🚩 CRITICAL CVE-2026-40313: PraisonAI ≤ 4.5.139 exposes GITHUB_TOKEN in workflow artifacts. Attackers can push malicious code & steal secrets. Upgrade to 4.5.140+ & set persist-credentials: false. https://radar.offseq.com/threat/cve-2026-40313-cwe-829-inclusion-of-functionality--2d33a73b #OffSeq #SupplyChain #CVE202640313

🔴 CVE-2026-40313 - Critical (9.1)

PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40313/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚩 CRITICAL CVE-2026-40313: PraisonAI ≤ 4.5.139 exposes GITHUB_TOKEN in workflow artifacts. Attackers can push malicious code & steal secrets. Upgrade to 4.5.140+ & set persist-credentials: false. https://radar.offseq.com/threat/cve-2026-40313-cwe-829-inclusion-of-functionality--2d33a73b #OffSeq #SupplyChain #CVE202640313

🔴 CVE-2026-40313 - Critical (9.1)

PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40313/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-40289: PraisonAI <4.5.139 & praisonaiagents <1.5.140 have a critical missing auth vuln on /ws. Remote attackers can hijack browser automation sessions. Patch ASAP or restrict access! https://radar.offseq.com/threat/cve-2026-40289-cwe-306-missing-authentication-for--874e515b #OffSeq #Infosec #Vulnerability #PraisonAI

🔴 CVE-2026-40289 - Critical (9.1)

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the browser bridge (praisonai browser start) is vulnerable to unauthenticated remote session hijacking due to missing authentication an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-40289: PraisonAI <4.5.139 & praisonaiagents <1.5.140 have a critical missing auth vuln on /ws. Remote attackers can hijack browser automation sessions. Patch ASAP or restrict access! https://radar.offseq.com/threat/cve-2026-40289-cwe-306-missing-authentication-for--874e515b #OffSeq #Infosec #Vulnerability #PraisonAI

🔴 CVE-2026-40289 - Critical (9.1)

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the browser bridge (praisonai browser start) is vulnerable to unauthenticated remote session hijacking due to missing authentication an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-40288 (CRITICAL, CVSS 9.8): PraisonAI <4.5.139 vulnerable to OS command injection via untrusted YAML files. Attackers can achieve full system compromise. Upgrade ASAP! More: https://radar.offseq.com/threat/cve-2026-40288-cwe-78-improper-neutralization-of-s-06bb92e7 #OffSeq #PraisonAI #InfoSec

🔴 CVE-2026-40288 - Critical (9.8)

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the workflow engine is vulnerable to arbitrary command and code execution through untrusted YAML files. When praisonai workflow run lo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-40288 (CRITICAL, CVSS 9.8): PraisonAI <4.5.139 vulnerable to OS command injection via untrusted YAML files. Attackers can achieve full system compromise. Upgrade ASAP! More: https://radar.offseq.com/threat/cve-2026-40288-cwe-78-improper-neutralization-of-s-06bb92e7 #OffSeq #PraisonAI #InfoSec

🔴 CVE-2026-40288 - Critical (9.8)

PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of praisonaiagents, the workflow engine is vulnerable to arbitrary command and code execution through untrusted YAML files. When praisonai workflow run lo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40287 - High (8.4)

PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py (import_tools_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40287 - High (8.4)

PraisonAI is a multi-agent teams system. Versions 4.5.138 and below are vulnerable to arbitrary code execution through automatic, unsanitized import of a tools.py file from the current working directory. Components including call.py (import_tools_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6264 - Critical (9.8)

A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6264/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-6264 affects Talend JobServer 8.0 & 7.3. Unauthenticated RCE via JMX port — patch immediately or require TLS client auth for mitigation. Disable JMX in Runtime if possible. Details: https://radar.offseq.com/threat/cve-2026-6264-cwe-306-missing-authentication-for-c-26a424cb #OffSeq #Talend #Vuln #RCE #Infosec

🔴 CVE-2026-6264 - Critical (9.8)

