🛡️ CVE-2026-5809: HIGH severity vuln in wpForo Forum plugin ≤3.0.2 lets subscriber+ users delete arbitrary files (e.g., wp-config.php). No patch yet — restrict permissions & monitor topic edits for abuse. https://radar.offseq.com/threat/cve-2026-5809-cwe-73-external-control-of-file-name-7d1ff4ec #OffSeq #WordPress #Vuln #InfoSec

🛡️ CVE-2026-5809: HIGH severity vuln in wpForo Forum plugin ≤3.0.2 lets subscriber+ users delete arbitrary files (e.g., wp-config.php). No patch yet — restrict permissions & monitor topic edits for abuse. https://radar.offseq.com/threat/cve-2026-5809-cwe-73-external-control-of-file-name-7d1ff4ec #OffSeq #WordPress #Vuln #InfoSec

🚨 CRITICAL: CVE-2026-34621 in Adobe Acrobat Reader (≤26.001.21367) enables arbitrary code execution via prototype pollution if a user opens a malicious file. No patch yet — exercise caution! https://radar.offseq.com/threat/cve-2026-34621-improperly-controlled-modification--1b9951d5 #OffSeq #Adobe #Security

🚨 CRITICAL: CVE-2026-34621 in Adobe Acrobat Reader (≤26.001.21367) enables prototype pollution & arbitrary code execution via malicious files. No patch yet — avoid opening untrusted PDFs. Monitor advisories. https://radar.offseq.com/threat/cve-2026-34621-improperly-controlled-modification--1b9951d5 #OffSeq #Adobe #Vuln #Infosec

🚨 CRITICAL: CVE-2026-34621 in Adobe Acrobat Reader (≤26.001.21367) enables arbitrary code execution via prototype pollution if a user opens a malicious file. No patch yet — exercise caution! https://radar.offseq.com/threat/cve-2026-34621-improperly-controlled-modification--1b9951d5 #OffSeq #Adobe #Security

🚨 CRITICAL: CVE-2026-34621 in Adobe Acrobat Reader (≤26.001.21367) enables prototype pollution & arbitrary code execution via malicious files. No patch yet — avoid opening untrusted PDFs. Monitor advisories. https://radar.offseq.com/threat/cve-2026-34621-improperly-controlled-modification--1b9951d5 #OffSeq #Adobe #Vuln #Infosec

🟠 CVE-2026-4152 - High (7.8)

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerabilit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4152 - High (7.8)

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerabilit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4151 - High (7.8)

GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4151 - High (7.8)

GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4150 - High (7.8)

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4150/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4150 - High (7.8)

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4150/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4157 - High (7.5)

ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex devices. Authentication i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4157/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4157 - High (7.5)

ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex devices. Authentication i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4157/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4156 - High (7.5)

ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex EV chargers. Auth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4156/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4156 - High (7.5)

ChargePoint Home Flex OCPP getpreq Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex EV chargers. Auth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4156/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4155 - High (7.5)

ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4155 - High (7.5)

ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5494 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User intera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5494 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User intera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5494 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User intera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5494 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User intera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5059 - Critical (9.8)

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerab...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5059 - Critical (9.8)

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerab...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5059 - Critical (9.8)

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerab...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5059 - Critical (9.8)

aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerab...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5059/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5495 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User intera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5495/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5495 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User intera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5495/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5493 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User intera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5493/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5493 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User intera...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5493/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5058 - Critical (9.8)

aws-mcp-server Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability.

...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5058/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5058 - Critical (9.8)

aws-mcp-server Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aws-mcp-server. Authentication is not required to exploit this vulnerability.

