CVE-2026-121607 – CRITICAL OS command injection in Qihoo 360 D603-2 (6.4.0 – 6.4.9). Remote code execution possible; public exploit exists. No patch available — immediate isolation and network restrictions advised. https://radar.offseq.com/threat/cve-2026-121607-os-command-injection-in-qihoo-360-d603-2-a508182fff399655 #OffSeq #CVE2026121607 #IoTSecurity

CVE-2026-121607 – CRITICAL OS command injection in Qihoo 360 D603-2 (6.4.0 – 6.4.9). Remote code execution possible; public exploit exists. No patch available — immediate isolation and network restrictions advised. https://radar.offseq.com/threat/cve-2026-121607-os-command-injection-in-qihoo-360-d603-2-a508182fff399655 #OffSeq #CVE2026121607 #IoTSecurity

Chrome security update: Chrome 157 fixes 213 flaws, including critical bugs CVE-2026-121156 in Dawn and CVE-2026-121035 in Prerender. Update now.

#Chrome #GoogleChrome #Chrome157 #CVE2026121156 #BrowserSecurity #UseAfterFree #PatchNow #Vulnerability

https://securityonline.info/chrome-157-security-update/?utm_source=mastodon&utm_medium=jetpack_social

Chrome security update: Chrome 157 fixes 213 flaws, including critical bugs CVE-2026-121156 in Dawn and CVE-2026-121035 in Prerender. Update now.

#Chrome #GoogleChrome #Chrome157 #CVE2026121156 #BrowserSecurity #UseAfterFree #PatchNow #Vulnerability

https://securityonline.info/chrome-157-security-update/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-92189 (CRITICAL, CVSS 9.8) hits Quest Foglight for Databases 8.2.0 – unauthenticated RCE via writeTopologySectionToFile path control. SYSTEM-level risk. Prioritize patching & restrict access. https://radar.offseq.com/threat/cve-2026-92189-cwe-73-external-control-of-file-name-or-path-in-quest-foglight-for-databases-bde4420456a8b3bd #OffSeq #Vuln #Quest #RCE

CVE-2026-92189 (CRITICAL, CVSS 9.8) hits Quest Foglight for Databases 8.2.0 – unauthenticated RCE via writeTopologySectionToFile path control. SYSTEM-level risk. Prioritize patching & restrict access. https://radar.offseq.com/threat/cve-2026-92189-cwe-73-external-control-of-file-name-or-path-in-quest-foglight-for-databases-bde4420456a8b3bd #OffSeq #Vuln #Quest #RCE

🟠 CVE-2026-121729 - High (8.3)

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121729/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121729 - High (8.3)

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121729/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-120931 - Critical (9.6)

Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-120931 - Critical (9.6)

Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120931/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121731 - High (8.8)

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single qu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121731/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121731 - High (8.8)

RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single qu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121731/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116651 - High (7.5)

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116651/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116651 - High (7.5)

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116651/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Chrome security update: Chrome 157 fixes 213 flaws, including critical bugs CVE-2026-121156 in Dawn and CVE-2026-121035 in Prerender. Update now.

#Chrome #GoogleChrome #Chrome157 #CVE2026121156 #BrowserSecurity #UseAfterFree #PatchNow #Vulnerability

https://securityonline.info/chrome-157-security-update/?utm_source=mastodon&utm_medium=jetpack_social

Chrome security update: Chrome 157 fixes 213 flaws, including critical bugs CVE-2026-121156 in Dawn and CVE-2026-121035 in Prerender. Update now.

#Chrome #GoogleChrome #Chrome157 #CVE2026121156 #BrowserSecurity #UseAfterFree #PatchNow #Vulnerability

https://securityonline.info/chrome-157-security-update/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-121727 - High (7.5)

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121727/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121727 - High (7.5)

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121727/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116650 - High (7.5)

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-116650 - High (7.5)

Tanium addressed an unauthorized code execution vulnerability in Threat Response.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82158 - Critical (9)

Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82158/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Arista fixed critical Arista security vulnerabilities CVE-2026-111497 and CVE-2026-98432 that allow unauthenticated remote code execution. Update now.

#Arista #VeloCloud #LinuxKernel #RCE #CVE2026111497 #CVE202698432 #Cybersecurity #InfoSec

https://securityonline.info/arista-security-vulnerabilities-rce-flaws/?utm_source=mastodon&utm_medium=jetpack_social

WordPress pingback and Brotli RCE https://fortbridge.co.uk/research/cve-2026-111497-wordpress-pingback-rce-reproduction/

Brotli vulnerability CVE-2026-111497 affected products list: fixes for Node.js, .NET, Envoy, PAN-OS and distros, plus VMware and others still unpatched.

#Brotli #CVE2026111497 #NodeJS #DotNET #VMware #PatchNow #CISAKEV #Vulnerability

https://securityonline.info/brotli-vulnerability-affected-products/?utm_source=mastodon&utm_medium=jetpack_social

CISA added WordPress Core CVE-2026-119977 to KEV on Nov. 3. A weakness in web-accessible staging paths during core upgrades could allow unauthenticated code execution in that window.

Confirm WordPress 7.1.4 or a fixed branch release, and check logs around recent core updates.

https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog

#Cybersecurity #Infosec #WordPress #PatchManagement

CVE ID: CVE-2026-119977
Vendor: WordPress
Product: WordPress Core
Date Added: 2026-11-03
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-119977

🟠 CVE-2026-82155 - High (7.8)

Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-95746 - High (7.5)

An authentication bypass vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95746/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Puppet Server RCE CVE-2026-115731 (CVSS 9.4) now has a public proof-of-concept exploit. Update OpenVox and Puppet Enterprise to patched versions.

#Puppet #OpenVox #CVE2026115731 #CVE2026115732 #RCE #PoC #DevOps #PatchNow

https://securityonline.info/puppet-server-rce-cve-2026-115731-poc/?utm_source=mastodon&utm_medium=jetpack_social

Puppet Server RCE CVE-2026-115731 (CVSS 9.4) now has a public proof-of-concept exploit. Update OpenVox and Puppet Enterprise to patched versions.

#Puppet #OpenVox #CVE2026115731 #CVE2026115732 #RCE #PoC #DevOps #PatchNow

https://securityonline.info/puppet-server-rce-cve-2026-115731-poc/?utm_source=mastodon&utm_medium=jetpack_social

HPE Fabric Composer vulnerabilities: 46 flaws fixed, including hardcoded password bug CVE-2026-95731 (CVSS 9.8). Upgrade to 7.4.1 or 7.3.5.

#HPE #ArubaNetworking #FabricComposer #CVE202695731 #HardcodedCredentials #DataCenter #PatchNow #Vulnerability

https://securityonline.info/hpe-fabric-composer-vulnerabilities-2/?utm_source=mastodon&utm_medium=jetpack_social

HPE Fabric Composer vulnerabilities: 46 flaws fixed, including hardcoded password bug CVE-2026-95731 (CVSS 9.8). Upgrade to 7.4.1 or 7.3.5.

#HPE #ArubaNetworking #FabricComposer #CVE202695731 #HardcodedCredentials #DataCenter #PatchNow #Vulnerability

https://securityonline.info/hpe-fabric-composer-vulnerabilities-2/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-95747 - High (7.5)

A privilege escalation vulnerability exists in the SSH interface of HPE Networking Fabric Composer which could allow an authenticated low-privileged attacker to exceed their authorized level of access, if certain preconditions outside of the attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95747/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16900 - High (7.5)

Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted reg...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16900/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

Bulletin ID: 2026-167-AWS Publication Date: 11/03/2026 10:30 AM PST
Description:
maplibre-gl-js-amplify is an open-source AWS Amplify library that integrates Amazon Location Service with MapLibre GL JS to render maps, markers, popups, and geofencing cont...

https://aws.amazon.com/security/security-bulletins/rss/2026-167-aws/

#aws #security

Advanced Custom Fields: Extended PRO for WordPress affected by CRITICAL code injection (CVE-2026-120534, CVSS 9.8). All versions ≤0.9.2.6 vulnerable via render_field. Immediate review and mitigation advised. https://radar.offseq.com/threat/the-advanced-custom-fields-extended-pro-plugin-for-wordpress-is-vulnerable-to-limited-code-injection-721e7bd7c6236973 #OffSeq #WordPress #CVE2026120534

CVE-2026-120534 | CRITICAL vuln (CVSS 9.8) in ACF Extended PRO ≤0.9.2.6 allows unauthenticated code injection via render_field. Prevent by disabling 'shortcode_preview' & ensuring OpenSSL is present. Patch status pending. https://radar.offseq.com/threat/cve-2026-120534-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-acf-extended-advanced-24aed413b4a5b6e4 #OffSeq #WordPress #Vuln

🟠 CVE-2026-28335 - High (8.4)

SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28335/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 Critical SolarWinds Dameware Flaw Could Allow Attackers to Compromise Remote Systems, CVE-2026-28336

SolarWinds has disclosed a critical command injection vulnerability in Dameware, its remote administration software, carrying a near-maximum CVSS score of 9.9.