A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector is the JMX monitoring port of the Talend JobServer. The vulnerability can be mitigated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6264/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-6264 affects Talend JobServer 8.0 & 7.3. Unauthenticated RCE via JMX port — patch immediately or require TLS client auth for mitigation. Disable JMX in Runtime if possible. Details: https://radar.offseq.com/threat/cve-2026-6264-cwe-306-missing-authentication-for-c-26a424cb #OffSeq #Talend #Vuln #RCE #Infosec

🔴 CVE-2026-4365 - Critical (9.1)

The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the `delete_question_answer()` function in all versions up to, and including, 4.3.2.8. The plugin exposes a `wp_rest` nonce in pub...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4365/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4365 - Critical (9.1)

The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the `delete_question_answer()` function in all versions up to, and including, 4.3.2.8. The plugin exposes a `wp_rest` nonce in pub...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4365/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4352 - High (7.5)

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is due to the `_cct_search` parameter being interpolated directly into...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4352 - High (7.5)

The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and including, 3.8.6.1. This is due to the `_cct_search` parameter being interpolated directly into...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22564 - Critical (9.8)

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the system.


Affected Products:
UniFi Play PowerAmp (Version 1.0.35 and earlier)

UniF...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22564/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22564 - Critical (9.8)

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to enable SSH to make unauthorized changes to the system.


Affected Products:
UniFi Play PowerAmp (Version 1.0.35 and earlier)

UniF...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22564/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22566 - High (7.5)

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials.


Affected Products:
UniFi Play PowerAmp (Version 1.0.35 and earlier)

UniFi Play Audio Port ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22566/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22566 - High (7.5)

An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials.


Affected Products:
UniFi Play PowerAmp (Version 1.0.35 and earlier)

UniFi Play Audio Port ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22566/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40164 - High (7.5)

jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precomput...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40164/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40164 - High (7.5)

jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precomput...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40164/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-27681 - Critical (9.9)

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27681/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27681 in SAP BPC & BW (CVSS 9.9). Authenticated users can inject SQL, risking data integrity & availability. No patch yet — restrict access & monitor DB activity. https://radar.offseq.com/threat/cve-2026-27681-cwe-89-improper-neutralization-of-s-a7704991 #OffSeq #SAP #Vuln #SQLi

🔴 CVE-2026-27681 - Critical (9.9)

Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27681/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-27681 in SAP BPC & BW (CVSS 9.9). Authenticated users can inject SQL, risking data integrity & availability. No patch yet — restrict access & monitor DB activity. https://radar.offseq.com/threat/cve-2026-27681-cwe-89-improper-neutralization-of-s-a7704991 #OffSeq #SAP #Vuln #SQLi

🟠 CVE-2026-33901 - High (7.5)

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when process...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33901/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33901 - High (7.5)

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, a heap buffer overflow occurs in the MVG decoder that could result in an out of bounds write when process...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33901/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33908 - High (7.5)

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is exe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33908/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33908 - High (7.5)

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is exe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33908/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-22563: Ubiquiti UniFi Play PowerAmp (≤1.0.35) & Audio Port (≤1.0.24) have a critical command injection flaw (CVSS 9.8). Network access = full compromise. Update to 1.0.38+/1.1.9+ ASAP! 🛡️ https://radar.offseq.com/threat/cve-2026-22563-cwe-20-improper-input-validation-in-4175b900 #OffSeq #CVE202622563 #infosec #patch

🔴 CVE-2026-22563 - Critical (9.8)

A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play network.

Affected Products:
UniFi Play PowerAmp (Version 1.0.35 and earlier)

UniFi Play Audio Port  (Ver...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22563/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-22563: Ubiquiti UniFi Play PowerAmp (≤1.0.35) & Audio Port (≤1.0.24) have a critical command injection flaw (CVSS 9.8). Network access = full compromise. Update to 1.0.38+/1.1.9+ ASAP! 🛡️ https://radar.offseq.com/threat/cve-2026-22563-cwe-20-improper-input-validation-in-4175b900 #OffSeq #CVE202622563 #infosec #patch

🔴 CVE-2026-22563 - Critical (9.8)

A series of Improper Input Validation vulnerabilities could allow a Command Injection by a malicious actor with access to the UniFi Play network.