...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5058/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5144 - High (8.8)

The BuddyPress Groupblog plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.3. This is due to the group blog settings handler accepting the `groupblog-blogid`, `default-member`, and `groupblog-sile...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5144/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5144 - High (8.8)

The BuddyPress Groupblog plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.3. This is due to the group blog settings handler accepting the `groupblog-blogid`, `default-member`, and `groupblog-sile...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5144/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5496 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User interaction...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5496/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5496 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User interaction...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5496/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5496 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User interaction...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5496/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5496 - High (7.8)

Labcenter Electronics Proteus PDSPRJ File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Labcenter Electronics Proteus. User interaction...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5496/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5055 - High (7.8)

NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5055/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5055 - High (7.8)

NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5055/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5054 - High (7.8)

NoMachine External Control of File Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-pri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5054/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5054 - High (7.8)

NoMachine External Control of File Path Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-pri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5054/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4154 - High (7.8)

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4154/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4154 - High (7.8)

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4154/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4153 - High (7.8)

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerabilit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4153/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4153 - High (7.8)

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerabilit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4153/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-4149: Sonos Era 300 (v17.5) has a CRITICAL remote code execution vulnerability via SMB, allowing kernel-level compromise without auth. No patch yet — restrict SMB access! https://radar.offseq.com/threat/cve-2026-4149-cwe-119-improper-restriction-of-oper-dcf90312 #OffSeq #Sonos #Infosec #RCE

🔴 CVE-2026-4149 - Critical (10)

Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos Era 300. Authentication is not required to exploit this vu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-4149 in Sonos Era 300 (v17.5) allows unauth RCE via SMB out-of-bounds flaw (CVSS 10.0). No patch yet — restrict SMB access, monitor advisories. https://radar.offseq.com/threat/cve-2026-4149-cwe-119-improper-restriction-of-oper-dcf90312 #OffSeq #Sonos #Vuln #RCE

⚠️ CVE-2026-4149: Sonos Era 300 (v17.5) has a CRITICAL remote code execution vulnerability via SMB, allowing kernel-level compromise without auth. No patch yet — restrict SMB access! https://radar.offseq.com/threat/cve-2026-4149-cwe-119-improper-restriction-of-oper-dcf90312 #OffSeq #Sonos #Infosec #RCE

🔴 CVE-2026-4149 - Critical (10)

Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sonos Era 300. Authentication is not required to exploit this vu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-4149 in Sonos Era 300 (v17.5) allows unauth RCE via SMB out-of-bounds flaw (CVSS 10.0). No patch yet — restrict SMB access, monitor advisories. https://radar.offseq.com/threat/cve-2026-4149-cwe-119-improper-restriction-of-oper-dcf90312 #OffSeq #Sonos #Vuln #RCE

🟠 CVE-2026-40188 - High (7.7)

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40188/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40188 - High (7.7)

goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, so it is possible to write outside of the root directory of the SFTP. This vulnerability ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40188/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5483 - High (8.5)

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could ena...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5483/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5483 - High (8.5)

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a NodeJS endpoint. This could ena...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5483/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-6057: CRITICAL path traversal in FalkorDB Browser 1.9.3 (file upload API). Unauthenticated attackers can write arbitrary files, risking RCE. No patch yet — restrict access and monitor logs. https://radar.offseq.com/threat/cve-2026-6057-cwe-22-path-traversal-in-falkordb-fa-80645f49 #OffSeq #Vulnerability #FalkorDB #InfoSec

CVE-2026-40189 (CRITICAL): patrickhener goshs <2.0.0-beta.4 has a missing auth bug — attackers can upload, delete, or remove auth files, exposing protected dirs. Upgrade to 2.0.0-beta.4 ASAP. https://radar.offseq.com/threat/cve-2026-40189-cwe-862-missing-authorization-in-pa-3a1ae9b4 #OffSeq #CVE202640189 #GoLang #infosec

🚨 CVE-2026-40189: goshs <2.0.0-beta.4 has a CRITICAL auth bypass. Attackers can upload, delete, and remove folder auth to access protected files. Mitigate by upgrading now! https://radar.offseq.com/threat/cve-2026-40189-cwe-862-missing-authorization-in-pa-3a1ae9b4 #OffSeq #CVE202640189 #infosec #GoLang

CVE-2026-40189 (CRITICAL): patrickhener goshs <2.0.0-beta.4 has a missing auth bug — attackers can upload, delete, or remove auth files, exposing protected dirs. Upgrade to 2.0.0-beta.4 ASAP. https://radar.offseq.com/threat/cve-2026-40189-cwe-862-missing-authorization-in-pa-3a1ae9b4 #OffSeq #CVE202640189 #GoLang #infosec