The vulnerability could allow authenticated attackers with low-level privileges to execute malicious commands and potentially take control of remotely managed systems.

Given Dameware's role in enterprise IT administration, successful exploitation could put sensitive systems and the data they handle at risk.

CVE-2026-28336 | Critical

• CVSS: 9.9
• Type: Command injection
• Attack vector: Network
• Privileges required: Low
• User interaction: None
• Impact: Potential compromise of remotely controlled hosts

Affected Systems

• Affected: SolarWinds Dameware 2026.3 and earlier
• Fixed: Dameware 2026.3.1
• PoC: No public exploit identified
• Exploitation: No confirmed in-the-wild attacks

SolarWinds recommends that administrators upgrade to version 2026.3.1 to address the vulnerability.

Source: https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336

SolarWinds Dameware 2026.3.1 fixes Dameware command injection flaw CVE-2026-28336 (CVSS 9.9), plus a buffer overflow and DLL hijacking bug.

#SolarWinds #Dameware #CVE202628336 #CommandInjection #RemoteSupport #CVSS #PatchNow #Vulnerability

https://securityonline.info/dameware-command-injection-cve-2026-28336/?utm_source=mastodon&utm_medium=jetpack_social

🚨 Critical SolarWinds Dameware Flaw Could Allow Attackers to Compromise Remote Systems, CVE-2026-28336

SolarWinds has disclosed a critical command injection vulnerability in Dameware, its remote administration software, carrying a near-maximum CVSS score of 9.9.

The vulnerability could allow authenticated attackers with low-level privileges to execute malicious commands and potentially take control of remotely managed systems.

Given Dameware's role in enterprise IT administration, successful exploitation could put sensitive systems and the data they handle at risk.

CVE-2026-28336 | Critical

• CVSS: 9.9
• Type: Command injection
• Attack vector: Network
• Privileges required: Low
• User interaction: None
• Impact: Potential compromise of remotely controlled hosts

Affected Systems

• Affected: SolarWinds Dameware 2026.3 and earlier
• Fixed: Dameware 2026.3.1
• PoC: No public exploit identified
• Exploitation: No confirmed in-the-wild attacks

SolarWinds recommends that administrators upgrade to version 2026.3.1 to address the vulnerability.

Source: https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336

SolarWinds Dameware 2026.3.1 fixes Dameware command injection flaw CVE-2026-28336 (CVSS 9.9), plus a buffer overflow and DLL hijacking bug.

#SolarWinds #Dameware #CVE202628336 #CommandInjection #RemoteSupport #CVSS #PatchNow #Vulnerability

https://securityonline.info/dameware-command-injection-cve-2026-28336/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-28336 - Critical (9.9)

SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28336/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28327 - High (8.2)

SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28327/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 Critical SonicWall GMS Vulnerability Exposes Internal Files Without Authentication, CVE-2026-109593

SonicWall has disclosed two security vulnerabilities in its Global Management System (GMS), including a critical flaw that allows attackers to access sensitive internal files without credentials or user interaction.

The second vulnerability could allow authenticated attackers to exploit SQL injection and potentially access or modify information stored in the GMS database.

CVE-2026-109593 | Critical

• CVSS: 9.1
• Unauthenticated access to internal files
• No privileges or user interaction required

CVE-2026-109594 | Medium

• CVSS: 6.8
• Authenticated SQL injection
• Potential database access or modification

Affected Systems:

• SonicWall GMS 9.5.2 and earlier
• Windows and Linux deployments
• No security patch available, as GMS has reached end-of-life

There is currently no identified public PoC or confirmed exploitation in the wild.

Source: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

The SonicWall GMS vulnerabilities patch notice details two critical SonicWall GMS vulnerabilities. Migrate EOL systems to Network Security Manager now.

#SonicWall #SonicWallGMS #CVE2026109593 #CVE2026109594 #NetworkSecurity #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/sonicwall-gms-vulnerabilities-cve-2026-109593/?utm_source=mastodon&utm_medium=jetpack_social

🚨 Critical SonicWall GMS Vulnerability Exposes Internal Files Without Authentication, CVE-2026-109593

SonicWall has disclosed two security vulnerabilities in its Global Management System (GMS), including a critical flaw that allows attackers to access sensitive internal files without credentials or user interaction.

The second vulnerability could allow authenticated attackers to exploit SQL injection and potentially access or modify information stored in the GMS database.

CVE-2026-109593 | Critical

• CVSS: 9.1
• Unauthenticated access to internal files
• No privileges or user interaction required

CVE-2026-109594 | Medium

• CVSS: 6.8
• Authenticated SQL injection
• Potential database access or modification

Affected Systems:

• SonicWall GMS 9.5.2 and earlier
• Windows and Linux deployments
• No security patch available, as GMS has reached end-of-life

There is currently no identified public PoC or confirmed exploitation in the wild.

Source: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

The SonicWall GMS vulnerabilities patch notice details two critical SonicWall GMS vulnerabilities. Migrate EOL systems to Network Security Manager now.

#SonicWall #SonicWallGMS #CVE2026109593 #CVE2026109594 #NetworkSecurity #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/sonicwall-gms-vulnerabilities-cve-2026-109593/?utm_source=mastodon&utm_medium=jetpack_social

🚨 Critical SonicWall GMS Vulnerability Exposes Internal Files Without Authentication, CVE-2026-109593

SonicWall has disclosed two security vulnerabilities in its Global Management System (GMS), including a critical flaw that allows attackers to access sensitive internal files without credentials or user interaction.

The second vulnerability could allow authenticated attackers to exploit SQL injection and potentially access or modify information stored in the GMS database.

CVE-2026-109593 | Critical

• CVSS: 9.1
• Unauthenticated access to internal files
• No privileges or user interaction required

CVE-2026-109594 | Medium

• CVSS: 6.8
• Authenticated SQL injection
• Potential database access or modification

Affected Systems:

• SonicWall GMS 9.5.2 and earlier
• Windows and Linux deployments
• No security patch available, as GMS has reached end-of-life

There is currently no identified public PoC or confirmed exploitation in the wild.

Source: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

🚨 Critical SonicWall GMS Vulnerability Exposes Internal Files Without Authentication, CVE-2026-109593

SonicWall has disclosed two security vulnerabilities in its Global Management System (GMS), including a critical flaw that allows attackers to access sensitive internal files without credentials or user interaction.

The second vulnerability could allow authenticated attackers to exploit SQL injection and potentially access or modify information stored in the GMS database.

CVE-2026-109593 | Critical

• CVSS: 9.1
• Unauthenticated access to internal files
• No privileges or user interaction required

CVE-2026-109594 | Medium

• CVSS: 6.8
• Authenticated SQL injection
• Potential database access or modification

Affected Systems:

• SonicWall GMS 9.5.2 and earlier
• Windows and Linux deployments
• No security patch available, as GMS has reached end-of-life

There is currently no identified public PoC or confirmed exploitation in the wild.

Source: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0019

Endor Labs researcher Peyton Kennedy discovered a vulnerability in Docker Sandboxes (CVE-2026-103916) that lets AI coding agents bypass file access restrictions to read or modify cloud credentials and SSH keys.

Sandbox isolation is only as strong as every path between an agent and the system it’s isolated from.

Learn More: www.endorlabs.com/learn/docker-sandboxes-vulnerability-lets-ai-agents-access-sensitive-files-outside-their-sandbox-cve-2026-103916

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-118527 – Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Strategic C-Suite briefing on CVE-2026-118527 for Ivanti Connect Secure, providing risk impact assessments, compliance alignment, and executive mitigation protocols....

https://thecybermind.co/pfmw

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-118527 – Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Actionable threat intelligence and multi-SIEM detection queries for CVE-2026-118527, featuring complete technical execution and hardening guidelines...

https://thecybermind.co/5pzs

New.

Rapid7: Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527/ @Rapid7Official #infosec #zeroday #Ivanti #vulnerability #threatintel #threatintelligence

Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack surface. https://www.bleepingcomputer.com/news/security/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks/

🚨 Rapid Response: Critical Control Web Panel command injection (CVE-2026-77876, CVSS 9.8).

