critical (9.8)

** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover.

This issue affects all versions of the Lua implementation of Pony Mail....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41873/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41873 - Critical (9.8)

** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover.

This issue affects all versions of the Lua implementation of Pony Mail....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41873/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41649 - High (7.7)

Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41649/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41649 - High (7.7)

Outline is a service that allows for collaborative documentation. The `shares.create` API endpoint starting in version 0.86.0 and prior to version 1.7.0 has an insecure direct object reference.. When both `collectionId` and `documentId` are provid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41649/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-38651 - High (8.2)

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-38651/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-38651 - High (8.2)

Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-38651/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 [CISA-2026:0428] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0428)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2024-1708 (https://secdb.nttzen.cloud/cve/detail/CVE-2024-1708)
- Name: ConnectWise ScreenConnect Path Traversal Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ConnectWise
- Product: ScreenConnect
- Notes: https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1708

⚠️ CVE-2026-32202 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-32202)
- Name: Microsoft Windows Protection Mechanism Failure Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202 ; https://nvd.nist.gov/vuln/detail/CVE-2026-32202

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260428 #cisa20260428 #cve_2024_1708 #cve_2026_32202 #cve20241708 #cve202632202

🛡️ Title: Windows Shell Spoofing Vulnerability
Description

🛡️ Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

https://www.cve.org/CVERecord?id=CVE-2026-32202

#cybersecurity #security #windows #microsoft

CVE ID: CVE-2026-32202
Vendor: Microsoft
Product: Windows
Date Added: 2026-04-28
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32202

🚨 [CISA-2026:0428] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0428)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2024-1708 (https://secdb.nttzen.cloud/cve/detail/CVE-2024-1708)
- Name: ConnectWise ScreenConnect Path Traversal Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ConnectWise
- Product: ScreenConnect
- Notes: https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1708

⚠️ CVE-2026-32202 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-32202)
- Name: Microsoft Windows Protection Mechanism Failure Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202 ; https://nvd.nist.gov/vuln/detail/CVE-2026-32202

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260428 #cisa20260428 #cve_2024_1708 #cve_2026_32202 #cve20241708 #cve202632202

🛡️ Title: Windows Shell Spoofing Vulnerability
Description

🛡️ Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

https://www.cve.org/CVERecord?id=CVE-2026-32202

#cybersecurity #security #windows #microsoft

CVE ID: CVE-2026-32202
Vendor: Microsoft
Product: Windows
Date Added: 2026-04-28
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-32202

Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202

https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html

Read on HackerWorkspace: https://hackerworkspace.com/article/microsoft-confirms-active-exploitation-of-windows-shell-cve-2026-32202

#cybersecurity #threatintelligence #vulnerability

A Shortcut to Coercion: Incomplete Patch of APT28's Zero-Day Leads to CVE-2026-32202
#CVE_2026_32202 #APT28 #CVE_2026_21510
https://www.akamai.com/blog/security-research/2026/apr/incomplete-patch-apt28s-zero-day-cve-2026-32202

🟠 CVE-2026-24222 - High (8.6)

NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending prompt-injected content that causes the agent to read and exfiltrate host environm...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24222/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

🟠 CVE-2026-24222 - High (8.6)

NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending prompt-injected content that causes the agent to read and exfiltrate host environm...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24222/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

🚨 [CISA-2026:0428] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0428)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2024-1708 (https://secdb.nttzen.cloud/cve/detail/CVE-2024-1708)
- Name: ConnectWise ScreenConnect Path Traversal Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ConnectWise
- Product: ScreenConnect
- Notes: https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1708

⚠️ CVE-2026-32202 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-32202)
- Name: Microsoft Windows Protection Mechanism Failure Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202 ; https://nvd.nist.gov/vuln/detail/CVE-2026-32202

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260428 #cisa20260428 #cve_2024_1708 #cve_2026_32202 #cve20241708 #cve202632202

CVE ID: CVE-2024-1708
Vendor: ConnectWise
Product: ScreenConnect
Date Added: 2026-04-28
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2024-1708

🚨 [CISA-2026:0428] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0428)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2024-1708 (https://secdb.nttzen.cloud/cve/detail/CVE-2024-1708)
- Name: ConnectWise ScreenConnect Path Traversal Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: ConnectWise
- Product: ScreenConnect
- Notes: https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1708