🚨 CVE-2026-40189: goshs <2.0.0-beta.4 has a CRITICAL auth bypass. Attackers can upload, delete, and remove folder auth to access protected files. Mitigate by upgrading now! https://radar.offseq.com/threat/cve-2026-40189-cwe-862-missing-authorization-in-pa-3a1ae9b4 #OffSeq #CVE202640189 #infosec #GoLang

🔴 CVE-2026-40175 - Critical (10)

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code E...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40175/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40175 - Critical (10)

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code E...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40175/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40093 - High (8.1)

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp >= parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MIN_PRODUCER_T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40093/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35641 - High (7.8)

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install executi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35641/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35641 - High (7.8)

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install executi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35641/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35643 - High (8.8)

OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35643/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35643 - High (8.8)

OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35643/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35643 - High (8.8)

OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35643/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35643 - High (8.8)

OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35643/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35666 - High (8.8)

OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass executable binding restrictions by using an unregistered time wrapper to reuse approval ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35666/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35666 - High (8.8)

OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass executable binding restrictions by using an unregistered time wrapper to reuse approval ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35666/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35595 - High (8.3)

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35595/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35595 - High (8.3)

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only requires CanWrite on the new parent project when changing parent_project_id. However, Vikunja's p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35595/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40163 - High (8.2)

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.j...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40163/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40163 - High (8.2)

Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to create arbitrary directories and write a changes.j...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40163/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40156 - High (7.8)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file named tools.py from the current working directory to discover and register custom agent tools. This loading process uses importlib.util.spec_from_file_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40156/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40156 - High (7.8)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file named tools.py from the current working directory to discover and register custom agent tools. This loading process uses importlib.util.spec_from_file_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40156/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40158 - High (8.6)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI's AST-based Python sandbox can be bypassed using type.__getattribute__ trampoline, allowing arbitrary code execution when running untrusted agent code. The _execute_code_direct f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40158/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40158 - High (8.6)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI's AST-based Python sandbox can be bypassed using type.__getattribute__ trampoline, allowing arbitrary code execution when running untrusted agent code. The _execute_code_direct f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40158/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40158 - High (8.6)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI's AST-based Python sandbox can be bypassed using type.__getattribute__ trampoline, allowing arbitrary code execution when running untrusted agent code. The _execute_code_direct f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40158/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40158 - High (8.6)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI's AST-based Python sandbox can be bypassed using type.__getattribute__ trampoline, allowing arbitrary code execution when running untrusted agent code. The _execute_code_direct f...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40158/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40150 - High (7.7)

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, the web_crawl() function in praisonaiagents/tools/web_crawl_tools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40150/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40116 - High (7.5)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in PraisonAI's call module accepts connections from any client without authentication or Twilio signature validation. Each connection opens an authenti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40116/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40113 - High (8.4)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delimited string for the gcloud run
deploy --set-env-vars argument by directly interpolating openai_model, openai_key, and openai_base without validatin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40113/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-34179 in Canonical LXD 4.12 – 6.7 enables privilege escalation from restricted TLS cert user to cluster admin (CVSS 9.1). No patch yet — restrict access & monitor API activity. https://radar.offseq.com/threat/cve-2026-34179-cwe-915-improperly-controlled-modif-752fa0b8 #OffSeq #LXD #PrivilegeEscalation #Vuln

🔴 CVE-2026-33707 - Critical (9.4)

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's em...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33707/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 CRITICAL vuln in Chamilo LMS (CVE-2026-33707): Weak password reset lets attackers hijack accounts using only the victim’s email. Affected: <1.11.38, 2.0.0-alpha.1 to <2.0.0-RC.3. Upgrade ASAP! https://radar.offseq.com/threat/cve-2026-33707-cwe-640-weak-password-recovery-mech-2af5871d #OffSeq #infosec #vuln #Chamilo

🔴 CVE-2026-33707 - Critical (9.4)

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, no expiration, and no rate limiting. An attacker who knows a user's em...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33707/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 CRITICAL vuln in Chamilo LMS (CVE-2026-33707): Weak password reset lets attackers hijack accounts using only the victim’s email. Affected: <1.11.38, 2.0.0-alpha.1 to <2.0.0-RC.3. Upgrade ASAP! https://radar.offseq.com/threat/cve-2026-33707-cwe-640-weak-password-recovery-mech-2af5871d #OffSeq #infosec #vuln #Chamilo

🟠 CVE-2026-40200 - High (8.1)

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40200/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SECURITY ADVISORY: musl libc up through 1.2.6 (present version) is affected by CVE-2026-40200 affecting qsort with large arrays.