Censys identified 443,734 Internet-exposed web properties running CWP. Versions cannot be confirmed, so not all are necessarily vulnerable.

Read the full advisory for additional details and queries: https://censys.com/advisory/cve-2026-77876/

#Cybersecurity #CensysARC #Vulnerability #CVE202677876 #CommandInjection #ControlWebPanel #AttackSurfaceManagement #ThreatIntelligence #VulnerabilityManagement #WebHosting

CVE-2026-77876: OS command injection in Control Web Panel (<1.16) – CRITICAL severity (CVSS 9.3). Remote code execution possible via unescaped POST input. Restrict access & monitor for acc=deletedp abuse. https://radar.offseq.com/threat/cve-2026-77876-cwe-78-os-command-injection-in-control-web-panel-ec9d2cc2044f7ecc #OffSeq #CVE #infosec #vuln

CVE-2026-119085 - Template injection in the publishing component of Virtual Engineering Workbench

Bulletin ID: 2026-162-AWS Publication Date: 11/02/2026 09:30 AM PST
Description:
Virtual Engineering Workbench (VEW) is an open-source platform where platform engineers define and publish development environments, and developers provision them on demand ...

https://aws.amazon.com/security/security-bulletins/rss/2026-162-aws/

#aws #security

@varjolintu Since you didn't cite the CVE IDs I can't check what you're talking about, but CVE-2026-118673 looks like bs. AFAICT it's "user can exploit themselves".

This is exactly what I mean by slop CVEs. Bugs that are *of the form* of a vuln (memory corruption, UAF, etc.) but where there is not any (or at least not any significant) crossing of privilege domains that make it attack surface.

The INFINITT PACS vulnerabilities patch fixes two INFINITT PACS vulnerabilities, stopping code execution and privilege escalation on hospital servers.

#INFINITT #PACS #HealthcareSecurity #MedicalImaging #CVE202616305 #CVE202616306 #Cybersecurity #InfoSec

https://securityonline.info/infinitt-pacs-vulnerabilities-cve-2026-16305/?utm_source=mastodon&utm_medium=jetpack_social

The INFINITT PACS vulnerabilities patch fixes two INFINITT PACS vulnerabilities, stopping code execution and privilege escalation on hospital servers.

#INFINITT #PACS #HealthcareSecurity #MedicalImaging #CVE202616305 #CVE202616306 #Cybersecurity #InfoSec

https://securityonline.info/infinitt-pacs-vulnerabilities-cve-2026-16305/?utm_source=mastodon&utm_medium=jetpack_social

🔒 New CSAF advisory published

VDE-2026-119
Welotec: Multiple vulnerabilities in TK routers
CVE-2026-105978, CVE-2026-105979, CVE-2026-105980, CVE-2026-105981, CVE-2026-105982 (+1 more)

Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote at…

HTML: https://certvde.com/en/advisories/VDE-2026-119
CSAF JSON: https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-119.json

#OT #Advisory

🟠 CVE-2026-120833 - High (7.8)

labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-29508 - High (8.8)

ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value tha...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29508/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-120752 - High (7.5)

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120752/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-10-26 - 2026-10-26)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 254
- High: 1007
- Medium: 1185
- Low: 189
- None: 1033

Status:
- : 23
- Analyzed: 151
- Awaiting Analysis: 1116
- Deferred: 1572
- Modified: 5
- Received: 408
- Rejected: 217
- Undergoing Analysis: 176

CISA KEVs:
- CISA-2026:1026 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1026)
- CISA-2026:1027 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1027)
- CISA-2026:1028 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1028)
- CISA-2026:1029 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1029)
- CISA-2026:1030 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1030)

Top CNAs:
- VulnCheck: 459
- GitHub, Inc.: 389
- Mozilla Corporation: 343
- Apple Inc.: 328
- Patchstack: 251
- Wordfence: 204
- VulDB: 165
- kernel.org: 129
- WPScan: 109
- Drupal.org: 106

Top Affected Products:
- UNKNOWN: 3324
- Google Chrome: 72
- Langflow: 33
- Microsoft Edge Chromium: 16
- Apple Macos: 14
- Semantic-mediawiki Semantic Mediawiki: 14
- Vllm: 8
- Mtrudel Bandit: 8
- Openpanel: 7
- Elastic Cloud Enterprise: 7

Top EPSS Score:
- CVE-2026-101210 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101210)
- CVE-2026-101214 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101214)
- CVE-2026-86379 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86379)
- CVE-2026-116505 - 2.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116505)
- CVE-2026-112351 - 2.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112351)
- CVE-2026-91913 - 2.65 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-91913)
- CVE-2026-119409 - 2.48 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-119409)
- CVE-2026-116485 - 2.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116485)
- CVE-2026-86394 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86394)
- CVE-2026-86395 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86395)

#ZEN #SecDB #InfoSec

The November 2026 bulletin resolves critical MediaTek vulnerabilities, including modem flaws CVE-2026-20499, CVE-2026-20545, and CVE-2026-20546.

#MediaTek #ChipsetSecurity #AndroidSecurity #CVE202620499 #MobileSecurity #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/critical-mediatek-vulnerabilities-patched/?utm_source=mastodon&utm_medium=jetpack_social

Zyxel GS1900 zero-day CVE-2026-107441 was exploited in the wild and bypasses the CVE-2026-7273 patch. Install the October 22 firmware now.

#Zyxel #GS1900 #ZeroDay #CVE2026107441 #CVE20267273 #ExploitedInTheWild #NetworkSecurity #PatchNow

https://securityonline.info/zyxel-gs1900-zero-day-cve-2026-107441/?utm_source=mastodon&utm_medium=jetpack_social

Zyxel GS1900 zero-day CVE-2026-107441 was exploited in the wild and bypasses the CVE-2026-7273 patch. Install the October 22 firmware now.

#Zyxel #GS1900 #ZeroDay #CVE2026107441 #CVE20267273 #ExploitedInTheWild #NetworkSecurity #PatchNow

https://securityonline.info/zyxel-gs1900-zero-day-cve-2026-107441/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-107441 - High (8.8)

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-107441/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Maybe go hack and patch some CWP if you are into that sort of thing.

https://nvd.nist.gov/vuln/detail/cve-2026-73695

https://nvd.nist.gov/vuln/detail/cve-2026-73696

https://nvd.nist.gov/vuln/detail/cve-2026-73697

SQLi in RunZero.

https://www.runzero.com/advisories/runzero-search-sqli-cve-2026-110265/

Maybe go hack and patch some CWP if you are into that sort of thing.

https://nvd.nist.gov/vuln/detail/cve-2026-73695

https://nvd.nist.gov/vuln/detail/cve-2026-73696

https://nvd.nist.gov/vuln/detail/cve-2026-73697

Technical details and a macOS revisiond vulnerability PoC exploit for CVE-2026-112487 are public, allowing root elevation. Update macOS immediately.

#macOS #Apple #CVE2026112487 #PoC #PrivilegeEscalation #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/macos-revisiond-vulnerability-poc-cve-2026-112487/?utm_source=mastodon&utm_medium=jetpack_social

The November 2026 Android security update fixes 216 flaws, including zero-click remote code execution bugs CVE-2026-58868 and CVE-2026-58936.

#Android #AndroidSecurity #CVE202658868 #ZeroClick #RCE #MediaTek #PatchNow #MobileSecurity

https://securityonline.info/android-security-update-november-2026/?utm_source=mastodon&utm_medium=jetpack_social

Maybe go hack and patch some CWP if you are into that sort of thing.

https://nvd.nist.gov/vuln/detail/cve-2026-73695

https://nvd.nist.gov/vuln/detail/cve-2026-73696

https://nvd.nist.gov/vuln/detail/cve-2026-73697

CVE-2026-99247 | HIGH severity in Linux kernel 5.19: Kernel may crash (NULL pointer dereference) during early boot if tracing is disabled & trace buffer allocation fails. Patch available — apply ASAP to prevent boot failures. https://radar.offseq.com/threat/cve-2026-99247-tracing-do-not-initialize-tracefs-work-if-tracing-is-disabled-in-linux-kernel-11ff73f18055537a #OffSeq #Linux #Kernel #Vuln

CVE-2026-89292 | Eclipse Mnestix Browser (v1.6.0 – <2.3.0): CRITICAL bug allows unauthenticated extraction of backend API keys 🗝️. Restrict access, monitor for patch info. No known exploit in wild. https://radar.offseq.com/threat/in-eclipse-mnestix-browser-versions-160-up-until-but-excluding-230-it-was-possible-for-an-0d3db4ce36b8acbe #OffSeq #CVE202689292 #infosec