⚠️ CVE-2026-32202 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-32202)
- Name: Microsoft Windows Protection Mechanism Failure Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-32202 ; https://nvd.nist.gov/vuln/detail/CVE-2026-32202

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260428 #cisa20260428 #cve_2024_1708 #cve_2026_32202 #cve20241708 #cve202632202

CVE ID: CVE-2024-1708
Vendor: ConnectWise
Product: ScreenConnect
Date Added: 2026-04-28
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2024-1708

🟠 CVE-2026-7289 - High (8.8)

A vulnerability was found in D-Link DIR-825M 1.1.12. This issue affects the function sub_414BA8 of the file /boafrm/formWanConfigSetup. The manipulation of the argument submit-url results in buffer overflow. The attack can be executed remotely. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7289 - High (8.8)

A vulnerability was found in D-Link DIR-825M 1.1.12. This issue affects the function sub_414BA8 of the file /boafrm/formWanConfigSetup. The manipulation of the argument submit-url results in buffer overflow. The attack can be executed remotely. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7288 - High (8.8)

A vulnerability has been found in D-Link DIR-825M 1.1.12. This vulnerability affects the function sub_4151FC of the file /boafrm/formVpnConfigSetup. The manipulation of the argument submit-url leads to buffer overflow. Remote exploitation of the a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7288 - High (8.8)

A vulnerability has been found in D-Link DIR-825M 1.1.12. This vulnerability affects the function sub_4151FC of the file /boafrm/formVpnConfigSetup. The manipulation of the argument submit-url leads to buffer overflow. Remote exploitation of the a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) affected by CVE-2026-7204 — remote OS command injection in CGI handler. No patch yet. Restrict access & monitor for updates. Public exploit disclosed. https://radar.offseq.com/threat/cve-2026-7204-os-command-injection-in-totolink-a80-304b8a45 #OffSeq #Vulnerability #IoTSecurity #CVE20267204

🔴 CVE-2026-7204 - Critical (9.8)

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command inje...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7204/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: Totolink A8000RU routers (7.1cu.643_b20200521) vulnerable to remote, unauthenticated OS command injection (CVE-2026-7204). No patch yet. Restrict access & monitor vendor channels. https://radar.offseq.com/threat/cve-2026-7204-os-command-injection-in-totolink-a80-304b8a45 #OffSeq #Vuln #RouterSecurity #CVE20267204

💥 CVE-2026-7155: CRITICAL OS command injection in Totolink A8000RU (7.1cu.643_b20200521). Exploitable remotely, no auth needed. Disable remote mgmt & restrict access until patch. Details: https://radar.offseq.com/threat/cve-2026-7155-os-command-injection-in-totolink-a80-1189da9b #OffSeq #Vulnerability #CVE2026_7155 #IoTSecurity

🔴 CVE-2026-7155 - Critical (9.8)

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass leads to os c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7154 - Critical (9.8)

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument tty_server can lead to os...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7154/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Totolink A8000RU (v7.1cu.643_b20200521) faces CRITICAL OS command injection (CVE-2026-7244, CVSS 9.3). Remote, unauthenticated exploit possible. No patch yet — restrict mgmt access & monitor for updates. https://radar.offseq.com/threat/cve-2026-7244-os-command-injection-in-totolink-a80-f82a0e92 #OffSeq #Vuln #RouterSecurity #CVE2026_7244

🚨 CRITICAL OS command injection in Totolink A8000RU (7.1cu.643_b20200521) via setVpnAccountCfg lets remote attackers run arbitrary commands. No patch yet; restrict device access & monitor closely. CVE-2026-7240 https://radar.offseq.com/threat/cve-2026-7240-os-command-injection-in-totolink-a80-cd808cb1 #OffSeq #CVE20267240 #infosec

🟠 CVE-2026-3323 - High (7.5)

An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3323/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3323 - High (7.5)

An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3323/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5944 - High (8.2)

An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endpoint on TCP port 7373 that is accessible within the network scope of the deployment envi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5944/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5944 - High (8.2)

An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endpoint on TCP port 7373 that is accessible within the network scope of the deployment envi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5944/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7279 - High (7.8)

AVACAST developed by eMPIA Technology, has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a malicious DLL in a specific directory, resulting in arbitrary code execution with system privileges when the system loads t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7279 - High (7.8)

AVACAST developed by eMPIA Technology, has a DLL Hijacking vulnerability, allowing authenticated local attackers to place a malicious DLL in a specific directory, resulting in arbitrary code execution with system privileges when the system loads t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67223 - High (7.5)