Affected Products:
UniFi Play PowerAmp (Version 1.0.35 and earlier)

UniFi Play Audio Port  (Ver...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22563/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22562 - Critical (9.8)

A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device firmware to write files on the system that could be used for a remote code execution (RCE).

Affected Products:
UniFi Play Po...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22562 - Critical (9.8)

A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device firmware to write files on the system that could be used for a remote code execution (RCE).

Affected Products:
UniFi Play Po...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22562/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30999 - High (7.5)

A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30999 - High (7.5)

A heap buffer overflow in the av_bprint_finalize() function of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30997 - High (7.5)

An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30997/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30997 - High (7.5)

An out-of-bounds read in the read_global_param() function (libavcodec/av1dec.c) of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30997/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-66769 - High (7.5)

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service (DoS) via a crafted XFA packet.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-66769 - High (7.5)

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service (DoS) via a crafted XFA packet.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40044 - Critical (9.8)

Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40044 - Critical (9.8)

Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting malicious serialized objects into cache files. Attackers can write PHP object payloads to world-writable cache files...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6198 - High (8.8)

A vulnerability has been found in Tenda F456 1.0.0.5. This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6198/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6198 - High (8.8)

A vulnerability has been found in Tenda F456 1.0.0.5. This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6198/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6197 - High (8.8)

A flaw has been found in Tenda F456 1.0.0.5. This vulnerability affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Executing a manipulation of the argument mit_ssid can lead to stack-based buffer overflow. The attack may be ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6197/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6197 - High (8.8)

A flaw has been found in Tenda F456 1.0.0.5. This vulnerability affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Executing a manipulation of the argument mit_ssid can lead to stack-based buffer overflow. The attack may be ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6197/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The vulnerability, assigned the CVE identifier CVE-2026-34621, carries a CVSS score of 8.6 out of 10.0. Successful exploitation of the flaw could allow an attacker to run malicious code on affected installations.

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 thehackernews.com/2026/04/adob...

Adobe Patches Actively Exploit...

The U.S. initiated a naval blockade on all Iranian ports today, following failed peace talks, escalating tensions and causing oil prices to surge. The UK stated it would not support this action. In cybersecurity, Adobe released emergency patches for a critical, actively exploited zero-day in Acrobat and Reader (CVE-2026-34621). Additionally, a critical vulnerability in the Marimo open-source Python notebook platform (CVE-2026-39987) is now under active exploitation, allowing remote code execution. A U.S. DOT report also revealed significant cybersecurity gaps in 45 critical FAA air traffic systems.

#AnonNews_irc #Cybersecurity #News

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CVE-2012-1854 Visual Basic for Applications Insecure Library Loading

CVE-2020-9715 Adobe Acrobat Use-After-Free

CVE-2023-21529 Microsoft Exchange Deserialization of Untrusted

CVE-2023-36424 Microsoft Windows Out-of-Bounds Read

CVE-2025-60710 Microsoft Windows Link Following

CVE-2026-21643 Fortinet SQL Injection

CVE-2026-34621 Adobe Acrobat Reader Prototype

https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog

#cybersecurity #cisa #adobe #microsoft

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2026-34621
Vendor: Adobe
Product: Acrobat and Reader
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34621

Adobe Emergency Patch Fixes Actively Exploited Acrobat Zero-Day (CVE-2026-34621)

Introduction Adobe has released an urgent security update addressing a high-risk vulnerability in Acrobat Reader and Acrobat products that has already been exploited in real-world attacks. The flaw, tracked as CVE-2026-34621, is particularly dangerous because it enables attackers to bypass sandbox protections and execute malicious code simply by convincing a user to open a crafted PDF…

https://undercodenews.com/adobe-emergency-patch-fixes-actively-exploited-acrobat-zero-day-cve-2026-34621/

Adobe rolls out emergency fix for Acrobat, Reader zero-day flaw

Adobe has released an emergency security update for Acrobat Reader to fix a vulnerability, tracked as CVE-2026-34621, that has been exploited in...