Unless you have a setup with at least tens of terrabytes of virtual memory, this does not affect 64-bit systems, only 32-bit ones. But all users should patch.

https://www.openwall.com/lists/musl/2026/04/10/3

🟠 CVE-2026-40200 - High (8.1)

An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40200/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SECURITY ADVISORY: musl libc up through 1.2.6 (present version) is affected by CVE-2026-40200 affecting qsort with large arrays.

Unless you have a setup with at least tens of terrabytes of virtual memory, this does not affect 64-bit systems, only 32-bit ones. But all users should patch.

https://www.openwall.com/lists/musl/2026/04/10/3

🟠 CVE-2026-32931 - High (7.5)

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type hea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32931 - High (7.5)

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file upload vulnerability in the exercise sound upload function allows an authenticated teacher to upload a PHP webshell by spoofing the Content-Type hea...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31941 - High (7.7)

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery (SSRF) vulnerability in the Social Wall feature. The endpoint read_url_with_open_graph accepts a URL from the user via...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-31941 - High (7.7)

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a Server-Side Request Forgery (SSRF) vulnerability in the Social Wall feature. The endpoint read_url_with_open_graph accepts a URL from the user via...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35663 - High (8.8)

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. Attackers can bypass pairing requirements to reconnect as operator.admin, gaining unautho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35663/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35663 - High (8.8)

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. Attackers can bypass pairing requirements to reconnect as operator.admin, gaining unautho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35663/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35660 - High (8.1)

OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission to reset admin sessions. Attackers with operator.write privileges can invoke /r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35660/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35660 - High (8.1)

OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write permission to reset admin sessions. Attackers with operator.write privileges can invoke /r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35660/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35653 - High (8.1)

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35653/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35653 - High (8.1)

OpenClaw before 2026.3.24 contains an incorrect authorization vulnerability in the POST /reset-profile endpoint that allows authenticated callers with operator.write access to browser.request to bypass profile mutation restrictions. Attackers can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35653/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-40157 in PraisonAI (<4.5.128) enables path traversal via malicious .praison bundles — risk: file overwrite & code execution. Patch to 4.5.128+ & avoid untrusted archives. Full details: https://radar.offseq.com/threat/cve-2026-40157-cwe-22-improper-limitation-of-a-pat-3d24639a #OffSeq #PraisonAI #infosec #vuln

🚨 CRITICAL: CVE-2026-40157 in PraisonAI (<4.5.128) enables path traversal via malicious .praison bundles — risk: file overwrite & code execution. Patch to 4.5.128+ & avoid untrusted archives. Full details: https://radar.offseq.com/threat/cve-2026-40157-cwe-22-improper-limitation-of-a-pat-3d24639a #OffSeq #PraisonAI #infosec #vuln

🟠 CVE-2026-35669 - High (8.8)

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope boundary b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35669/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35669 - High (8.8)

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope boundary b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35669/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35668 - High (7.7)

OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit inc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35668 - High (7.7)

OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit inc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35668 - High (7.7)

OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit inc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35668 - High (7.7)

OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit inc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35650 - High (7.5)

OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or malformed overri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35650 - High (7.5)

OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or malformed overri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6067 - High (7.5)

A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the obj_directive() function. This vulnerability can be exploited by a user assembling a malicious .asm file, potentially leading to he...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6067/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6067 - High (7.5)

A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the obj_directive() function. This vulnerability can be exploited by a user assembling a malicious .asm file, potentially leading to he...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6067/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-58913 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CactusThemes VideoPro allows PHP Local File Inclusion.This issue affects VideoPro: from n/a through 2.3.8.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-58913/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-58913 - High (8.1)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CactusThemes VideoPro allows PHP Local File Inclusion.This issue affects VideoPro: from n/a through 2.3.8.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-58913/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40217 - High (8.8)

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40217/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40217 - High (8.8)

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40217/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33092 - High (7.8)