🟠 CVE-2026-77691 - High (8.1)

ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77691/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-121022 - High (8.1)

Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 on Windows and Linux allows a remote unauthenticated attacker to log in as the built-in administrator with the default credentials on a newly installed system...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-121022/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 New CSAF advisory published

VDE-2026-119
Welotec: Multiple vulnerabilities in TK routers
CVE-2026-105978, CVE-2026-105979, CVE-2026-105980, CVE-2026-105981, CVE-2026-105982 (+1 more)

Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote at…

HTML: https://certvde.com/en/advisories/VDE-2026-119
CSAF JSON: https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-119.json

#OT #Advisory

🔒 New CSAF advisory published

VDE-2026-119
Welotec: Multiple vulnerabilities in TK routers
CVE-2026-105978, CVE-2026-105979, CVE-2026-105980, CVE-2026-105981, CVE-2026-105982 (+1 more)

Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote at…

HTML: https://certvde.com/en/advisories/VDE-2026-119
CSAF JSON: https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-119.json

#OT #Advisory

🔒 New CSAF advisory published

VDE-2026-119
Welotec: Multiple vulnerabilities in TK routers
CVE-2026-105978, CVE-2026-105979, CVE-2026-105980, CVE-2026-105981, CVE-2026-105982 (+1 more)

Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote at…

HTML: https://certvde.com/en/advisories/VDE-2026-119
CSAF JSON: https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-119.json

#OT #Advisory

CVE-2026-4052 (CRITICAL): WSO2 API Manager (4.1.0 – 4.6.0, <1.8.8) has missing authorization — self-registered users can access System REST APIs if Identity Server is a Resident Key Manager. Upgrade to 1.8.8. https://radar.offseq.com/threat/cve-2026-4052-cwe-862-missing-authorization-in-wso2-wso2-api-manager-d1eaf36f3e90a714 #OffSeq #CVE #WSO2 #APIsecurity

🔴 CVE-2026-4052 - Critical (9.8)

This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4052/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-13594 - Critical (9.1)

Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13594/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 New CSAF advisory published

VDE-2026-119
Welotec: Multiple vulnerabilities in TK routers
CVE-2026-105978, CVE-2026-105979, CVE-2026-105980, CVE-2026-105981, CVE-2026-105982 (+1 more)

Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote at…

HTML: https://certvde.com/en/advisories/VDE-2026-119
CSAF JSON: https://welotec.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-119.json

#OT #Advisory

🐧 SIGINT // Ubuntu Watch — 2026-11-04

Primary source for a 9.8 remote, unauthenticated TCP use-after-free. Fixed kernels are in -proposed, not yet in -updates. Exposed hosts should mitigate now, and anyone who can tolerate the risk can test the proposed kernel on a non-critical box first.

🔗 https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432

#Ubuntu #Linux #infosec

🚨🐛 SIGINT // Cybersecurity Watch — 2026-11-04
Anthropic-found Linux kernel RCE (CVE-2026-98432, kernels since 4.4) has an AI-built exploit; Red Hat patched but Ubuntu hasn't, and crypto validators are on alert.
https://www.scworld.com/brief/critical-linux-kernel-vulnerability-allows-remote-code-execution
#CVE #Linux #InfoSec #Vulnerability

For anybody assessing risk from CVE-2026-98432, this is good from @malwaretech

tl;dr is basically likely a few million devices are vulnerable, some scanning, no sign of exploitation and no exploits available, development likely in the realms of nation state.

My POV - don't panic, calmly patch.

https://www.linkedin.com/posts/malwaretech_update-on-the-98-cvss-tcpip-rce-in-the-share-7523273340598411264-3rlv/

Ubuntu Server Is Cooked | CVE-2026-98432

https://watch.linuxrenaissance.com/w/3ouqDZgMNFM7M6czupnUWz

Ubuntu lässt sich ewig Zeit mit dem Patch für den Linux Kernel RCE CVE. Wer manuell installieren will: https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432

CVE-2026-98432 means that setting

net.mptcp.enabled = 0

in /etc/sysctl.conf is a very good idea. Then reboot to quash any existing sockets.

If you missed these releases yesterday:

Red Hat: CRITICAL: RHSB-2026-016 Use-after-free - kernel IPv4 (CVE-2026-98432) https://access.redhat.com/security/vulnerabilities/RHSB-2026-016

Canonical: Fixes available in -proposed pocket for CVE-2026-98432 https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432

More:

The Hacker News: Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html @thehackernews #infosec #vulnerability #Ubuntu #Linux

@malwaretech I was wondering when the patched Ubuntu kernels would be out. TL;DR - the fixes are available now in the -proposed pocket, and will make it into the regular updates when testing is complete.

https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432

Ubuntu continues to work on the the fix for CVE-2026-98432.

a critical use-after-free vulnerability in the Linux kernel's IPv4 TCP connection handling code (CVSS 9.8 score)

Debian released the fix on Oct 16.

https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432

#Security

Critical Kernel Flaw CVE-2026-98432: How to Patch #Ubuntu #Linux

https://www.ubuntufree.com/linux-kernel-cve-2026-98432-ubuntu-fix/

https://chalmovsky.com/posts/wtf-ubuntu
CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely. Anthropic says it built a working exploit that gets root on a server. A total takeover.

Debian patched it on October 16. Ubuntu still doesn't have a patch more than two weeks later. Every supported release, LTS included, is listed as "Vulnerable". #security #offrehcked

Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks

Link: https://freenode.net/article/ubuntu-lts-kernels-still-unfixed-for-critical-cve-2026-98432
Discussion: https://news.ycombinator.com/item?id=50341462

Ubuntu still hasn't released a patch for the Linux 0day RCE in almost three weeks.

https://freenode.net/article/ubuntu-lts-kernels-still-unfixed-for-critical-cve-2026-98432

#Linux #Security #ubuntu #zeroday

Ubuntu puts fixes for CVE-2026-98432, a Linux kernel TCP flaw rated CVSS 9.8, in the proposed pocket for 22.04 LTS and newer. Older releases wait.

#CVE202698432 #LinuxKernel #Ubuntu #TCP #RCE #MPTCP #PatchNow #LinuxSecurity

https://securityonline.info/cve-2026-98432-ubuntu-proposed-fix/?utm_source=mastodon&utm_medium=jetpack_social

Noone should blame Ubuntu for not fixing CVE-2026-98432. They actually have had a solution for a decade. Just roll back to 14.04 LTS.

Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore there is an increased likelihood of threat actors attempting to develop exploits for the vulnerability.

while CVE-2026-98432 is believed to require MPTCP to be enabled in the kernel, as well as a listening app/service which binds an MPTCP socket, which many have suggested should be rare, several kernels including Debian enable MPTCP by default.

Additionally, Go 1.24+ binds MPTCP sockets by default if the option is enabled in the kernel, so anything built on top of Go (including Caddy) will create the required MPTCP listener.

The mitigation of setting net.mptcp.enabled=0 disabled MPTCP, but does not apply to existing sockets, so any applications that have bound MPTCP sockets need to be restarted, otherwise the system remains exploitable.

You can check if your server is running any MPTCP listeners with the following command: sudo ss -Mlnp

On 2026-10-30 our preliminary internet-wide scan of port 443 confirmed that there are approximately 2,102,043 servers that are successfully reachable via an MPTCP connection. A deeper scan which attempts to connect to each endpoint on port 443 and negotiate a full TLS connection with MPTCP enabled returned about 762,774 systems.

Neither scan can confirm that these are unpatched kernels, just total exposure, but it's a lot more systems than expected. Since a valid HTTP connection is not required to exploit the vulnerability, the total attack surface is likely closer to the 2.1 million number than the 763k one.

As of today (2026-11-02), we've picked up several residential proxies and VPNs scanning the internet on port 443 using MPTCP-enabled connections. Since regular scanners do not negotiate MPTCP by default, and no data is being sent to the HTTP server over 443, we strongly suspect this activity is scanning for CVE-2026-98432 specifically. The use of residential proxies and RU-based VPN servers suggests that this is likely threat actor scanning, rather than security researchers.

Currently there are no known publicly available remote code execution exploits, but there are several denial of service proof-of-concepts floating around. This code gives threat actors a starting point to begin attempting to weaponize the vulnerability. Building exploits for the vulnerability is reported to be extremely difficult, but several state-sponsored threat actors likely have the resources required to succeed.

Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks https://freenode.net/article/ubuntu-lts-kernels-still-unfixed-for-critical-cve-2026-98432

Arista fixed critical Arista security vulnerabilities CVE-2026-111497 and CVE-2026-98432 that allow unauthenticated remote code execution. Update now.

#Arista #VeloCloud #LinuxKernel #RCE #CVE2026111497 #CVE202698432 #Cybersecurity #InfoSec

https://securityonline.info/arista-security-vulnerabilities-rce-flaws/?utm_source=mastodon&utm_medium=jetpack_social

Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks
https://freenode.net/article/ubuntu-lts-kernels-still-unfixed-for-critical-cve-2026-98432
Discussion: https://news.ycombinator.com/item?id=50341462

Now that's what I call commitment.

https://bloatberg.com/2026/11/02/ubuntu-canonical-extends-long-term-support-for-cve-2026-98432-through-2036

#satire

Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks

Link: https://freenode.net/article/ubuntu-lts-kernels-still-unfixed-for-critical-cve-2026-98432
Discussion: https://news.ycombinator.com/item?id=50341462

Reaffirming its commitment to enterprise-grade stability, Canonical announced Monday that CVE-2026-98432, the critical use-after-free in the Linux kernel's IPv4 TCP code, will receive a full 10 years of Long-Term Support on every Ubuntu release it affects.

"Other distros will patch something out from under you in 48 hours, and suddenly your whole threat model is wrong. Canonical is giving CIOs a vulnerability they can actually budget for."

https://bloatberg.com/2026/11/02/ubuntu-canonical-extends-long-term-support-for-cve-2026-98432-through-2036

#Ubuntu #Canonical #Linux

Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks

Link: https://freenode.net/article/ubuntu-lts-kernels-still-unfixed-for-critical-cve-2026-98432
Discussion: https://news.ycombinator.com/item?id=50341462

Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks

Link: https://freenode.net/article/ubuntu-lts-kernels-still-unfixed-for-critical-cve-2026-98432
Discussion: https://news.ycombinator.com/item?id=50341462

Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks

https://freenode.net/article/ubuntu-lts-kernels-still-unfixed-for-critical-cve-2026-98432

#linux

@nixCraft

Ubuntu, IMHO an awful choice.

the fact that below CVE is not fixed despite the fact it is patched by Debian
is yet another reason to install a decent distribution.

CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code.

It's really funny Ubuntu hasn't shipped a fix for CVE-2026-98432 yet because the fix is a +2/-2 diff that applies cleanly to their kernels and the entire reason they haven't been able to get an update out the door is due to deep organisational dysfunction within Canonical.

🚨 Critical Linux kernel flaw could allow remote root code execution; CVE-2026-98432

A use-after-free vulnerability in the Linux IPv4 TCP handshake path allows an unauthenticated attacker to trigger memory corruption by sending specially timed packets to a listening service.

Successful exploitation could crash the system or potentially execute arbitrary code as root.
⠀
• CVSS: 9.8
• Affected: Linux kernel 4.4 and later
• Attack vector: Network
• Privileges required: None
• User interaction: None
• Active exploitation: Not reported
⠀
Fixed kernel branches:

• 5.10.272
• 5.15.223
• 6.1.190
• 6.6.159
• 6.12.113
• 6.18.56
• 7.2.10
• 7.3
⠀
Administrators should install their distribution’s updated kernel and reboot to activate the fix.

Advisory: https://access.redhat.com/security/vulnerabilities/RHSB-2026-016

WTF Ubuntu? https://chalmovsky.com/posts/wtf-ubuntu

In case you missed it: CVE-2026-98432 is a critical (CVSS 9.8) bug in the Linux kernel's TCP code. It's been there since 2016, so virtually every Linux server on the planet has it, and it can be hit remotely. Anthropic says it built a working exploit that gets root on a server. A total takeover.

Debian patched it on October 16. Ubuntu still doesn't have a patch more than two weeks later. Every supported release, LTS included, is listed as "Vulnerable".

Bin irritiert, dass für Debian schön länger Kernelpatches bereitstehen, aber man bei Ubuntu irgendwie hängt (CVE Score 9,8).

https://ubuntu.com/security/CVE-2026-98432

CVE-2026-98432 : la faille critique du noyau Linux qui peut offrir un accès root à distance https://www.it-connect.fr/cve-2026-98432-faille-noyau-linux-tcp-root-distance/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Linux

9.8 CVE in Linux kernel: https://www.cve.org/CVERecord?id=CVE-2026-98432

CW: biztonság

CVE-2026-98432 (CVSS 9.8) kritikus Linux kernel IPv4 use-after-free: Anthropic belső Claude modellje működő exploitot demonstrált—Multipath TCP listenerek esetén távoli root lehetséges. Upstream javítások elérhetők, de Ubuntu 22.04/24.04/26.04/26.10 még sebezhető. Ideiglenes mitigáció: sudo sysctl -w net.mptcp.enabled=0 vagy az iptables DROP szabály. Részletek: https://linuxmint.hu/hir/2026/11/a-claude-ai-jelszo-nelkul-torhet-be-sebezheto-linux-szerverekre-az-ubuntu-meg-mindig-nem

#Linux #CVE2026-98432 #Ubuntu #security #OpenSource

Ubuntu is shitty software and backporting is flawed
https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf

Anza has urged Solana mainnet-beta validators to act on CVE-2026-98432, a critical Linux kernel use-after-free bug scored 9.8 that lets a remote attacker run commands as root. Ubuntu still lists the fix as work in progress, so operators should disable Multipath TCP. A host takeover could expose the validator identity key. https://thedefiant.io/news/security/anza-urges-solana-validators-to-act-on-critical-linux-flaw #Web3 #Blockchain #Solana

what the heck?

CVE-2026-98432 is a CVSS 9.8 remote use-after-free in Linux's IPv4 TCP handshake, fixed upstream Oct 15. Ubuntu and RHEL haven't shipped a fixed kernel yet.

https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf

TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf

#linux

🟠 CVE-2026-77800 - High (7.7)

ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77800/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SUSE fixed Rancher security vulnerabilities, including Rancher credential leak CVE-2026-88811, an SSRF flaw, and an unauthorized shell bypass. Update now.

#Rancher #Kubernetes #CloudSecurity #CVE202688811 #InfoSec #Cybersecurity #Vulnerability

https://securityonline.info/rancher-security-vulnerabilities-cve-2026-88811/?utm_source=mastodon&utm_medium=jetpack_social

Rancher CVE-2026-88811 can forward a signed-in user's Rancher session credential or API token to allowlisted third-party hosts through its meta proxy.

Fixed in 2.15.3, 2.14.7, 2.13.11, 2.12.15 and 2.11.19. The vendor recommends upgrading, rotating affected API tokens and invalidating sessions. This is credential exposure, not confirmed remote takeover.

https://github.com/rancher/rancher/security/advisories/GHSA-x82x-2qj6-5rm2

#Cybersecurity #Infosec #CloudSecurity #PatchManagement

🔴 CVE-2026-88811 - Critical (9.1)

Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11,

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88811/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-120577 - High (8.1)

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120577/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomware
https://isc.sans.edu/podcastdetail/10162

Barracuda security advisory:

• CVE-2026-116606 (9.3 critical) Pre-Authentication Authorization Bypass in Email Security Gateway
• CVE-2026-111560 (8.6 high) Command Injection in ESG, ADC, BMA, WCC, WAF, WSGhttps://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

#Barracuda #CVE

Patch two Barracuda vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that allow attackers to gain Barracuda root access across multiple appliances.

#Barracuda #EmailSecurity #CVE2026116606 #CVE2026111560 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/barracuda-vulnerabilities-root-access-patch/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-116606: CRITICAL auth bypass in Barracuda ESG (<9.4.0.030). Unauthenticated attackers can import crafted configs, altering appliance settings. Upgrade to 9.4.0.030+ now. https://radar.offseq.com/threat/cve-2026-116606-cwe-288-authentication-bypass-using-an-alternate-path-or-channel-in-barracuda-networks-f64fb8cb7ae70977 #OffSeq #Barracuda #Infosec #CVE2026_116606

SANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomware
https://isc.sans.edu/podcastdetail/10162

Barracuda security advisory:

• CVE-2026-116606 (9.3 critical) Pre-Authentication Authorization Bypass in Email Security Gateway
• CVE-2026-111560 (8.6 high) Command Injection in ESG, ADC, BMA, WCC, WAF, WSGhttps://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection

#Barracuda #CVE

Patch two Barracuda vulnerabilities, CVE-2026-116606 and CVE-2026-111560, that allow attackers to gain Barracuda root access across multiple appliances.