🔗️ [Bleepingcomputer] https://link.is.it/1HWevZ

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 thehackernews.com/2026/04/adob...

Adobe Patches Actively Exploit...

The U.S. initiated a naval blockade on all Iranian ports today, following failed peace talks, escalating tensions and causing oil prices to surge. The UK stated it would not support this action. In cybersecurity, Adobe released emergency patches for a critical, actively exploited zero-day in Acrobat and Reader (CVE-2026-34621). Additionally, a critical vulnerability in the Marimo open-source Python notebook platform (CVE-2026-39987) is now under active exploitation, allowing remote code execution. A U.S. DOT report also revealed significant cybersecurity gaps in 45 critical FAA air traffic systems.

#AnonNews_irc #Cybersecurity #News

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2026-34621
Vendor: Adobe
Product: Acrobat and Reader
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34621

Adobe rolls out emergency fix for Acrobat, Reader zero-day flaw

Adobe has released an emergency security update for Acrobat Reader to fix a vulnerability, tracked as CVE-2026-34621, that has been exploited in...

🔗️ [Bleepingcomputer] https://link.is.it/1HWevZ

Recent global developments include a major cybersecurity breach, ongoing geopolitical tensions, and critical advancements in AI. A hacker leveraged AI platforms (Claude Code, GPT-4.1) to compromise nine Mexican government agencies, exfiltrating millions of records (Apr 12). Rockstar Games faces a ransom threat from ShinyHunters following a supply-chain cyberattack (Apr 12). Adobe also issued an emergency patch for a critical Acrobat Reader zero-day (CVE-2026-34621) actively exploited since December (Apr 12). Geopolitically, US-Iran talks in Pakistan to end their six-week conflict concluded without agreement, impacting oil markets and the Strait of Hormuz (Apr 12-13). In technology, Anthropic has withheld its new AI model, "Claude Mythos Preview," due to its advanced capability in discovering software vulnerabilities, deeming it too risky for public release (Apr 12).

#Cybersecurity #TechNews #Geopolitics

Le patch est désormais dispo:

"*Adobe has released a security update for Adobe Acrobat and Reader for Windows and macOS. This update addresses a critical vulnerability. Successful exploitation could lead to arbitrary code execution.

 Adobe is aware of CVE-2026-34621 being exploited in the wild.*"
👇
https://helpx.adobe.com/security/products/acrobat/apsb26-43.html

#CyberVeille #CVE_2026_34621

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621

Adobe has issued emergency security updates addressing a severe Acrobat Reader flaw tracked as CVE-2026-34621, a high-impact Adobe vulnerability...

🔗️ [Thecyberexpress] https://link.is.it/pTL1zP

Geopolitical: US-Iran peace talks failed, raising Strait of Hormuz blockade threat and soaring oil prices (April 12-13).

Tech: Japan allocates $4B for Rapidus to accelerate 2nm AI chip production by 2027 (April 12). Harvard unveils "Cascade" AI for faster quantum error correction (April 12).

Cybersecurity: Adobe issued emergency patch for actively exploited Acrobat zero-day (CVE-2026-34621) (April 12). Iran-linked groups persist in targeting US industrial control systems (April 11-12).

#AnonNews_irc #Cybersecurity #Anonymous #News

Adobe Issues Emergency Patch for Actively Exploited Acrobat Reader Zero-Day

Adobe released emergency patches for CVE-2026-34621, a critical prototype pollution vulnerability in Acrobat and Reader that is being actively exploited to run arbitrary code via malicious PDF files.

**Update your Adobe Acrobat and Reader immediately because attackers are already using this flaw to take over computers through simple PDF files. If you cannot patch right away, use a browser-based PDF viewer as a temporary safety measure and disable Javascript in your Adobe Acrobat and Reader.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/adobe-issues-emergency-patch-for-actively-exploited-acrobat-reader-zero-day-r-s-c-8-v/gD2P6Ple2L

🔴 CVE-2026-34621 - Critical (9.6)

Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could result in arbitrary code execution in the context ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34621/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-34621 in Adobe Acrobat Reader (≤26.001.21367) enables arbitrary code execution via prototype pollution if a user opens a malicious file. No patch yet — exercise caution! https://radar.offseq.com/threat/cve-2026-34621-improperly-controlled-modification--1b9951d5 #OffSeq #Adobe #Security

🚨 CRITICAL: CVE-2026-34621 in Adobe Acrobat Reader (≤26.001.21367) enables prototype pollution & arbitrary code execution via malicious files. No patch yet — avoid opening untrusted PDFs. Monitor advisories. https://radar.offseq.com/threat/cve-2026-34621-improperly-controlled-modification--1b9951d5 #OffSeq #Adobe #Vuln #Infosec

🟠 CVE-2026-35650 - High (7.5)

OpenClaw before 2026.3.22 contains an environment variable override handling vulnerability that allows attackers to bypass the shared host environment policy through inconsistent sanitization paths. Attackers can supply blocked or malformed overri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35668 - High (7.7)

OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit inc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35668 - High (7.7)

OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit inc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35668/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35663 - High (8.8)

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability allowing non-admin operators to self-request broader scopes during backend reconnect. Attackers can bypass pairing requirements to reconnect as operator.admin, gaining unautho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35663/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30998 - High (7.5)

An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30998/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30998 - High (7.5)

An improper resource deallocation and closure vulnerability in the tools/zmqsend.c component of FFmpeg v8.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input file.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30998/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69624 - High (7.5)

Nitro PDF Pro for Windows 14.41.1.4 contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert(). When app.alert() is called with more than one argument and the first argument evaluates to null (for example, ap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-69624 - High (7.5)

Nitro PDF Pro for Windows 14.41.1.4 contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert(). When app.alert() is called with more than one argument and the first argument evaluates to null (for example, ap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35641 - High (7.8)

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install executi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35641/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-04-06 - 2026-04-13)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1590

Severity:
- Critical: 126
- High: 530
- Medium: 671
- Low: 50
- None: 213

Status:
- : 7
- Analyzed: 175
- Awaiting Analysis: 513
- Modified: 12
- Received: 645
- Rejected: 14
- Undergoing Analysis: 224

Top CNAs:
- GitHub, Inc.: 462
- VulDB: 202
- Patchstack: 175
- MITRE: 115
- Wordfence: 95
- VulnCheck: 92
- Chrome: 60
- Apache Software Foundation: 31
- Juniper Networks, Inc.: 27
- wolfSSL Inc.: 22

Top Affected Products:
- UNKNOWN: 1354
- Dlink Di-8003 Firmware: 27
- Openclaw: 27
- Churchcrm: 24
- Qualcomm Fastconnect 7800 Firmware: 16
- Qualcomm Wsa8840 Firmware: 16
- Qualcomm Wcd9385 Firmware: 16
- Qualcomm Fastconnect 6900 Firmware: 16
- Qualcomm Wsa8845h Firmware: 16
- Qualcomm Wcd9380 Firmware: 16

Top EPSS Score:
- CVE-2026-34197 - 5.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34197)
- CVE-2026-34885 - 5.14 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34885)
- CVE-2026-39365 - 3.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-39365)
- CVE-2026-5677 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5677)
- CVE-2026-5678 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5678)
- CVE-2026-5688 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5688)
- CVE-2026-5689 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5689)
- CVE-2026-5690 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5690)
- CVE-2026-5691 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5691)
- CVE-2026-5692 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-5692)

🟠 CVE-2026-6200 - High (8.8)

A vulnerability was determined in Tenda F456 1.0.0.5. The affected element is the function formwebtypelibrary of the file /goform/webtypelibrary. This manipulation of the argument menufacturer/Go causes stack-based buffer overflow. The attack can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6200/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6200 - High (8.8)

A vulnerability was determined in Tenda F456 1.0.0.5. The affected element is the function formwebtypelibrary of the file /goform/webtypelibrary. This manipulation of the argument menufacturer/Go causes stack-based buffer overflow. The attack can ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6200/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6199 - High (8.8)