The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtua...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67223/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67223 - High (7.5)

The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly accessible directory, which allows unauthenticated remote attackers to obtain direct virtua...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67223/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27760 - High (8.1)

OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27760/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27760 - High (8.1)

OpenCATS prior to commit 3002a29 contains a PHP code injection vulnerability in the installer AJAX endpoint that allows unauthenticated attackers to execute arbitrary code by injecting PHP statements into the databaseConnectivity action parameter....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27760/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-32644 (CRITICAL, CVSS 9.2): Milesight MS-Cxx63-PD cameras have default SSL private keys, exposing encrypted traffic to interception & tampering. No patch yet — restrict access & follow vendor updates. https://radar.offseq.com/threat/cve-2026-32644-cwe-321-in-milesight-ms-cxx63-pd-60e79b90 #OffSeq #IoTSecurity #Vulnerability

🔴 CVE-2026-32644 - Critical (9.8)

Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32644/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20766 - High (8.8)

An out-of-bounds memory access vulnerability exists in specific firmware versions of Milesight AIOT cameras.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20766/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40972 - High (7.5)

An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this could result in the attacker determining the secret and uploading chang...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40972/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7321 - Critical (9.6)

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox ESR 140.10.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7321/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7321 - Critical (9.6)

Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. This vulnerability was fixed in Firefox ESR 140.10.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7321/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7320 - High (7.5)

Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, and Firefox ESR 115.35.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7320/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7320 - High (7.5)

Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, and Firefox ESR 115.35.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7320/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24186 - High (8.8)

NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message. A successful exploit of this vulnerability might lead to code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24186/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

🟠 CVE-2026-24186 - High (8.8)

NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message. A successful exploit of this vulnerability might lead to code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24186/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

🔴 CVE-2026-24178 - Critical (9.8)

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24178/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

🔴 CVE-2026-24178 - Critical (9.8)

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24178/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

Nvidia has posted two advisories:

"NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key."

- Critical: CVE-2026-24178, CVE-2026-24186, and CVE-2026-24204: NVIDIA FLARE SDK - April 2026 https://nvidia.custhelp.com/app/answers/detail/a_id/5819

"NVIDIA NemoClaw contains a vulnerability in the sandbox environment initialization component where a remote attacker may cause improper access control by sending prompt-injected content."

- High: CVE-2026-24222 and CVE-2026-24231: https://nvidia.custhelp.com/app/answers/detail/a_id/5837 #Nvidia #infoec #vulnerability

🔴 CVE-2026-3893 - Critical (9.4)

The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism,
allowing an attacker with network access to directly access and modify
its configuration and operational functions without needing credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3893/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3893 - Critical (9.4)

The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism,
allowing an attacker with network access to directly access and modify
its configuration and operational functions without needing credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3893/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41395 - High (7.5)

OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to bypass replay...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41395/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41395 - High (7.5)

OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes query ordering for signatures but hashes raw URLs for replay detection. Attackers can reorder query parameters to bypass replay...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41395/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41404 - High (8.8)

OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation. Attackers can exploit this by declaring operator scopes on non-Control-UI clients, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41404 - High (8.8)

OpenClaw before 2026.3.31 contains an incomplete scope-clearing vulnerability in trusted-proxy authentication mode that allows operator.admin privilege escalation. Attackers can exploit this by declaring operator scopes on non-Control-UI clients, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41404/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41396 - High (7.8)

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41396/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41396 - High (7.8)

OpenClaw before 2026.3.31 allows workspace .env files to override the OPENCLAW_BUNDLED_PLUGINS_DIR environment variable, compromising plugin trust verification. Attackers with control over workspace configuration can inject malicious plugins by ov...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41396/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41912 - High (7.6)

OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks. Attackers can exploit browser interactions to bypass SSRF protections and access re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41912/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41912 - High (7.6)

OpenClaw before 2026.4.8 contains a server-side request forgery policy bypass vulnerability allowing attackers to trigger navigations bypassing normal SSRF checks. Attackers can exploit browser interactions to bypass SSRF protections and access re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41912/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41405 - High (7.5)

OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server reso...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41405/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41405 - High (7.5)

OpenClaw before 2026.3.31 parses MS Teams webhook request bodies before performing JWT validation, allowing unauthenticated attackers to trigger resource exhaustion. Remote attackers can send malicious Teams webhook payloads to exhaust server reso...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41405/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42422 - High (8.8)

OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42422 - High (8.8)

OpenClaw before 2026.4.8 contains a role bypass vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles. Attackers can bypass device role-upgrade pairing to preserve or mint roles and scopes that had not u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41914 - High (8.5)

OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist pol...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41914 - High (8.5)

OpenClaw before 2026.4.8 contains a server-side request forgery vulnerability in QQ Bot media download paths that bypass SSRF protection. Attackers can exploit unprotected media fetch endpoints to access internal resources and bypass allowlist pol...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42423 - High (7.5)

OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42423/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42423 - High (7.5)

OpenClaw before 2026.4.8 contains an approval-timeout fallback mechanism that bypasses strictInlineEval explicit-approval requirements on gateway and node exec hosts. Attackers can exploit this timeout fallback to execute inline eval commands that...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42423/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42432 - High (7.8)

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without operator.admin scope requirement. Attackers can bypass re-pairing authentication to execute pri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42432/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42432 - High (7.8)

OpenClaw before 2026.4.8 contains a privilege escalation vulnerability allowing previously paired nodes to reconnect with exec-capable commands without operator.admin scope requirement. Attackers can bypass re-pairing authentication to execute pri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42432/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42431 - High (8.1)

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of persistent browser profiles. Attackers can exploit this path to circumvent the browser.request persistent profile-mutation guar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42431/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42431 - High (8.1)

OpenClaw before 2026.4.8 contains a security bypass vulnerability in node.invoke(browser.proxy) that allows mutation of persistent browser profiles. Attackers can exploit this path to circumvent the browser.request persistent profile-mutation guar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42431/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6785 - High (8.1)

Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have be...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6786 - High (8.1)

Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40453 - Critical (9.9)

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCase(true) call was no...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40048 - High (7.8)

The Camel-PQC FileBasedKeyLifecycleManager class deserializes the contents of `.key` files in the configured key directory using java.io.ObjectInputStream without applying any ObjectInputFilter or class-loading restrictions. The cast to `java.secu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40048/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33454 - Critical (9.4)

The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, while it does not configure t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33454/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40022 - High (8.2)

When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the B...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40022/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Discussion: http://news.ycombinator.com/item?id=47936479

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Discussion: https://news.ycombinator.com/item?id=47936479

There should be a "but the service is never up to be exploited" reducer on the CVE score.
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Question about the GitHub RCE:

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 says GHES patches were _released_ on 03/10.

https://github.blog/security/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability/ says "we _prepared_ patches [...] and published CVE-2026-3854. These are _available today_".

So were GHES patches made available to customers at the time of CVE publication or only today, 1.5 months laster?

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Discussion: http://news.ycombinator.com/item?id=47936479

Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854) https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Critical GitHub Vulnerability CVE-2026-3854 Enables Remote Code Execution via Simple Git Push + Video

Introduction: A Silent Flaw Inside a Trusted Developer Ecosystem A newly discovered security vulnerability inside GitHub has exposed a dangerous weakness in one of the most widely trusted development platforms in the world. Identified as CVE-2026-3854, this flaw allows attackers to execute malicious code on backend systems using nothing more than a carefully crafted…

https://undercodenews.com/critical-github-vulnerability-cve-2026-3854-enables-remote-code-execution-via-simple-git-push-video/

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
https://news.ycombinator.com/item?id=47936479

#hackernews #tech

Researchers Discover Critical GitHub CVE-2026-3854 RCE Flaw Exploitable via Single Git Push https://thehackernews.com/2026/04/researchers-discover-critical-github.html

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown https://lobste.rs/s/8fxgx7 #security #vibecoding
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Discussion: https://news.ycombinator.com/item?id=47936479

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Discussion: https://news.ycombinator.com/item?id=47936479

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Comments: https://news.ycombinator.com/item?id=47936479

@GossiTheDog Here's a non-Twitter link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

HAHAHAHAHHAHAHAHAHAHAH https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Wiz got RCE on the cloud version of Github.com and access to every customer environment.

To do this they just reversed the on prem version and found a simple vuln.