Local privilege escalation due to improper handling of environment variables. The following products are affected: Acronis True Image OEM (macOS) before build 42571, Acronis True Image (macOS) before build 42902.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33092 - High (7.8)

Local privilege escalation due to improper handling of environment variables. The following products are affected: Acronis True Image OEM (macOS) before build 42571, Acronis True Image (macOS) before build 42902.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40088 - Critical (9.6)

PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function and workflow shell execution are exposed to user-controlled input via agent workflows, YAML definitions, and LLM-generated tool calls, allowing attackers to in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40088/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-5804 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case Themes Case Theme User allows PHP Local File Inclusion.This issue affects Case Theme User: from n/a before 1.0.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-5804/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-5804 - High (7.5)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case Themes Case Theme User allows PHP Local File Inclusion.This issue affects Case Theme User: from n/a before 1.0.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-5804/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5412 - Critical (9.9)

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5412/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5412 - Critical (9.9)

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated user can call the CloudSpec API method to extract the cloud credentials used to bootstrap the controller. This allows a low-privi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5412/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-1115: CRITICAL stored XSS in parisneo/lollms <2.2.0. Unsanitized input in create_post lets attackers run JS in user browsers via Home Feed. Upgrade to 2.2.0+ now! https://radar.offseq.com/threat/cve-2026-1115-cwe-79-improper-neutralization-of-in-d36d67ac #OffSeq #XSS #Vuln #Security

⚠️ CVE-2026-6029 (CRITICAL, CVSS 9.3): Totolink A7100RU firmware 7.4cu.2313_b20191024 is vulnerable to unauthenticated OS command injection via setVpnAccountCfg. No patch yet — restrict access and monitor for updates. https://radar.offseq.com/threat/cve-2026-6029-os-command-injection-in-totolink-a71-25809d7e #OffSeq #CVE20266029 #Infosec

🔴 CVE-2026-6025 - Critical (9.8)

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6025/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6016 - High (8.8)

A vulnerability was found in Tenda AC9 15.03.02.13. The affected element is the function decodePwd of the file /goform/WizardHandle of the component POST Request Handler. Performing a manipulation of the argument WANS results in stack-based buffer...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6016/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6014 - High (8.8)

A flaw has been found in D-Link DIR-513 1.10. This issue affects the function formAdvanceSetup of the file /goform/formAdvanceSetup of the component POST Request Handler. This manipulation of the argument webpage causes buffer overflow. It is poss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6014/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6013 - High (8.8)

A vulnerability was detected in D-Link DIR-513 1.10. This vulnerability affects the function formSetRoute of the file /goform/formSetRoute of the component POST Request Handler. The manipulation of the argument curTime results in buffer overflow. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6013/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6015 - High (8.8)

A vulnerability has been found in Tenda AC9 15.03.02.13. Impacted is the function formQuickIndex of the file /goform/QuickIndex of the component POST Request Handler. Such manipulation of the argument PPPOEPassword leads to stack-based buffer over...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6015/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6012 - High (8.8)

A security vulnerability has been detected in D-Link DIR-513 1.10. This affects the function formSetPassword of the file /goform/formSetPassword of the component POST Request Handler. The manipulation of the argument curTime leads to buffer overfl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6012/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-5994: CRITICAL OS command injection in Totolink A7100RU (7.4cu.2313_b20191024). Remote attackers can run OS commands via setTelnetCfg. No patch yet; public exploit released. Restrict access & monitor traffic. https://radar.offseq.com/threat/cve-2026-5994-os-command-injection-in-totolink-a71-2d1c7675 #OffSeq #Vuln #RouterSecurity

🔴 CVE-2026-5994 - Critical (9.8)

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This issue affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument telnet_enabled resu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5994/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-5996 in Totolink A7100RU (7.4cu.2313_b20191024) enables unauthenticated OS command injection via /cgi-bin/cstecgi.cgi. No patch yet — restrict remote access & monitor devices. More: https://radar.offseq.com/threat/cve-2026-5996-os-command-injection-in-totolink-a71-7853c72c #OffSeq #Vulnerability #IoTSecurity

🔴 CVE-2026-5996 - Critical (9.8)

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument tty_serve...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5996/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5993 - Critical (9.8)

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wifiOff leads to os c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5993/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-25203 - High (7.8)

Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability

This issue affects MagicINFO 9 Server: less than 21.1091.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25203/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4351 - High (8.1)

The Perfmatters plugin for WordPress is vulnerable to arbitrary file overwrite via path traversal in all versions up to, and including, 2.5.9. This is due to the `PMCS::action_handler()` method processing the bulk action `activate`/`deactivate` ha...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4351/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3360 - High (7.5)

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3360/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5997 - Critical (9.8)

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass results in os c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5997/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Totolink A7100RU (7.4cu.2313_b20191024) hit by CRITICAL OS command injection (CVE-2026-5997) — remote, unauthenticated code execution possible. No patch yet. Disable remote management & limit access! https://radar.offseq.com/threat/cve-2026-5997-os-command-injection-in-totolink-a71-76c83173 #OffSeq #CVE20265997 #RouterSecurity #Vuln

CVE-2026-33170 is fascinating because it breaks Rails' own XSS protection system. SafeBuffer#% operator fails to propagate the html_unsafe flag when creating new buffers, so content that should be escaped gets marked as safe.

It's a flaw in the security mechanism itself, not just another injection point. Rails apps using SafeBuffer with the % operator for formatting could be exposing XSS vulnerabilities without realising their protection layer is compromised.

CVE-2026-33170 is fascinating because it breaks Rails' own XSS protection system. SafeBuffer#% operator fails to propagate the html_unsafe flag when creating new buffers, so content that should be escaped gets marked as safe.

It's a flaw in the security mechanism itself, not just another injection point. Rails apps using SafeBuffer with the % operator for formatting could be exposing XSS vulnerabilities without realising their protection layer is compromised.

🔴 CVE-2026-5995 - Critical (9.8)

A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Impacted is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument lan_info can lead to os...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5995/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛑 CRITICAL: CVE-2026-5995 in Totolink A7100RU (7.4cu.2313_b20191024) enables remote, unauthenticated OS command injection via /cgi-bin/cstecgi.cgi. No patch yet — disable remote mgmt & restrict access. https://radar.offseq.com/threat/cve-2026-5995-os-command-injection-in-totolink-a71-27cc3191 #OffSeq #Infosec #Vulnerability

🟠 CVE-2026-35638 - High (8.8)

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the Control UI that allows unauthenticated sessions to retain self-declared privileged scopes without device identity verification. Attackers can exploit the device-less al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35638/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5983 - High (8.8)

A vulnerability was determined in D-Link DIR-605L 2.13B01. This issue affects the function formSetDDNS of the file /goform/formSetDDNS of the component POST Request Handler. Executing a manipulation of the argument curTime can lead to buffer overf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5983/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5982 - High (8.8)

A vulnerability was found in D-Link DIR-605L 2.13B01. This vulnerability affects the function formAdvNetwork of the file /goform/formAdvNetwork of the component POST Request Handler. Performing a manipulation of the argument curTime results in buf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5982/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5981 - High (8.8)

A vulnerability has been found in D-Link DIR-605L 2.13B01. This affects the function formAdvFirewall of the file /goform/formAdvFirewall of the component POST Request Handler. Such manipulation of the argument curTime leads to buffer overflow. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5981/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5988 - High (8.8)

A vulnerability was detected in Tenda F451 1.0.0.7. This impacts the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Performing a manipulation of the argument mit_ssid results in stack-based buffer overflow. The attack can be initiat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5992 - High (8.8)

A vulnerability was determined in Tenda F451 1.0.0.7. This affects the function fromP2pListFilter of the file /goform/P2pListFilter. This manipulation of the argument page causes stack-based buffer overflow. Remote exploitation of the attack is po...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5992/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5991 - High (8.8)

A vulnerability was found in Tenda F451 1.0.0.7. Affected by this issue is the function formWrlExtraSet of the file /goform/WrlExtraSet. The manipulation of the argument GO results in stack-based buffer overflow. The attack may be launched remotel...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5991/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5989 - High (8.8)

A flaw has been found in Tenda F451 1.0.0.7. Affected is the function fromRouteStatic of the file /goform/RouteStatic. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be launched remotely. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33778 - High (7.5)

An Improper Validation of Syntactic Correctness of Input vulnerability in the IPsec library used by kmd and iked of Juniper Networks Junos OS on SRX Series and MX Series allows an unauthenticated, network-based attacker to cause a complete Denial...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33785 - High (8.8)

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute specific commands which will lead to a complete compromise of managed devices.