#Barracuda #EmailSecurity #CVE2026116606 #CVE2026111560 #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/barracuda-vulnerabilities-root-access-patch/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-76955: HIGH severity buffer overflow in Zyxel NWA110AX (≤7.12[ABTG.0]C0) allows LAN-based privilege escalation and device compromise. No patch yet — limit LAN access & monitor for abuse. https://radar.offseq.com/threat/a-buffer-overflow-vulnerability-in-the-zdpwtp-binary-in-zyxel-nwa110ax-firmware-versions-through-ef14a731cb981018 #OffSeq #Zyxel #Vulnerability

🟠 CVE-2026-76955 - High (8.8)

A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76955/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58873 - High (8.4)

In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58873/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-86596 | s2Member plugin <=260927 has a CRITICAL RCE bug. Auth'd users (custom-level+) can execute arbitrary PHP via 'item_name' in email templates. No confirmed patch — restrict or disable plugin now. https://radar.offseq.com/threat/the-s2member-plugin-for-wordpress-is-vulnerable-to-remote-code-execution-in-all-versions-up-to-and-2c20f20d9eb4970a #OffSeq #WordPress #RCE #CVE202686596

🔴 CVE-2026-86596 - Critical (9.8)

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, &lt;= 260927 via the &#039;item_name&#039; parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86596/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CW: kritikus Android sebezhetőség (CVE-2026-58882)

Egy speciálisan összeállított SMS összeomlaszthatja a híváskezelőt, megszakítva hívásokat — akár segélyhívásokat is. Javítást Google kiadta júliusban biztonsági előzetesekben; novemberi bulletinben szerepel. Frissítsd, ahol elérhető.

https://linuxmint.hu/hir/2026/11/halalos-sms-bug-benithatja-az-androidot-de-hamarosan-erkezik-a-javitas

#Android #CVE2026-58882 #Security #OpenSource

🟠 CVE-2026-91893 - High (7.8)

Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91893/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91898 - High (8.1)

Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, le...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91898/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 Critical zero-click Android RCE patched; CVE-2026-58868

A heap buffer overflow in Android’s Framework component could allow remote code execution without additional privileges or user interaction.

The flaw resides in the onOutputReceived function within FrameDecoder.cpp, where an out-of-bounds write can occur while processing media frames.

• Severity: Critical
• CVSS: Not yet assigned
• Affected: Android 14, 15, 16, 16 QPR2 and 17
• Fixed: Security patch level 2026-11-01 or later
• PoC: No public exploit identified
• Exploitation: No confirmed in-the-wild attacks

Administrators should aim for the 2026-11-05 patch level or later, which includes this fix and the remaining November security updates for kernel and hardware components.

Source: https://source.android.com/docs/security/bulletin/2026/2026-11-01

🚨 Critical zero-click Android RCE patched; CVE-2026-58868

A heap buffer overflow in Android’s Framework component could allow remote code execution without additional privileges or user interaction.

The flaw resides in the onOutputReceived function within FrameDecoder.cpp, where an out-of-bounds write can occur while processing media frames.

• Severity: Critical
• CVSS: Not yet assigned
• Affected: Android 14, 15, 16, 16 QPR2 and 17
• Fixed: Security patch level 2026-11-01 or later
• PoC: No public exploit identified
• Exploitation: No confirmed in-the-wild attacks

Administrators should aim for the 2026-11-05 patch level or later, which includes this fix and the remaining November security updates for kernel and hardware components.

Source: https://source.android.com/docs/security/bulletin/2026/2026-11-01

The November 2026 Android security update fixes 216 flaws, including zero-click remote code execution bugs CVE-2026-58868 and CVE-2026-58936.

#Android #AndroidSecurity #CVE202658868 #ZeroClick #RCE #MediaTek #PatchNow #MobileSecurity

https://securityonline.info/android-security-update-november-2026/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-119978 - High (8.5)

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-119978/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

The November 2026 bulletin resolves critical MediaTek vulnerabilities, including modem flaws CVE-2026-20499, CVE-2026-20545, and CVE-2026-20546.

#MediaTek #ChipsetSecurity #AndroidSecurity #CVE202620499 #MobileSecurity #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/critical-mediatek-vulnerabilities-patched/?utm_source=mastodon&utm_medium=jetpack_social

The November 2026 bulletin resolves critical MediaTek vulnerabilities, including modem flaws CVE-2026-20499, CVE-2026-20545, and CVE-2026-20546.

#MediaTek #ChipsetSecurity #AndroidSecurity #CVE202620499 #MobileSecurity #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/critical-mediatek-vulnerabilities-patched/?utm_source=mastodon&utm_medium=jetpack_social

📈 CVE Published in last 7 days (2026-10-26 - 2026-10-26)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 254
- High: 1007
- Medium: 1185
- Low: 189
- None: 1033

Status:
- : 23
- Analyzed: 151
- Awaiting Analysis: 1116
- Deferred: 1572
- Modified: 5
- Received: 408
- Rejected: 217
- Undergoing Analysis: 176

CISA KEVs:
- CISA-2026:1026 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1026)
- CISA-2026:1027 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1027)
- CISA-2026:1028 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1028)
- CISA-2026:1029 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1029)
- CISA-2026:1030 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1030)

Top CNAs:
- VulnCheck: 459
- GitHub, Inc.: 389
- Mozilla Corporation: 343
- Apple Inc.: 328
- Patchstack: 251
- Wordfence: 204
- VulDB: 165
- kernel.org: 129
- WPScan: 109
- Drupal.org: 106

Top Affected Products:
- UNKNOWN: 3324
- Google Chrome: 72
- Langflow: 33
- Microsoft Edge Chromium: 16
- Apple Macos: 14
- Semantic-mediawiki Semantic Mediawiki: 14
- Vllm: 8
- Mtrudel Bandit: 8
- Openpanel: 7
- Elastic Cloud Enterprise: 7

Top EPSS Score:
- CVE-2026-101210 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101210)
- CVE-2026-101214 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101214)
- CVE-2026-86379 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86379)
- CVE-2026-116505 - 2.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116505)
- CVE-2026-112351 - 2.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112351)
- CVE-2026-91913 - 2.65 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-91913)
- CVE-2026-119409 - 2.48 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-119409)
- CVE-2026-116485 - 2.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116485)
- CVE-2026-86394 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86394)
- CVE-2026-86395 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86395)

#ZEN #SecDB #InfoSec

🔴 CVE-2026-120280 - Critical (10)

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120280/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-120240 - Critical (9.9)

A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120240/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Out-of-bounds write (CWE-787) in MediaTek chipsets' modem (CVE-2026-68589, HIGH) allows local privilege escalation for attackers with System privilege. Patch: MOLY01320076. Fix now! https://radar.offseq.com/threat/cve-2026-68589-cwe-787-out-of-bounds-write-in-mediatek-inc-mediatek-chipset-743516bd3729fd5f #OffSeq #MediaTek #Vulnerability #Security

CVE-2026-109618 (PHP2Shell) – CRITICAL vuln in WAGO CC100. Attackers can hijack the PHP process via web UI; public exploit exists, no patch yet. Restrict access & monitor for updates. https://radar.offseq.com/threat/wago-multiple-devices-affected-by-php2shell-b21f4d4a82bef247 #OffSeq #Vulnerability #ICS #WAGO

🔒 New CSAF advisory published

VDE-2026-139
Two critical PHP vulnerabilities in several Festo Didactic products
CVE-2026-109618, CVE-2026-109619

Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with PHP. The bundled version of PHP is vulnerable to the two critical vulnerabilities CVE-2026-109618 a…

HTML: https://certvde.com/en/advisories/VDE-2026-139
CSAF JSON: https://festo.csaf-tp.certvde.com/.well-known/csaf/white/2026/fsa-202603.json

#OT #Advisory

🔒 New CSAF advisory published

VDE-2026-132
WAGO: Multiple Devices affected by PHP2Shell
CVE-2026-109618, CVE-2026-109619

Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weaknesses in PHP's internal memory and request handling mechanisms. Under specific conditions, specially…

HTML: https://certvde.com/en/advisories/VDE-2026-132
CSAF JSON: https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-132.json

#OT #Advisory

The ASF patched Apache security vulnerabilities with new Apache security fixes for Syncope, Arrow, and Fineract, including critical flaw CVE-2026-64618.