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Read on HackerWorkspace: https://hackerworkspace.com/article/github-rce-vulnerability-cve-2026-3854-breakdown-wiz-blog

#aisecurity #vulnerability #exploit

🎉 BREAKING NEWS: #Hackers discover GitHub's secret Easter egg, allowing anyone with a pulse to play "Command & Conquer" on their backend servers! 😂 A riveting tale of how to hack into the Matrix using nothing but a 'git' command — surely, Neo is quaking in his boots. 🕶️
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 #GitHub #EasterEgg #CommandAndConquer #HackingIntoTheMatrix #NeoQuaking #HackerNews #ngated

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

#HackerNews #GitHub #RCE #Vulnerability #CVE-2026-3854 #Cybersecurity #Vulnerability #Analysis #InfoSec

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown - https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

#hackernews

Updates**
- GitHub availability issues and service disruptions
- BookStack migrating from GitHub to Codeberg
- GitHub RCE vulnerability (CVE-2026-3854)

3. **Privacy and Security Concerns**
- Period tracking apps selling data to Meta
- Signal phishing attacks targeting journalists and politicians
- "Pack2TheRoot" Linux vulnerability affecting multiple distributions

4. **Tech Industry and Corporate News**
- Google’s Pentagon AI deal despite employee [2/4]

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

#github

Beaucoup de gens vont sans doute résumer la faille de sécurité CVE-2026-3854 en « Mon Dieu, la totalité des logiciels hébergés sur GitHub ont peut-être été compromis ».

Mais, en fait, c'était déjà possible, Microsoft (propriétaire de GitHub) pouvait déjà tout modifier.

Tout ce qu'a permis CVE-2026-3854, si des gens l'ont exploité, c'est de démocratiser cette possibilité, en la rendant accessible à tous les gens ayant un compte GitHub.

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Discussion: https://news.ycombinator.com/item?id=47936479

There should be a "but the service is never up to be exploited" reducer on the CVE score.
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Question about the GitHub RCE:

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 says GHES patches were _released_ on 03/10.

https://github.blog/security/securing-the-git-push-pipeline-responding-to-a-critical-remote-code-execution-vulnerability/ says "we _prepared_ patches [...] and published CVE-2026-3854. These are _available today_".

So were GHES patches made available to customers at the time of CVE publication or only today, 1.5 months laster?

Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854) https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
https://news.ycombinator.com/item?id=47936479

#hackernews #tech

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown https://lobste.rs/s/8fxgx7 #security #vibecoding
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Discussion: https://news.ycombinator.com/item?id=47936479

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Discussion: https://news.ycombinator.com/item?id=47936479

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown
Link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854
Comments: https://news.ycombinator.com/item?id=47936479

@GossiTheDog Here's a non-Twitter link: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

HAHAHAHAHHAHAHAHAHAHAH https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Wiz got RCE on the cloud version of Github.com and access to every customer environment.

To do this they just reversed the on prem version and found a simple vuln.

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

Read on HackerWorkspace: https://hackerworkspace.com/article/github-rce-vulnerability-cve-2026-3854-breakdown-wiz-blog

#aisecurity #vulnerability #exploit

🎉 BREAKING NEWS: #Hackers discover GitHub's secret Easter egg, allowing anyone with a pulse to play "Command & Conquer" on their backend servers! 😂 A riveting tale of how to hack into the Matrix using nothing but a 'git' command — surely, Neo is quaking in his boots. 🕶️
https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 #GitHub #EasterEgg #CommandAndConquer #HackingIntoTheMatrix #NeoQuaking #HackerNews #ngated

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

#HackerNews #GitHub #RCE #Vulnerability #CVE-2026-3854 #Cybersecurity #Vulnerability #Analysis #InfoSec

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

#github

Beaucoup de gens vont sans doute résumer la faille de sécurité CVE-2026-3854 en « Mon Dieu, la totalité des logiciels hébergés sur GitHub ont peut-être été compromis ».

Mais, en fait, c'était déjà possible, Microsoft (propriétaire de GitHub) pouvait déjà tout modifier.

Tout ce qu'a permis CVE-2026-3854, si des gens l'ont exploité, c'est de démocratiser cette possibilité, en la rendant accessible à tous les gens ayant un compte GitHub.

https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

📰 Critical Unpatched RCE Flaw in Hugging Face's LeRobot AI Platform Puts Robotics Systems at Risk

🚨 CRITICAL FLAW: Unpatched RCE (CVE-2026-25874, CVSS 9.3) in Hugging Face's LeRobot AI platform. Unsafe deserialization allows unauthenticated attackers to execute code. #CVE202625874 #HuggingFace #AI #RCE

🔗 https://cyber.netsecops.io

📰 Critical Unpatched RCE Flaw in Hugging Face's LeRobot AI Platform Puts Robotics Systems at Risk

🚨 CRITICAL FLAW: Unpatched RCE (CVE-2026-25874, CVSS 9.3) in Hugging Face's LeRobot AI platform. Unsafe deserialization allows unauthenticated attackers to execute code. #CVE202625874 #HuggingFace #AI #RCE

🔗 https://cyber.netsecops.io

May I suggest...not exposing your robot control plane to the internet

https://www.resecurity.com/blog/article/cve-2026-25874-hugging-face-lerobot-unauthenticated-rce-via-pickle-deserialization

The vulnerability in question is CVE-2026-25874 (CVSS score: 9.3), which has been described as a case of untrusted data deserialization stemming from the use of the unsafe pickle format. https://thehackernews.com/2026/04/critical-cve-2026-25874-leaves-hugging.html

🟠 CVE-2026-41364 - High (8.1)

OpenClaw before 2026.3.31 contains a symlink following vulnerability in SSH sandbox tar upload that allows remote attackers to write arbitrary files. Attackers can exploit this by uploading tar archives containing symlinks to escape the sandbox an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41364/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41371 - High (8.5)

OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in chat.send that allows write-scoped gateway callers to trigger admin-only session reset operations. Attackers can rotate target sessions, archive prior transcript state, and...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41371/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: OS command injection in JPCERT/CC LogonTracer before v2.0.0 (CVE-2026-33277). Logged-in users can run arbitrary OS commands. Restrict access & monitor logs until patch available. https://radar.offseq.com/threat/cve-2026-33277-improper-neutralization-of-special--31d12542 #OffSeq #Vuln #LogonTracer #Infosec

🟠 CVE-2026-33277 - High (8.8)

An OS command Injection issue exists in LogonTracer prior to v2.0.0. An arbitrary OS command may be executed by a logged-in user.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41602 - High (7.5)

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41602/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41602 - High (7.5)

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation

This issue affects Apache Thrift: before 0.23.0.

Users are recommended to upgrade to version 0.23.0, which fixes the issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41602/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-04-20 - 2026-04-27)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1459

Severity:
- Critical: 124
- High: 358
- Medium: 586
- Low: 70
- None: 321

Status:
- : 40
- Analyzed: 313
- Awaiting Analysis: 570
- Deferred: 238
- Modified: 9
- Received: 124
- Rejected: 23
- Undergoing Analysis: 142

Top CNAs:
- GitHub, Inc.: 326
- kernel.org: 257
- VulnCheck: 119
- VulDB: 114
- Oracle: 102
- MITRE: 69
- Wordfence: 67
- Canonical Ltd.: 46
- Mozilla Corporation: 42
- N/A: 40

Top Affected Products:
- UNKNOWN: 1040
- Openclaw: 42
- Mozilla Firefox: 39
- Mozilla Thunderbird: 38
- Oracle Mysql Server: 25
- Wwbn Avideo: 18
- Flowiseai Flowise: 18
- Uutils Coreutils: 14
- Silextechnology Sd-330ac Firmware: 11
- Gitlab: 11

Top EPSS Score:
- CVE-2026-5965 - 6.34 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5965)
- CVE-2026-41179 - 5.98 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41179)
- CVE-2026-40887 - 4.56 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-40887)
- CVE-2026-38834 - 3.22 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-38834)
- CVE-2026-41176 - 2.79 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41176)
- CVE-2026-21571 - 1.10 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21571)
- CVE-2026-6799 - 1.06 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6799)
- CVE-2026-24467 - 0.76 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-24467)
- CVE-2026-41472 - 0.67 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41472)
- CVE-2019-25714 - 0.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2019-25714)

🟠 CVE-2026-42426 - High (8.8)

OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attacker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42426 - High (8.8)

OpenClaw before 2026.4.8 contains an improper authorization vulnerability where the node.pair.approve method accepts operator.write scope instead of the narrower operator.pairing scope, allowing unprivileged users to approve node pairing. Attacker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41399 - High (7.5)

OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network attackers can exhaust socket and worker capacity to disrupt WebSocket availability for ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41399 - High (7.5)

OpenClaw before 2026.3.28 accepts unbounded concurrent unauthenticated WebSocket upgrades without pre-authentication budget allocation. Unauthenticated network attackers can exhaust socket and worker capacity to disrupt WebSocket availability for ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41399/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41394 - High (8.2)

OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41394/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41394 - High (8.2)

OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes. Attackers can access these routes without authentication to perform privileged runtime a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41394/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41387 - High (7.8)

OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41387/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41387 - High (7.8)

OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts that allows package-manager environment overrides. Attackers can exploit approved exec ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41387/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41386 - Critical (9.1)

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41386/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41386 - Critical (9.1)

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41386/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41384 - High (7.8)

OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41384/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41384 - High (7.8)

OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41384/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41383 - High (8.1)

OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. Attackers can man...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41383/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41383 - High (8.1)

OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remoteWorkspaceDir and remoteAgentWorkspaceDir configuration values. Attackers can man...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41383/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41378 - High (8.8)

OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41378 - High (8.8)

OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestricted gateway-side tool access. Attackers with trusted paired node credentials can escal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7040 - High (7.5)

Text::Minify::XS versions from v0.3.0 before v0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters.

The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption.

Note that the minify_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7040/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Microsoft Patches Critical CVSS 10.0 SSRF Vulnerability in Entra ID

Microsoft patched a critical SSRF vulnerability (CVE-2026-35431) in Entra ID Entitlement Management with a CVSS score of 10.0 that allowed unauthenticated spoofing and internal network access. The flaw was fixed server-side, requiring no action from users to secure their environments.

**No action is needed on your part, Microsoft already fixed this vulnerability on their cloud servers on April 23, 2026. As a good practice, review your Entra ID sign-in and audit logs for any unusual activity from before that date, and ensure multi-factor authentication is enforced for all admin accounts.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/microsoft-patches-critical-cvss-10-0-ssrf-vulnerability-in-entra-id-c-d-3-y-z/gD2P6Ple2L

Microsoft Patches Critical CVSS 10.0 SSRF Vulnerability in Entra ID

Microsoft patched a critical SSRF vulnerability (CVE-2026-35431) in Entra ID Entitlement Management with a CVSS score of 10.0 that allowed unauthenticated spoofing and internal network access. The flaw was fixed server-side, requiring no action from users to secure their environments.

**No action is needed on your part, Microsoft already fixed this vulnerability on their cloud servers on April 23, 2026. As a good practice, review your Entra ID sign-in and audit logs for any unusual activity from before that date, and ensure multi-factor authentication is enforced for all admin accounts.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/microsoft-patches-critical-cvss-10-0-ssrf-vulnerability-in-entra-id-c-d-3-y-z/gD2P6Ple2L

🚨 CVE-2026-7243: Critical OS command injection in Totolink A8000RU (7.1cu.643_b20200521). Remote, unauthenticated RCE risk — public exploit out, no patch yet. Lock down management access & monitor for updates. https://radar.offseq.com/threat/cve-2026-7243-os-command-injection-in-totolink-a80-73a189fb #OffSeq #Vulnerability #RouterSecurity

⚠️ CRITICAL: CVE-2026-7248 in D-Link DI-8100 (fw 16.07.26A1) enables remote buffer overflow via 'fn' in CGI Endpoint. No patch available — restrict access & monitor for updates. Exploit code is public. https://radar.offseq.com/threat/cve-2026-7248-buffer-overflow-in-d-link-di-8100-798ac14e #OffSeq #DLink #Vuln #Infosec

🛑 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) is vulnerable to OS command injection (CVE-2026-7202). Public exploit available. Restrict remote access & disable WPS until patched! https://radar.offseq.com/threat/cve-2026-7202-os-command-injection-in-totolink-a80-9229772f #OffSeq #IoTSecurity #vulnerability #CVE20267202

🔴 CVE-2026-7202 - Critical (9.8)

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument wscDisabled leads to os command injec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7202/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) suffers from OS command injection (CVE-2026-7203). Remote, unauthenticated attackers can fully compromise affected routers. No patch confirmed — disable remote mgmt & isolate. https://radar.offseq.com/threat/cve-2026-7203-os-command-injection-in-totolink-a80-b3a02d32 #OffSeq #Vuln #IoTSec

🔴 CVE-2026-7203 - Critical (9.8)

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os comma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7203/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-27785 - High (8.8)

Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40976 - Critical (9.1)

In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7160 - High (8.8)

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed fro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: Totolink A8000RU (7.1cu.643_b20200521) is vulnerable to OS command injection (CVE-2026-7156, CVSS 9.3). Exploit is public — remote attackers can fully compromise devices. Disable remote mgmt & restrict access now. https://radar.offseq.com/threat/cve-2026-7156-os-command-injection-in-totolink-a80-8abcd97a #OffSeq #CVE20267156 #IoTSecurity

🔴 CVE-2026-7156 - Critical (9.8)

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7156/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7151 - High (8.8)

A vulnerability was determined in Tenda HG3 2.0. Impacted is the function formUploadConfig of the file /boaform/formIPv6Routing. This manipulation of the argument destNet causes stack-based buffer overflow. It is possible to initiate the attack re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7153 - Critical (9.8)

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sys_in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7153/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30350 - High (7.5)

An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30350/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31662 - High (7.5)

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG

The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements
bc_ackers on every inbound group ACK, even when the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31662/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6741 - High (8.8)

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1. This is due to a missing authorization check in the execute() method of the con...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6741/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7152 - Critical (9.8)

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31637 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: reject undecryptable rxkad response tickets

rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then
parses the buffer as plaintext without checking whether
cry...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31637/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31659 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: reject oversized global TT response buffers

batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
global TT response in 16-bit temporaries. When a ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31659/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31657 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: hold claim backbone gateways by reference

batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway's last reference while readers still follow ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31656 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat

A use-after-free / refcount underflow is possible when the heartbeat
worker and intel_engine_park_heartbeat() ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31656/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31652 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/stat: deallocate damon_call() failure leaking damon_ctx

damon_stat_start() always allocates the module's damon_ctx object
(damon_stat_context). Meanwhile, if damon_cal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31652/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31650 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mmc: vub300: fix use-after-free on disconnect

The vub300 driver maintains an explicit reference count for the
controller and its driver data and the last reference can in theory...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31649 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix integer underflow in chain mode

The jumbo_frm() chain-mode implementation unconditionally computes

len = nopaged_len - bmax;

where nopaged_len = skb_headl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31649/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31648 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

mm: filemap: fix nr_pages calculation overflow in filemap_map_pages()

When running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I
encountered some very strange crash issu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31669 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix slab-use-after-free in __inet_lookup_established

The ehash table lookups are lockless and rely on
SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability
during RCU...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31669/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-31668 - Critical (9.8)

In the Linux kernel, the following vulnerability has been resolved:

seg6: separate dst_cache for input and output paths in seg6 lwtunnel

The seg6 lwtunnel uses a single dst_cache per encap route, shared
between seg6_input_core() and seg6_output_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31667 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

Input: uinput - fix circular locking dependency with ff-core

A lockdep circular locking dependency warning can be triggered
reproducibly when using a force-feedback gamepad with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31667/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31666 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()

After commit 1618aa3c2e01 ("btrfs: simplify return variables in
lookup_extent_data_ref()"), the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31666/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31665 - High (7.8)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: fix use-after-free in timeout object destroy

nft_ct_timeout_obj_destroy() frees the timeout object with kfree()
immediately after nf_ct_untimeout(), without w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31665/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The diversity of advisory is key. Look at how good the advisory of GitHub is compared to the others.

https://db.gcve.eu/vuln/cve-2026-40372

#cve #vulnerability #vulnerabilitymanagement

⚪️ Microsoft Issues Emergency Patch for Critical ASP.NET Vulnerability

🗨️ Microsoft has released an out-of-band update for ASP.NET Core. The patch fixes a critical vulnerability in the Data Protection cryptographic APIs that allowed unauthenticated attackers to obtain SYSTEM privileges by forging authentication cookies. The vulnerability is tracked as CVE-2026-40372 and…

🔗 https://hackmag.com/news/asp-net-patch?utm_source=mastodon&utm_medium=social&utm_campaign=repost_hackmag_to_socials

#news

🟠 CVE-2026-42039 - High (7.5)

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a Range...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30352 - Critical (9.8)

A remote code execution (RCE) vulnerability in the /devserver/start endpoint of leonvanzyl autocoder commit 79d02a allows attackers to execute arbitrary code via providing a crafted command parameter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 New security advisory:

CVE-2026-41635 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-41635-apache-mina-unauth-rce-via-deserialization

#InfoSec #VulnerabilityManagement #CyberSec

🔴 CVE-2026-41635 - Critical (9.8)