Any user l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33785/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33790 - High (7.5)

An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an attacker sending a specific, malformed ICMPv6 packet to cause the srxpfe process to crash and res...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33790/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33793 - High (7.8)

An Execution with Unnecessary Privileges vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to gain root privileges, thus compromising the system.

When a configurat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35625 - High (7.8)

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability where silent local shared-auth reconnects auto-approve scope-upgrade requests, widening paired device permissions from operator.read to operator.admin. Attackers can exploit t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35625/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35645 - High (8.1)

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime scope. Attackers can exploit this by triggering session deletion wi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33788 - High (7.8)

A Missing Authentication for Critical Function vulnerability in the Flexible PIC Concentrators (FPCs) of Juniper Networks Junos OS Evolved on PTX Series allows a local, authenticated attacker with low privileges to gain direct access to FPCs insta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33788/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5990 - High (8.8)

A vulnerability has been found in Tenda F451 1.0.0.7. Affected by this vulnerability is the function fromSafeEmailFilter of the file /goform/SafeEmailFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5990/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-34424 - Critical (9.8)

Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated attackers to execute arbitrary code and commands. Attackers can trig...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34424/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-34424 (CRITICAL): Smart Slider 3 Pro 3.5.1.35 for WordPress/Joomla has embedded malicious code via a compromised update system. Unauth RCE, backdoors, hidden admins, data exfil possible. Remove plugin & monitor. No fix yet. https://radar.offseq.com/threat/cve-2026-34424-cwe-506-embedded-malicious-code-in--565778ad #OffSeq #WordPress #Infosec

🟠 CVE-2026-5984 - High (8.8)

A vulnerability was identified in D-Link DIR-605L 2.13B01. Impacted is the function formSetLog of the file /goform/formSetLog of the component POST Request Handler. The manipulation of the argument curTime leads to buffer overflow. The attack is p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5984/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 New security advisory:

CVE-2026-40154 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-40154-praisonai-remote-code-execution

#Cybersecurity #SecurityPatching #HackerNews

🔴 CVE-2026-40154 - Critical (9.3)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI treats remotely fetched template files as trusted executable code without integrity verification, origin validation, or user confirmation, enabling supply chain attacks through m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40154/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40149 - High (7.9)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, the gateway's /api/approval/allow-list endpoint permits unauthenticated modification of the tool approval allowlist when no auth_token is configured (the default). By adding dangerous tool...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35639 - High (8.8)

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability in the device.pair.approve method that allows an operator.pairing approver to approve pending device requests with broader operator scopes than the approver actually holds. At...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35639/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34512 - High (8.1)

OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions/:sessionKey/kill route that allows any bearer-authenticated user to invoke admin-level session termination functions without proper scope validation....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34512/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33784 - Critical (9.8)

A Use of Default Password vulnerability in the Juniper Networks

Support Insights (JSI)

Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control of the device.

vLWC software images ship with a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33784/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13914 - High (8.7)

A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM

attacker to impersonate managed devices.

Due to insufficient SSH host key validation an attacker can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13914/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5978 - Critical (9.8)

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument mode leads to os command ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5978/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5977 - Critical (9.8)

A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wifiOff can lead to os comma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5977/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5980 - High (8.8)

A flaw has been found in D-Link DIR-605L 2.13B01. Affected by this issue is the function formSetMACFilter of the file /goform/formSetMACFilter of the component POST Request Handler. This manipulation of the argument curTime causes buffer overflow....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5975 - Critical (9.8)

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wanIdx leads to os command inj...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5975/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5979 - High (8.8)

A vulnerability was detected in D-Link DIR-605L 2.13B01. Affected by this vulnerability is the function formVirtualServ of the file /goform/formVirtualServ of the component POST Request Handler. The manipulation of the argument curTime results in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5979/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5976 - Critical (9.8)

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setStorageCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sambaEnabled results in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5976/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Marimo Python Notebook RCE Exploited Hours After Disclosure

Marimo patched a critical RCE vulnerability (CVE-2026-39987) that was exploited within 10 hours of disclosure to steal cloud credentials and SSH keys. The flaw allows unauthenticated attackers to gain full interactive shell access via a WebSocket authentication bypass.