#Apache #ApacheSyncope #ApacheFineract #ApacheArrow #SQLInjection #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/apache-security-vulnerabilities-syncope-fineract/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-120345: CRITICAL RCE in WAVLINK WN551X3-A (M51X3_V251020-WO-182e965) via DNS handler. Public exploit. No patch. Isolate devices from untrusted networks until fix released. https://radar.offseq.com/threat/a-vulnerability-was-found-in-wavlink-wn551x3-a-m51x3v251020-wo-182e965-cve-2026-120345-c09ec0836592aef0 #OffSeq #Vuln #IoT #Security

CVE-2026-120345: CRITICAL OS command injection in WAVLINK WN551X3-A (DNS Handler, /bin/ioos). Remote code execution possible — public exploit exists. Restrict network access & monitor device activity. Details: https://radar.offseq.com/threat/cve-2026-120345-os-command-injection-in-wavlink-wn551x3-a-8a3e40bb494c5e8c #OffSeq #CVE2026120345 #IoTSecurity

WAVLINK WN536AX6-A V260507 is impacted by CVE-2026-120279 (CRITICAL, CVSS 10) – remote OS command injection via /protocol.csp openvpn_cli Handler. Exploit is public. Patch or isolate devices now! https://radar.offseq.com/threat/a-flaw-has-been-found-in-wavlink-wn536ax6-a-v260507-cve-2026-120279-f78efd8cb5e677e8 #OffSeq #Vulnerability #CVE2026120279

🔴 CVE-2026-120279 - Critical (10)

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-120283 - Critical (10)

A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-120283 – CRITICAL stack buffer overflow in Linksys E8450 v1.2.00.360516. Remote, unauthenticated RCE possible via /www/cgi-bin/portal.cgi (hidden_timezone). No patch from vendor. Restrict access ASAP. https://radar.offseq.com/threat/cve-2026-120283-stack-based-buffer-overflow-in-linksys-e8450-ba4aff2d530ff600 #OffSeq #CVE2026120283 #InfoSec #RouterSecurity

🔴 CVE-2026-120281 - Critical (10)

A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120281/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-120282 - Critical (9.9)

A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-120276 - Critical (10)

A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120276/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-120277 - Critical (10)

A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-120277: CRITICAL OS command injection in WAVLINK WN536AX6-A (V260507_2.0.0). Remote attackers can execute OS commands – no patch yet. Restrict access & monitor for updates. Exploit code is public. https://radar.offseq.com/threat/cve-2026-120277-os-command-injection-in-wavlink-wn536ax6-a-51fe2fe977f184ad #OffSeq #CVE #Infosec #IoT

Apache Wicket vulnerabilities: a security update fixes 19 flaws, including CVE-2026-84170 upload DoS and XSS bugs. Upgrade to 8.20.0, 9.25.0 or 10.12.0.

#ApacheWicket #Java #CVE202684170 #CVE202683594 #XSS #WebSecurity #PatchNow #Vulnerability

https://securityonline.info/apache-wicket-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-120241 - High (7.5)

A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-120241/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-118185 - High (7.5)

The Security Optimizer WordPress plugin before 1.6.9 does not limit the number of two-factor authentication codes that can be submitted for a pending login, allowing an attacker who already knows a user's password to brute force the second factor...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-118185/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Prefab UI's opt-in Generative UI sandbox has a bypass (CVE-2026-120338). The Pyodide/Deno boundary let caller-supplied Python read and write host files as the server OS user.

Relevant to FastMCP servers that expose generate_prefab_ui. Unauthenticated exposure depends on the server's access controls.

Fixed in prefab-ui 0.21.0, released Oct 26. Check versions and tool access.

https://github.com/PrefectHQ/prefab/pull/538

#Cybersecurity #Infosec #AppSec #MCP

WAVLINK WN553X1-B firmware V260403_2.0.0 has authenticated command injection (CVE-2026-120231). A researcher reproduced root execution in emulated firmware. Default passwords raise the risk.

MSPs: inventory devices, change defaults, and restrict management access. No confirmed vendor fix or in-the-wild exploitation.

https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_openvpn_cli_command_injection.md

#Cybersecurity #Infosec #NetworkSecurity #MSP

Apply the new Gitea vulnerabilities patch to resolve 18 Gitea vulnerabilities, including XSS flaw CVE-2026-113429 and token leak bug CVE-2026-112887.

#Gitea #DevOps #Git #Cybersecurity #CVE2026113429 #AppSec #Vulnerability #InfoSec

https://meterpreter.org/gitea-vulnerabilities-patch-28-3-0/?utm_source=mastodon&utm_medium=jetpack_social

Linux kernel vulnerabilities this week: 129 CVEs, including critical iSCSI flaws CVE-2026-99154 and CVE-2026-99153. Get the kernel security update.

#LinuxKernel #Linux #CVE202699154 #CVE202699153 #iSCSI #KernelSecurity #PatchNow #Vulnerability

https://securityonline.info/linux-kernel-vulnerabilities-oct-26-nov-1-2026/?utm_source=mastodon&utm_medium=jetpack_social

Linux kernel vulnerabilities this week: 129 CVEs, including critical iSCSI flaws CVE-2026-99154 and CVE-2026-99153. Get the kernel security update.

#LinuxKernel #Linux #CVE202699154 #CVE202699153 #iSCSI #KernelSecurity #PatchNow #Vulnerability

https://securityonline.info/linux-kernel-vulnerabilities-oct-26-nov-1-2026/?utm_source=mastodon&utm_medium=jetpack_social

📈 CVE Published in last 7 days (2026-10-26 - 2026-10-26)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 254
- High: 1007
- Medium: 1185
- Low: 189
- None: 1033

Status:
- : 23
- Analyzed: 151
- Awaiting Analysis: 1116
- Deferred: 1572
- Modified: 5
- Received: 408
- Rejected: 217
- Undergoing Analysis: 176

CISA KEVs:
- CISA-2026:1026 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1026)
- CISA-2026:1027 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1027)
- CISA-2026:1028 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1028)
- CISA-2026:1029 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1029)
- CISA-2026:1030 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1030)

Top CNAs:
- VulnCheck: 459
- GitHub, Inc.: 389
- Mozilla Corporation: 343
- Apple Inc.: 328
- Patchstack: 251
- Wordfence: 204
- VulDB: 165
- kernel.org: 129
- WPScan: 109
- Drupal.org: 106

Top Affected Products:
- UNKNOWN: 3324
- Google Chrome: 72
- Langflow: 33
- Microsoft Edge Chromium: 16
- Apple Macos: 14
- Semantic-mediawiki Semantic Mediawiki: 14
- Vllm: 8
- Mtrudel Bandit: 8
- Openpanel: 7
- Elastic Cloud Enterprise: 7

Top EPSS Score:
- CVE-2026-101210 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101210)
- CVE-2026-101214 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101214)
- CVE-2026-86379 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86379)
- CVE-2026-116505 - 2.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116505)
- CVE-2026-112351 - 2.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112351)
- CVE-2026-91913 - 2.65 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-91913)
- CVE-2026-119409 - 2.48 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-119409)
- CVE-2026-116485 - 2.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116485)
- CVE-2026-86394 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86394)
- CVE-2026-86395 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86395)

#ZEN #SecDB #InfoSec

3 threats SOC teams should know about this week 🛡️

My site Intel60 tracked 119 security stories this week. 34 were rated critical, and CISA added 10 bugs to its Known Exploited Vulnerabilities list. These are the three I’d put at the top of a SOC’s list:

1️⃣ Cisco firewall VPN zero-day (CVE-2026-76418)
Attackers are exploiting a flaw in the remote-access VPN of Cisco Secure Firewall ASA and FTD. It’s the second Cisco firewall zero-day since August.
🔎 SOC angle: patch now, then review VPN logs for unusual sessions. Edge devices are where attackers get in first.

2️⃣ Claude Code extension backdoored in Open VSX
The extension in the Open VSX registry was compromised to install a persistent SSH backdoor on developer machines. Cursor’s marketplace was also affected and temporarily shut down.
🔎 SOC angle: check developer endpoints for unexpected SSH keys and new authorized_keys entries. Developer tools are now part of the supply-chain attack surface.

3️⃣ Ivanti Connect Secure flaws added to KEV
CISA flagged a missing-authentication flaw (CVE-2026-111357) that can be chained with other bugs. The federal deadline is Nov 2, which tells you how urgent CISA considers it.
🔎 SOC angle: if you run Ivanti, patch, then hunt for signs of compromise. With Ivanti, patching alone hasn’t always removed attackers who were already in.

The pattern this week: the entry points are edge devices and developer tools. Watch what sits at the perimeter and what your developers install.