A vulnerability was found in Tenda F456 1.0.0.5. Impacted is the function fromqossetting of the file /goform/qossetting. The manipulation of the argument page results in stack-based buffer overflow. It is possible to launch the attack remotely. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6199/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6199 - High (8.8)

A vulnerability was found in Tenda F456 1.0.0.5. Impacted is the function fromqossetting of the file /goform/qossetting. The manipulation of the argument page results in stack-based buffer overflow. It is possible to launch the attack remotely. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6199/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40042 - Critical (9.8)

Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML parsing in the TextParser helper. Attackers can inject malicious XML entities through wiki ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40042 - Critical (9.8)

Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML parsing in the TextParser helper. Attackers can inject malicious XML entities through wiki ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40040 - High (8.8)

Pachno 1.0.6 contains an unrestricted file upload vulnerability that allows authenticated users to upload arbitrary file types by bypassing ineffective extension filtering to the /uploadfile endpoint. Attackers can upload executable files .php5 sc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40040/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40040 - High (8.8)

Pachno 1.0.6 contains an unrestricted file upload vulnerability that allows authenticated users to upload arbitrary file types by bypassing ineffective extension filtering to the /uploadfile endpoint. Attackers can upload executable files .php5 sc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40040/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CISA Reports Active Exploitation of Four Microsoft Vulnerabilities, Including a 14-Year-Old Flaw

CISA flagged four actively exploited Microsoft vulnerabilities, spanning from 2012 to 2025 covering privilege escalation, remote code execution in Exchange Server, and insecure library loading, with at least one (CVE-2023-21529) tied to Storm-1175's Medusa ransomware campaigns. US Federal agencies must patch all four by April 27, 2026.

**Most of these flaws are old. So if you haven't patched your systems for over a year - let alone 14 years, it's high time to do it today. Because hackers don't care how old a vulnerability is. It's still usable. If you're still running Exchange Server 2013, 2016, or 2019 on-premises, prioritize patching or migrating those immediately.**
#cybersecurity #infosec #advisory #ransomware
https://beyondmachines.net/event_details/cisa-reports-active-exploitation-of-four-microsoft-vulnerabilities-including-a-14-year-old-flaw-f-v-f-p-4/gD2P6Ple2L

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CVE-2012-1854 Visual Basic for Applications Insecure Library Loading

CVE-2020-9715 Adobe Acrobat Use-After-Free

CVE-2023-21529 Microsoft Exchange Deserialization of Untrusted

CVE-2023-36424 Microsoft Windows Out-of-Bounds Read

CVE-2025-60710 Microsoft Windows Link Following

CVE-2026-21643 Fortinet SQL Injection

CVE-2026-34621 Adobe Acrobat Reader Prototype

https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog

#cybersecurity #cisa #adobe #microsoft

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2023-21529
Vendor: Microsoft
Product: Exchange Server
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-21529

CISA Reports Active Exploitation of Four Microsoft Vulnerabilities, Including a 14-Year-Old Flaw

CISA flagged four actively exploited Microsoft vulnerabilities, spanning from 2012 to 2025 covering privilege escalation, remote code execution in Exchange Server, and insecure library loading, with at least one (CVE-2023-21529) tied to Storm-1175's Medusa ransomware campaigns. US Federal agencies must patch all four by April 27, 2026.

**Most of these flaws are old. So if you haven't patched your systems for over a year - let alone 14 years, it's high time to do it today. Because hackers don't care how old a vulnerability is. It's still usable. If you're still running Exchange Server 2013, 2016, or 2019 on-premises, prioritize patching or migrating those immediately.**
#cybersecurity #infosec #advisory #ransomware
https://beyondmachines.net/event_details/cisa-reports-active-exploitation-of-four-microsoft-vulnerabilities-including-a-14-year-old-flaw-f-v-f-p-4/gD2P6Ple2L

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2023-21529
Vendor: Microsoft
Product: Exchange Server
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-21529

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CVE-2012-1854 Visual Basic for Applications Insecure Library Loading

CVE-2020-9715 Adobe Acrobat Use-After-Free

CVE-2023-21529 Microsoft Exchange Deserialization of Untrusted

CVE-2023-36424 Microsoft Windows Out-of-Bounds Read

CVE-2025-60710 Microsoft Windows Link Following

CVE-2026-21643 Fortinet SQL Injection

CVE-2026-34621 Adobe Acrobat Reader Prototype

https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog

#cybersecurity #cisa #adobe #microsoft

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2026-21643
Vendor: Fortinet
Product: FortiClient EMS
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21643

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2026-21643
Vendor: Fortinet
Product: FortiClient EMS
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21643

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CVE-2012-1854 Visual Basic for Applications Insecure Library Loading

CVE-2020-9715 Adobe Acrobat Use-After-Free

CVE-2023-21529 Microsoft Exchange Deserialization of Untrusted

CVE-2023-36424 Microsoft Windows Out-of-Bounds Read

CVE-2025-60710 Microsoft Windows Link Following

CVE-2026-21643 Fortinet SQL Injection

CVE-2026-34621 Adobe Acrobat Reader Prototype

https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog

#cybersecurity #cisa #adobe #microsoft

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2025-60710
Vendor: Microsoft
Product: Windows
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-60710

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2025-60710
Vendor: Microsoft
Product: Windows
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-60710

🟠 CVE-2026-6196 - High (8.8)

A vulnerability was detected in Tenda F456 1.0.0.5. This affects the function fromexeCommand of the file /goform/exeCommand. Performing a manipulation of the argument cmdinput results in stack-based buffer overflow. The attack is possible to be ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6196/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6196 - High (8.8)

A vulnerability was detected in Tenda F456 1.0.0.5. This affects the function fromexeCommand of the file /goform/exeCommand. Performing a manipulation of the argument cmdinput results in stack-based buffer overflow. The attack is possible to be ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6196/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6194 - High (8.8)

A weakness has been identified in Totolink A3002MU B20211125.1046. Affected by this vulnerability is the function sub_410188 of the file /boafrm/formWlanSetup of the component HTTP Request Handler. This manipulation of the argument wan-url causes ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6194/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6194 - High (8.8)

A weakness has been identified in Totolink A3002MU B20211125.1046. Affected by this vulnerability is the function sub_410188 of the file /boafrm/formWlanSetup of the component HTTP Request Handler. This manipulation of the argument wan-url causes ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6194/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6186 - High (8.8)

A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This vulnerability affects the function strcpy of the file /goform/formNatStaticMap. The manipulation of the argument NatBind leads to buffer overflow. The attack i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6186/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6186 - High (8.8)

A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This vulnerability affects the function strcpy of the file /goform/formNatStaticMap. The manipulation of the argument NatBind leads to buffer overflow. The attack i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6186/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5085 - Critical (9.1)

Solstice::Session versions through 1440 for Perl generates session ids insecurely.

The _generateSessionID method returns an MD5 digest seeded by the epoch time, a random hash reference, a call to the built-in rand() function and the process id.

...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5085/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5085 - Critical (9.1)

Solstice::Session versions through 1440 for Perl generates session ids insecurely.

The _generateSessionID method returns an MD5 digest seeded by the epoch time, a random hash reference, a call to the built-in rand() function and the process id.

...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5085/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CVE-2012-1854 Visual Basic for Applications Insecure Library Loading

CVE-2020-9715 Adobe Acrobat Use-After-Free

CVE-2023-21529 Microsoft Exchange Deserialization of Untrusted

CVE-2023-36424 Microsoft Windows Out-of-Bounds Read

CVE-2025-60710 Microsoft Windows Link Following

CVE-2026-21643 Fortinet SQL Injection

CVE-2026-34621 Adobe Acrobat Reader Prototype

https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog

#cybersecurity #cisa #adobe #microsoft

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2023-36424
Vendor: Microsoft
Product: Windows
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-36424

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2023-36424
Vendor: Microsoft
Product: Windows
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-36424

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CVE-2012-1854 Visual Basic for Applications Insecure Library Loading

CVE-2020-9715 Adobe Acrobat Use-After-Free

CVE-2023-21529 Microsoft Exchange Deserialization of Untrusted

CVE-2023-36424 Microsoft Windows Out-of-Bounds Read

CVE-2025-60710 Microsoft Windows Link Following

CVE-2026-21643 Fortinet SQL Injection

CVE-2026-34621 Adobe Acrobat Reader Prototype

https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog

#cybersecurity #cisa #adobe #microsoft

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2020-9715
Vendor: Adobe
Product: Acrobat
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2020-9715

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854

⚠️ CVE-2020-9715 (https://secdb.nttzen.cloud/cve/detail/CVE-2020-9715)
- Name: Adobe Acrobat Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html ; https://nvd.nist.gov/vuln/detail/CVE-2020-9715

⚠️ CVE-2023-21529 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-21529)
- Name: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Exchange Server
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529 ; https://nvd.nist.gov/vuln/detail/CVE-2023-21529

⚠️ CVE-2023-36424 (https://secdb.nttzen.cloud/cve/detail/CVE-2023-36424)
- Name: Microsoft Windows Out-of-Bounds Read Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-36424 ; https://nvd.nist.gov/vuln/detail/CVE-2023-36424

⚠️ CVE-2025-60710 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-60710)
- Name: Microsoft Windows Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-60710 ; https://nvd.nist.gov/vuln/detail/CVE-2025-60710

⚠️ CVE-2026-21643 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21643)
- Name: Fortinet SQL Injection Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Fortinet
- Product: FortiClient EMS
- Notes: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21643

⚠️ CVE-2026-34621 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34621)
- Name: Adobe Acrobat and Reader Prototype Pollution Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html ; https://nvd.nist.gov/vuln/detail/CVE-2026-34621

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260413 #cisa20260413 #cve_2012_1854 #cve_2020_9715 #cve_2023_21529 #cve_2023_36424 #cve_2025_60710 #cve_2026_21643 #cve_2026_34621 #cve20121854 #cve20209715 #cve202321529 #cve202336424 #cve202560710 #cve202621643 #cve202634621

CISA has updated the KEV catalogue:

- CVE-2026-34621: Adobe Acrobat and Reader Prototype Pollution Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-34621

- CVE-2026-21643: Fortinet SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-21643

- CVE-2020-9715: Adobe Acrobat Use-After-Free Vulnerability https://www.cve.org/CVERecord?id=CVE-2020-9715

- CVE-2023-36424: Microsoft Windows Out-of-Bounds Read Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-36424

- CVE-2023-21529: Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability https://www.cve.org/CVERecord?id=CVE-2023-21529

- CVE-2025-60710: Microsoft Windows Link Following Vulnerability https://www.cve.org/CVERecord?id=CVE-2025-60710

- CVE-2012-1854: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability https://www.cve.org/CVERecord?id=CVE-2012-1854 #CISA #Microsoft #Windows #Adobe #Fortinet #infosec #vulnerability

CVE ID: CVE-2020-9715
Vendor: Adobe
Product: Acrobat
Date Added: 2026-04-13
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2020-9715

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CVE-2012-1854 Visual Basic for Applications Insecure Library Loading

CVE-2020-9715 Adobe Acrobat Use-After-Free

CVE-2023-21529 Microsoft Exchange Deserialization of Untrusted

CVE-2023-36424 Microsoft Windows Out-of-Bounds Read

CVE-2025-60710 Microsoft Windows Link Following

CVE-2026-21643 Fortinet SQL Injection

CVE-2026-34621 Adobe Acrobat Reader Prototype

https://www.cisa.gov/news-events/alerts/2026/04/13/cisa-adds-seven-known-exploited-vulnerabilities-catalog

#cybersecurity #cisa #adobe #microsoft

🚨 [CISA-2026:0413] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0413)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2012-1854 (https://secdb.nttzen.cloud/cve/detail/CVE-2012-1854)
- Name: Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Visual Basic for Applications (VBA)
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046 ; https://nvd.nist.gov/vuln/detail/CVE-2012-1854