**If you're running Marimo notebooks, update to version 0.23.0 immediately and rotate any credentials (AWS keys, SSH keys, database passwords, API secrets) that were stored on or accessible from that system. If you can't update right away, block access to the /terminal/ws endpoint or put the notebook behind a reverse proxy with authentication and never expose notebook platforms directly to the internet.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/marimo-python-notebook-rce-exploited-hours-after-disclosure-5-z-x-w-k/gD2P6Ple2L

Marimo Python Notebook RCE Exploited Hours After Disclosure

Marimo patched a critical RCE vulnerability (CVE-2026-39987) that was exploited within 10 hours of disclosure to steal cloud credentials and SSH keys. The flaw allows unauthenticated attackers to gain full interactive shell access via a WebSocket authentication bypass.

**If you're running Marimo notebooks, update to version 0.23.0 immediately and rotate any credentials (AWS keys, SSH keys, database passwords, API secrets) that were stored on or accessible from that system. If you can't update right away, block access to the /terminal/ws endpoint or put the notebook behind a reverse proxy with authentication and never expose notebook platforms directly to the internet.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/marimo-python-notebook-rce-exploited-hours-after-disclosure-5-z-x-w-k/gD2P6Ple2L

🟠 CVE-2026-39885 - High (7.5)

FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39885/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39891 - High (8.8)

PraisonAI is a multi-agent teams system. Prior to 4.5.115, the create_agent_centric_tools() function returns tools (like acp_create_file) that process file content using template rendering. When user input from agent.start() is passed directly int...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39891 - High (8.8)

PraisonAI is a multi-agent teams system. Prior to 4.5.115, the create_agent_centric_tools() function returns tools (like acp_create_file) that process file content using template rendering. When user input from agent.start() is passed directly int...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-39890 - Critical (9.8)

PraisonAI is a multi-agent teams system. Prior to 4.5.115, the AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags (such as !!js/function and !!js/undefined). This allows an attacker ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39890/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39889 - High (7.5)

PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authentication. The create_a2u_routes() function registers the following endpoints with NO authe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39889/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39889 - High (7.5)

PraisonAI is a multi-agent teams system. Prior to 4.5.115, the A2U (Agent-to-User) event stream server in PraisonAI exposes all agent activity without authentication. The create_a2u_routes() function registers the following endpoints with NO authe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39889/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39429 - High (8.2)

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no authentication or authorization in place...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39429/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2024-008
Wago: Vulnerability in WBM through Open VPN

A security vulnerability has been identified in the Web-Based Management (WBM) function when OpenVPN is enabled.
#CVE CVE-2024-1490

https://certvde.com/en/advisories/vde-2024-008/
#oCSAF
#CSAF https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2024-008.json

🔴 CVE-2026-5852 - Critical (9.8)

A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. Affected is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument igmpVer causes os command injection. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5852/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5854 - Critical (9.8)

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument merge results in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5854/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5853 - Critical (9.8)

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument addr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5853/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛑 CRITICAL: CVE-2026-5850 in Totolink A7100RU (fw 7.4cu.2313_b20191024) enables unauthenticated OS command injection via pptpPassThru. No patch yet — restrict access & monitor advisories. https://radar.offseq.com/threat/cve-2026-5850-os-command-injection-in-totolink-a71-c437d074 #OffSeq #CVE20265850 #RouterSecurity #Infosec

🔴 CVE-2026-5850 - Critical (9.8)

A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument pptpPassThru leads to os command injec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5850/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 CVE-2026-5851: CRITICAL OS command injection in Totolink A7100RU (7.4cu.2313_b20191024). Remote, unauthenticated RCE possible via /cgi-bin/cstecgi.cgi. Exploit public, no patch. Isolate device and check for updates! https://radar.offseq.com/threat/cve-2026-5851-os-command-injection-in-totolink-a71-cec71662 #OffSeq #CVE20265851 #IoTSec

🔴 CVE-2026-5851 - Critical (9.8)

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injecti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5851/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-1830 - Critical (9.8)

The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-1830/