I track these with Intel60, a free tool I built that turns security news into 60-word, severity-rated briefs every 30 minutes: https://intel60.app

What was the biggest story on your radar this week? 👇

#cybersecurity #SOC #threatintel #infosec #blueteam #vulnerabilitymanagement

New.

Rapid7: Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527/ @Rapid7Official #infosec #zeroday #Ivanti #vulnerability #threatintel #threatintelligence

Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack surface. https://www.bleepingcomputer.com/news/security/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks/

SANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized Claude Code Extension in Cursor Marketplace; Ivanti Connect Secure Zero-Days (CVE-2026-111357); Android SMS of Death
https://isc.sans.edu/podcastdetail/10160

📈 CVE Published in last 7 days (2026-10-26 - 2026-10-26)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 254
- High: 1007
- Medium: 1185
- Low: 189
- None: 1033

Status:
- : 23
- Analyzed: 151
- Awaiting Analysis: 1116
- Deferred: 1572
- Modified: 5
- Received: 408
- Rejected: 217
- Undergoing Analysis: 176

CISA KEVs:
- CISA-2026:1026 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1026)
- CISA-2026:1027 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1027)
- CISA-2026:1028 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1028)
- CISA-2026:1029 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1029)
- CISA-2026:1030 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1030)

Top CNAs:
- VulnCheck: 459
- GitHub, Inc.: 389
- Mozilla Corporation: 343
- Apple Inc.: 328
- Patchstack: 251
- Wordfence: 204
- VulDB: 165
- kernel.org: 129
- WPScan: 109
- Drupal.org: 106

Top Affected Products:
- UNKNOWN: 3324
- Google Chrome: 72
- Langflow: 33
- Microsoft Edge Chromium: 16
- Apple Macos: 14
- Semantic-mediawiki Semantic Mediawiki: 14
- Vllm: 8
- Mtrudel Bandit: 8
- Openpanel: 7
- Elastic Cloud Enterprise: 7

Top EPSS Score:
- CVE-2026-101210 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101210)
- CVE-2026-101214 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101214)
- CVE-2026-86379 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86379)
- CVE-2026-116505 - 2.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116505)
- CVE-2026-112351 - 2.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112351)
- CVE-2026-91913 - 2.65 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-91913)
- CVE-2026-119409 - 2.48 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-119409)
- CVE-2026-116485 - 2.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116485)
- CVE-2026-86394 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86394)
- CVE-2026-86395 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86395)

#ZEN #SecDB #InfoSec

📈 CVE Published in last 7 days (2026-10-26 - 2026-10-26)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 254
- High: 1007
- Medium: 1185
- Low: 189
- None: 1033

Status:
- : 23
- Analyzed: 151
- Awaiting Analysis: 1116
- Deferred: 1572
- Modified: 5
- Received: 408
- Rejected: 217
- Undergoing Analysis: 176

CISA KEVs:
- CISA-2026:1026 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1026)
- CISA-2026:1027 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1027)
- CISA-2026:1028 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1028)
- CISA-2026:1029 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1029)
- CISA-2026:1030 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1030)

Top CNAs:
- VulnCheck: 459
- GitHub, Inc.: 389
- Mozilla Corporation: 343
- Apple Inc.: 328
- Patchstack: 251
- Wordfence: 204
- VulDB: 165
- kernel.org: 129
- WPScan: 109
- Drupal.org: 106

Top Affected Products:
- UNKNOWN: 3324
- Google Chrome: 72
- Langflow: 33
- Microsoft Edge Chromium: 16
- Apple Macos: 14
- Semantic-mediawiki Semantic Mediawiki: 14
- Vllm: 8
- Mtrudel Bandit: 8
- Openpanel: 7
- Elastic Cloud Enterprise: 7

Top EPSS Score:
- CVE-2026-101210 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101210)
- CVE-2026-101214 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101214)
- CVE-2026-86379 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86379)
- CVE-2026-116505 - 2.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116505)
- CVE-2026-112351 - 2.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112351)
- CVE-2026-91913 - 2.65 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-91913)
- CVE-2026-119409 - 2.48 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-119409)
- CVE-2026-116485 - 2.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116485)
- CVE-2026-86394 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86394)
- CVE-2026-86395 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86395)

#ZEN #SecDB #InfoSec

📈 CVE Published in last 7 days (2026-10-26 - 2026-10-26)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 254
- High: 1007
- Medium: 1185
- Low: 189
- None: 1033

Status:
- : 23
- Analyzed: 151
- Awaiting Analysis: 1116
- Deferred: 1572
- Modified: 5
- Received: 408
- Rejected: 217
- Undergoing Analysis: 176

CISA KEVs:
- CISA-2026:1026 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1026)
- CISA-2026:1027 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1027)
- CISA-2026:1028 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1028)
- CISA-2026:1029 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1029)
- CISA-2026:1030 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1030)

Top CNAs:
- VulnCheck: 459
- GitHub, Inc.: 389
- Mozilla Corporation: 343
- Apple Inc.: 328
- Patchstack: 251
- Wordfence: 204
- VulDB: 165
- kernel.org: 129
- WPScan: 109
- Drupal.org: 106

Top Affected Products:
- UNKNOWN: 3324
- Google Chrome: 72
- Langflow: 33
- Microsoft Edge Chromium: 16
- Apple Macos: 14
- Semantic-mediawiki Semantic Mediawiki: 14
- Vllm: 8
- Mtrudel Bandit: 8
- Openpanel: 7
- Elastic Cloud Enterprise: 7

Top EPSS Score:
- CVE-2026-101210 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101210)
- CVE-2026-101214 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-101214)
- CVE-2026-86379 - 2.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86379)
- CVE-2026-116505 - 2.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116505)
- CVE-2026-112351 - 2.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-112351)
- CVE-2026-91913 - 2.65 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-91913)
- CVE-2026-119409 - 2.48 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-119409)
- CVE-2026-116485 - 2.35 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-116485)
- CVE-2026-86394 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86394)
- CVE-2026-86395 - 2.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-86395)

#ZEN #SecDB #InfoSec

Karen IT Security Response Center (@ksrc) Advisory

Advisory ID: KSRC-2026-11023

A #critical #vulnerability has been identified in #GitLab Community Edition (CE) and Enterprise Edition (EE) that allows an unauthenticated remote attacker to achieve Remote Code Execution (RCE) on the GitLab server. The vulnerability is tracked as CVE-2026-97229 and has been assigned a CVSS v3.1 score of 10.0 (Critical) — the maximum possible severity.

https://ksrc.karenit.net/blog/security-alert/critical-unauthenticated-remote-code-execution-in-gitlab-ce

#cve #cyberSecurity #staysafe #StayInformed #StayProtected

Tracked as CVE-2026-97229, this vulnerability stems from an integer overflow weakness and was discovered in the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration files. https://www.bleepingcomputer.com/news/security/over-1-000-gitlab-servers-vulnerable-to-code-execution-attacks/

🚨 More than 1,000 GitLab servers remain exposed to an actively exploited RCE flaw; CVE-2026-97229

The CVSS 10.0 vulnerability allows an unauthenticated attacker to execute arbitrary code through a malicious regular expression inside a CI/CD configuration.
⠀
• CVSS: 10.0
• Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2
• Fixed: 19.2.8, 19.3.5 and 19.4.2
• Active exploitation: Confirmed
⠀
CISA added the flaw to its Known Exploited Vulnerabilities catalog after attacks were detected.

Shadowserver is still tracking more than 1,000 vulnerable internet-facing instances.

Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

Mais de 1.000 servidores do GitLab permanecem expostos a ataques de execução de código. A falha CVE-2026-97229 permite que atacantes não autenticados assumam o controle das instâncias afetadas. 🚨

🔗 https://tugatech.com.pt/t93904-gitlab-tem-mais-de-1-000-servidores-expostos-a-ataques-ativos-de-execucao-de-codigo

#empresa #erro #falha #gitlab #vulnerabilidade 

The PostgreSQL project resolved 15 critical pgAdmin 4 vulnerabilities in version 9.19, fixing command injection flaw CVE-2026-116241 and credential leaks.

#pgAdmin4 #PostgreSQL #DatabaseSecurity #CVE2026116241 #RCE #Cybersecurity #Vulnerability #InfoSec

https://securityonline.info/pgadmin-4-vulnerabilities-fixed-9-19/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-116852 - Critical (9.1)

Author Remote Code Execution (RCE) in Widget Options &lt;= 4.2.5 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116852/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-116386 - Critical (9.8)

Unauthenticated Privilege Escalation in SMS Alert Order Notifications &lt;= 4.0.2 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-116386/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack