CVE-2026-14803: HIGH severity vuln in Mojo::JSON <9.47 — pure-Perl decoder allows uncontrolled recursion. Apps may face DoS if Cpanel::JSON::XS isn’t enabled. Install XS module or limit JSON depth. https://radar.offseq.com/threat/cve-2026-14803-cwe-674-uncontrolled-recursion-in-s-622d5e94b9c3bd9b #OffSeq #infosec #Perl #DoS

CVE-2026-14803: HIGH severity vuln in Mojo::JSON <9.47 — pure-Perl decoder allows uncontrolled recursion. Apps may face DoS if Cpanel::JSON::XS isn’t enabled. Install XS module or limit JSON depth. https://radar.offseq.com/threat/cve-2026-14803-cwe-674-uncontrolled-recursion-in-s-622d5e94b9c3bd9b #OffSeq #infosec #Perl #DoS

CVE-2026-59510: ail-framework ≤6.9.0 has a HIGH path traversal flaw 🗂️. Authenticated attackers can access sensitive files outside the PDF dir. Restrict PDF ops access & monitor activity. Patch when released. https://radar.offseq.com/threat/cve-2026-59510-cwe-22-improper-limitation-of-a-pat-adb7f29895187030 #OffSeq #vulnerability #pathtraversal

CVE-2026-59510: ail-framework ≤6.9.0 has a HIGH path traversal flaw 🗂️. Authenticated attackers can access sensitive files outside the PDF dir. Restrict PDF ops access & monitor activity. Patch when released. https://radar.offseq.com/threat/cve-2026-59510-cwe-22-improper-limitation-of-a-pat-adb7f29895187030 #OffSeq #vulnerability #pathtraversal

CVE-2026-59509 (CRITICAL): cve-search POST /fetch_cve_data allows unauth'd access to arbitrary MongoDB collections, exposing admin creds for offline cracking. Restrict endpoint, monitor activity, check vendor updates. https://radar.offseq.com/threat/ghsa-3fmp-59v6-4qw2-ddbb46f84ba1bbe2 #OffSeq #infosec #CVE202659509

CVE-2026-59509 (CRITICAL): cve-search POST /fetch_cve_data allows unauth'd access to arbitrary MongoDB collections, exposing admin creds for offline cracking. Restrict endpoint, monitor activity, check vendor updates. https://radar.offseq.com/threat/ghsa-3fmp-59v6-4qw2-ddbb46f84ba1bbe2 #OffSeq #infosec #CVE202659509

🟠 CVE-2026-12250 - High (7.9)

Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner allows Excavation.

This issue affects Pardus Domain Joiner: from 0.5.2 before 0.5.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-12250 - High (7.9)

Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner allows Excavation.

This issue affects Pardus Domain Joiner: from 0.5.2 before 0.5.4.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9085 - High (8.8)

Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing.

This issue affects Pardus-Parental-Control: from ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9085/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9085 - High (8.8)

Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing.

This issue affects Pardus-Parental-Control: from ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9085/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6509 - High (7.8)

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation.

This issue affects Pardus Update: from &lt;=0.6.3 before 0.6.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6509 - High (7.8)

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation.

This issue affects Pardus Update: from &lt;=0.6.3 before 0.6.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SQL injection (MEDIUM, CVE-2026-14751) in mjperpinosa stumasy: All versions at risk via Notes_controller::search_scratch_data. No patch yet, public exploit exists. Sanitize field_name & restrict access. Details: https://radar.offseq.com/threat/cve-2026-14751-sql-injection-in-mjperpinosa-stumas-6dc8c79135cda9b5 #OffSeq #SQLInjection #Vulnerability #AppSec

SQL injection (MEDIUM, CVE-2026-14751) in mjperpinosa stumasy: All versions at risk via Notes_controller::search_scratch_data. No patch yet, public exploit exists. Sanitize field_name & restrict access. Details: https://radar.offseq.com/threat/cve-2026-14751-sql-injection-in-mjperpinosa-stumas-6dc8c79135cda9b5 #OffSeq #SQLInjection #Vulnerability #AppSec

CVE-2026-14738 (MEDIUM, CVSS 6.3) impacts exo-explore exo ≤1.0.71. Weak hash in Vision Feature Cache, remote exploit released, high complexity. Patch pending. Review deployments & monitor for updates. https://radar.offseq.com/threat/cve-2026-14738-use-of-weak-hash-in-exo-explore-exo-d776a3211767a5cf #OffSeq #Vulnerability #CVE202614738 #Infosec

CVE-2026-14738 (MEDIUM, CVSS 6.3) impacts exo-explore exo ≤1.0.71. Weak hash in Vision Feature Cache, remote exploit released, high complexity. Patch pending. Review deployments & monitor for updates. https://radar.offseq.com/threat/cve-2026-14738-use-of-weak-hash-in-exo-explore-exo-d776a3211767a5cf #OffSeq #Vulnerability #CVE202614738 #Infosec

CVE-2026-14781 (MEDIUM): Red Hat Build of Keycloak flaw in OIDC broker email_verified claim sync. If trustEmail=true & userinfo enabled, attacker can mark emails as verified. Review config & monitor fixes. https://radar.offseq.com/threat/cve-2026-14781-improper-validation-of-consistency--d19be74f7ead5808 #OffSeq #Keycloak #Vuln #IAM

CVE-2026-14781 (MEDIUM): Red Hat Build of Keycloak flaw in OIDC broker email_verified claim sync. If trustEmail=true & userinfo enabled, attacker can mark emails as verified. Review config & monitor fixes. https://radar.offseq.com/threat/cve-2026-14781-improper-validation-of-consistency--d19be74f7ead5808 #OffSeq #Keycloak #Vuln #IAM

CVE-2026-14733 - SQLi in SourceCodester Class and Exam Timetabling System 1.0. Remote exploit via /edit_coursea.php ID parameter. CVSS 7.3. No patch available. Monitor systems now. #CVE #infosec #SourceCodester

https://www.valtersit.com/cve/CVE-2026-14733/

UTT HiPER 1250GW (v3.2.7-210907-180535) hit by HIGH severity stack buffer overflow (CVE-2026-14721). Remote code execution possible via 'ssid' in /goform/ConfigWirelessBase_5g. No patch — restrict access. https://radar.offseq.com/threat/cve-2026-14721-stack-based-buffer-overflow-in-utt--61b09d8093b25eb2 #OffSeq #CVE #Infosec #NetSec

🟠 CVE-2026-14721 - High (8.8)

A vulnerability has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects an unknown function of the file /goform/ConfigWirelessBase_5g of the component Web Endpoint. The manipulation of the argument ssid leads to stack-based buff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14721/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

UTT HiPER 1250GW (v3.2.7-210907-180535) hit by HIGH severity stack buffer overflow (CVE-2026-14721). Remote code execution possible via 'ssid' in /goform/ConfigWirelessBase_5g. No patch — restrict access. https://radar.offseq.com/threat/cve-2026-14721-stack-based-buffer-overflow-in-utt--61b09d8093b25eb2 #OffSeq #CVE #Infosec #NetSec

🟠 CVE-2026-14721 - High (8.8)

A vulnerability has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects an unknown function of the file /goform/ConfigWirelessBase_5g of the component Web Endpoint. The manipulation of the argument ssid leads to stack-based buff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14721/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-14570: HIGH severity in TIMLEGGE Crypt::DSA (<1.22) — insufficiently random values in DSA signing allow attackers to recover private keys using lattice attacks. Replace all affected keys and upgrade to 1.22+. https://radar.offseq.com/threat/cve-2026-14570-cwe-330-use-of-insufficiently-rando-539cd2ae349f5a7a #OffSeq #Vuln #Perl #Crypto

CVE-2026-14570: HIGH severity in TIMLEGGE Crypt::DSA (<1.22) — insufficiently random values in DSA signing allow attackers to recover private keys using lattice attacks. Replace all affected keys and upgrade to 1.22+. https://radar.offseq.com/threat/cve-2026-14570-cwe-330-use-of-insufficiently-rando-539cd2ae349f5a7a #OffSeq #Vuln #Perl #Crypto

SQL injection (MEDIUM severity) found in itsourcecode Hospital Management System 1.0 via 'editid' in /patientorder.php (CVE-2026-14703). No patch yet — enforce input validation & parameterized queries. https://radar.offseq.com/threat/cve-2026-14703-sql-injection-in-itsourcecode-hospi-f942c28e535ca531 #OffSeq #SQLInjection #Vuln #HealthcareIT

SQL injection (MEDIUM severity) found in itsourcecode Hospital Management System 1.0 via 'editid' in /patientorder.php (CVE-2026-14703). No patch yet — enforce input validation & parameterized queries. https://radar.offseq.com/threat/cve-2026-14703-sql-injection-in-itsourcecode-hospi-f942c28e535ca531 #OffSeq #SQLInjection #Vuln #HealthcareIT

CVE-2026-14691 (MEDIUM): SourceCodester Multi-Vendor Online Grocery Management System 1.0 is vulnerable to remote code injection via update_settings_info in SystemSettings.php. Exploit is public. Monitor & restrict access until fix released. https://radar.offseq.com/threat/cve-2026-14691-code-injection-in-sourcecodester-mu-dfa4f0d89d3ba2d7 #OffSeq #Vuln #AppSec

CVE-2026-14691 (MEDIUM): SourceCodester Multi-Vendor Online Grocery Management System 1.0 is vulnerable to remote code injection via update_settings_info in SystemSettings.php. Exploit is public. Monitor & restrict access until fix released. https://radar.offseq.com/threat/cve-2026-14691-code-injection-in-sourcecodester-mu-dfa4f0d89d3ba2d7 #OffSeq #Vuln #AppSec

🟠 CVE-2026-14637 - High (8.2)

A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element is the function getCartItems in the library application/libraries/ShoppingCart.php. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14637/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Two PHP flaws are patched. CVE-2026-12184 is a PHP remote DoS that crashes PHP-FPM, and CVE-2026-14355 causes memory corruption. Update PHP now.

#PHP #RemoteDoS #DoS #PHPFPM #CyberSecurity #Vulnerability #InfoSec

https://securityonline.info/php-remote-dos-cve-2026-12184/?utm_source=mastodon&utm_medium=jetpack_social

Two PHP flaws are patched. CVE-2026-12184 is a PHP remote DoS that crashes PHP-FPM, and CVE-2026-14355 causes memory corruption. Update PHP now.

#PHP #RemoteDoS #DoS #PHPFPM #CyberSecurity #Vulnerability #InfoSec

https://securityonline.info/php-remote-dos-cve-2026-12184/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-14534 - High (8.8)

Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard library modules _posixsubprocess, site, and atexit in the UNSAFE_IMPORTS denylist (fickle.py). Because these modules are absent from the denylist, fickli...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14534/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14535 - High (8.8)

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14535/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Here's a summary of the latest geopolitical, technology, and cybersecurity news:

Geopolitics: Russian President Putin and U.S. President Trump held a 90-minute call on July 4th. Russia claims to have captured Kostyantynivka in eastern Donetsk, Ukraine.
Technology: Grok 4.5 has entered private beta at SpaceX/Tesla. Meta plans to rent out its AI computing power. Micron is expanding high-bandwidth memory (HBM) production in Japan. Five Eyes alliance warns AI-fueled cyberattacks are "months away."
Cybersecurity: A critical "Bad Epoll" Linux kernel flaw (CVE-2026-46242) allows root access on Linux/Android. AI-automated JadePuffer ransomware has been detected. Lazarus Group is pushing 108 malicious packages.

#AnonNews_irc #Cybersecurity #News

Bad Epoll: Inside CVE-2026-46242, the Race Condition an AI Model Read Right Past

https://thecybersecguru.com/exploits/cve-2026-46242-bad-epoll-linux-vulnerability/

Here's a summary of the latest geopolitical, technology, and cybersecurity news:

Geopolitics: Russian President Putin and U.S. President Trump held a 90-minute call on July 4th. Russia claims to have captured Kostyantynivka in eastern Donetsk, Ukraine.
Technology: Grok 4.5 has entered private beta at SpaceX/Tesla. Meta plans to rent out its AI computing power. Micron is expanding high-bandwidth memory (HBM) production in Japan. Five Eyes alliance warns AI-fueled cyberattacks are "months away."
Cybersecurity: A critical "Bad Epoll" Linux kernel flaw (CVE-2026-46242) allows root access on Linux/Android. AI-automated JadePuffer ransomware has been detected. Lazarus Group is pushing 108 malicious packages.

#AnonNews_irc #Cybersecurity #News

Bad Epoll: Inside CVE-2026-46242, the Race Condition an AI Model Read Right Past

https://thecybersecguru.com/exploits/cve-2026-46242-bad-epoll-linux-vulnerability/

Bad Epoll (CVE-2026-46242) https://lobste.rs/s/drf6my #linux #security
https://github.com/J-jaeyoung/bad-epoll

🚨 Bad Epoll (CVE-2026-46242) has been identified as a notable vulnerability.

In the Linux kernel, the following vulnerability has been resolved:

eventpoll: fix ep_remove struct eventpoll / struct file UAF

ℹ️ Additional information on ZEN SecDB:

- BadEpoll: https://secdb.nttzen.cloud/updates/79198418-b310-4e40-80cd-d98ba3da0b2a/bad-epoll-vulnerability
- CVE details, sightings and advisories: https://secdb.nttzen.cloud/cve/detail/CVE-2026-46242

#InfoSec #BadEpoll #CVE202646242 #Linux #Kernel
#NTTDATA #Zen #SecDB #VulnerabilityIntelligence #Security

New “Bad Epoll” Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android

A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access…
#NewsBeep #News #US #USA #UnitedStates #UnitedStatesOfAmerica #Technology
https://www.newsbeep.com/us/742153/

CVE-2026-53360: Linux kernel KVM SEV-SNP HIGH vuln allows SEV-SNP guests OOB read/write on host heap memory 🐧. Heap corruption & info leaks possible. Patch status unclear — avoid untrusted guests & check advisories. https://radar.offseq.com/threat/ghsa-4pq2-jh73-g3hw-1f03f05c22f6fb26 #OffSeq #Linux #Vuln

CVE-2026-53360: Linux kernel KVM SEV-SNP HIGH vuln allows SEV-SNP guests OOB read/write on host heap memory 🐧. Heap corruption & info leaks possible. Patch status unclear — avoid untrusted guests & check advisories. https://radar.offseq.com/threat/ghsa-4pq2-jh73-g3hw-1f03f05c22f6fb26 #OffSeq #Linux #Vuln

CVE-2026-14622 – Missing Auth in Jairiidriss restaurant-website-php-mysql. AJAX endpoint /admin/ajax_files allows remote exploitation. CVSS 7.3. No patch available. Apply workarounds immediately. #CVE #infosec #cybersecurity

https://www.valtersit.com/cve/CVE-2026-14622/

🟠 CVE-2025-71369 - High (8.1)

picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods, allowing attackers to bypass safety checks. Remote attackers can embed undetected malicious code in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71369/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71343 - High (8.1)

picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce method. Attackers can craft malicious pickle files with embedded code that evades detection but execu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71343/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-54424 - High (8.4)

An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54424/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71353 - High (8.1)

picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get function in reduce methods. Attackers can craft pickle files with embedded code that evades picklescan detection and executes arbitr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71353/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71342 - High (8.1)

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in PyTorch ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71342/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71366 - High (8.1)

picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle files, allowing attackers to bypass safety checks. Remote attackers can embed undetected code in pickle files to achieve arbit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71364 - High (8.1)

picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execution. Attackers can craft malicious pickle files embedding this built-in function that ev...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71364/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71362 - High (8.1)

picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed malicious code in pickle files that executes when loaded from untrusted sources.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71375 - High (8.1)

picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. Attackers can craft malicious pickle payloads using _operator.methodcaller that evade detection and execute arbitr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71375/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71347 - High (8.1)

picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function in reduce methods, allowing attackers to bypass security checks. Remote attackers can embed undetected code in pickle files that exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71347/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71356 - High (8.1)

picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. Attackers can embed undetected code in pickle files that executes remote code when loaded ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71356/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-12252 - High (7.8)

In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These cla...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12252/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71380 - High (8.8)

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71380/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71373 - High (8.1)

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71373/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71372 - High (8.1)

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded, bypa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71367 - High (8.1)

picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using _operator.attrgetter in reduce methods to execut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71367/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71360 - High (8.1)

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71360/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71359 - High (8.1)

picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code execution. Attackers can craft pickle files embedding dangerous code that evades pickles...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71359/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71345 - High (8.1)

picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd_prof function. Attackers can embed undetected code in pickle files that executes during deserialization, enabling remote code ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71345/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-58286 - Improper access control in Microsoft Edge enables network spoofing attacks. CVSS 8.1. No patch yet. Restrict browser use until fixed. #CVE #MicrosoftEdge #infosec

https://www.valtersit.com/cve/CVE-2026-58286/

🟠 CVE-2026-58286 - High (8.1)

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58286 - High (8.1)

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57985 - High (7.6)

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57985/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57985 - High (7.6)

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57985/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58290 - High (7.5)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58290 - High (7.5)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-58289 - Critical (9)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-58289 - Critical (9)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58289/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58288 - High (8.3)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58288 - High (8.3)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58285 - High (8.3)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58285 - High (8.3)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58284 - High (8.3)

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58284 - High (8.3)

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58294 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58294/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58294 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58294/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58293 - High (8.1)

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58293/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58293 - High (8.1)

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58293/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-12481 - High (8.8)

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12481/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-12481 - High (8.8)

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-12481/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57992 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57992/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57992 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57992/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57984 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57984/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57984 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57984/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57983 - High (8.7)

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57983/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57983 - High (8.7)

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57983/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57981 - High (8.8)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57981/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57981 - High (8.8)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57981/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14606 - High (7.8)

A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CAN_Receive in the library bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Handler. Performing a manipula...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14606/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58423 - High (7.7)

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58423/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58299 - High (7.5)

Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58299/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58299 - High (7.5)

Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58299/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-58295 - Type confusion in Microsoft Edge (Chromium-based). CVSS 8.3. Network-based security feature bypass. Patch status unknown. Monitor for updates. #CVE #MicrosoftEdge #infosec

https://www.valtersit.com/cve/CVE-2026-58295/

🟠 CVE-2026-58295 - High (8.3)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58295/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58295 - High (8.3)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58295/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58292 - High (7.5)

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58292/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58287 - High (8.3)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58287 - High (8.3)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58283 - High (8.1)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58283 - High (8.1)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58282 - High (8.1)

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-58282 - High severity spoofing in Microsoft Edge (Chromium-based). Improper access control. CVSS 8.1. Apply mitigations or restrict usage. #CVE #Microsoft #infosec

https://www.valtersit.com/cve/CVE-2026-58282/

🟠 CVE-2026-58282 - High (8.1)

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58276 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58276/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58276 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58276/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57986 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57986/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57986 - High (7.5)

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57986/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57975 - High (7.5)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57975/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57975 - High (7.5)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57975/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57974 - High (8.8)

Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57974 - High (8.8)

Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57974/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56645 - High (8.8)

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56645 - High (8.8)

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28744 - High (8.1)

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28744 - High (8.1)

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28737 - High (8.7)

Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28737/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28737 - High (8.7)

Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28737/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28699 - High (8.1)

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28699/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-28699 - High (8.1)

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28699/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26231 - High (8.5)

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26231/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-26231 - High (8.5)

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26231/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22874 - Critical (9.6)

Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22874/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-22874 - Critical (9.6)

Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22874/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22555 - High (8.1)

Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22555/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22555 - High (8.1)

Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22555/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14605 - High (7.8)

A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the function recvmsg in the library bsp/loongson/ls1cdev/libraries/ls1c_can.h of the component ls1c CAN Handler. Such manipulation leads to stack-based buff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14605/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-49814 - High-severity OS Command Injection in Dell PowerProtect Data Domain. CVSS 7.2. High-privileged remote attacker can execute arbitrary commands. Patch status unknown. Monitor for updates. #CVE #Dell #infosec

https://www.valtersit.com/cve/CVE-2026-49814/

🟠 CVE-2026-14460 - High (8.8)

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection.

This issue affects pardus-software: from &lt;= 1.0.4 before 1.0.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14460/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14459 - High (8.8)

Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection.

This issue affects pardus-software: from &lt;= ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14459/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

KongHQ mcp-konnect (<1.0.0) has a HIGH severity flaw (CVE-2026-13341, CVSS 7.4) allowing remote prompt injection with risk to confidentiality. No patch — monitor vendor updates. https://radar.offseq.com/threat/cve-2026-13341-cwe-20-improper-input-validation-in-a1d90aa86cfef676 #OffSeq #KongHQ #Infosec #Vulnerability

🟠 CVE-2026-10055 - High (8.5)

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10055/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Server-Side Request Forgery (SSRF) in Eclipse Theia 1.26.0 (CVE-2026-10055, HIGH, CVSS 8.5). Attackers with access to the service connection can target internal resources. Restrict access now. https://radar.offseq.com/threat/cve-2026-10055-cwe-918-server-side-request-forgery-66116bce3c83a4f6 #OffSeq #SSRF #EclipseTheia #Cybersecurity

🔴 CVE-2026-4321 - Critical (9.8)

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows SQL Injection.

This issue affects Destekz: through 02062026. NOTE: The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4321/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4321 - Critical (9.8)

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows SQL Injection.

This issue affects Destekz: through 02062026. NOTE: The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4321/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-14544 - Critical (9.8)

A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalate privileges or achieve arbitrary code execution. This can occur through an integer ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-14544 - Critical (9.8)

A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalate privileges or achieve arbitrary code execution. This can occur through an integer ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-14544: CRITICAL integer overflow in HPLIP (RHEL 10) enables remote code execution or privilege escalation via crafted print data 🖨️. Patch status not confirmed. Stay updated: https://radar.offseq.com/threat/cve-2026-14544-integer-overflow-or-wraparound-in-r-d57463ec7bf8b710 #OffSeq #CVE202614544 #LinuxSecurity

🟠 CVE-2026-4967 - High (7.5)

In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4967/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4967 - High (7.5)

In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4967/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-9725 - Critical (9.1)

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, whic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9725/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-9725 - Critical (9.1)

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, whic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9725/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: CVE-2026-9725 in Printcart Web to Print Product Designer for WooCommerce ≤2.5.2 enables unauthenticated file deletion via path traversal. No patch yet — restrict AJAX endpoints & monitor logs. https://radar.offseq.com/threat/cve-2026-9725-cwe-22-improper-limitation-of-a-path-a96c709af943903a #OffSeq #WordPress #CVE2026_9725 #PathTraversal

🟠 CVE-2026-14352 - High (7.5)

The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14352 - High (7.5)

The AR for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44941 - High (8.4)

A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-14424: HIGH severity use-after-free in Chrome (Mac <150.0.7871.46) enables sandbox escape via crafted HTML. Update to 150.0.7871.46+ now. https://radar.offseq.com/threat/cve-2026-14424-use-after-free-in-google-chrome-1a17c58d72224f47 #OffSeq #Chrome #Infosec #Vuln

CVE-2026-14417: CRITICAL use-after-free in Chrome’s Dawn (pre-150.0.7871.46). Remote attackers can potentially escape the sandbox — patch ASAP. Details: https://radar.offseq.com/threat/cve-2026-14417-use-after-free-in-google-chrome-b3887b8e713f2d29 #OffSeq #Chrome #CVE202614417 #Infosec

🔴 CVE-2026-14417 - Critical (9.6)

Use after free in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14417/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-14416 - Critical (9.6)

Out of bounds read in Dawn in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14416/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14327 - High (7.5)

The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14327/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14327 - High (7.5)

The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary fi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14327/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-13768 - Critical (10)

Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-13768 - Critical (10)

Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-13768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-13768: Gardyn Home Firmware (CRITICAL, CVSS 10) exposes a privileged iothubowner key, enabling attackers to control devices & move laterally on networks. No patch yet. Monitor and segment IoT devices. https://radar.offseq.com/threat/cve-2026-13768-cwe-798-in-gardyn-gardyn-home-firmw-08332214fc38f3ba #OffSeq #IoTSecurity #CVE202613768

🔴 CVE-2026-41106 - Critical (9.3)

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-41106 - Critical (9.3)

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41106/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45499 - Critical (9.9)

Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45499/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

WatchGuard Patches Third Critical IKEv2 RCE in Firebox Appliances

WatchGuard patched a critical pre-authentication RCE vulnerability (CVE-2026-13368) in Firebox appliances. The vulnerability allows unauthenticated attackers to gain administrative control. Legacy T15 and T35 models currently do not have a patch.

**If you use WatchGuard Firebox firewalls, read the advisory in detail. Plan a very quick update to Fireware OS 2026.2.1 or 12.12.1. If you run legacy T15/T35 models, disable external LDAP authentication for IKEv2 as a temporary fix, and if you're on version 11.x, migrate to supported hardware since no patch is coming.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/watchguard-patches-third-critical-ikev2-rce-in-firebox-appliances-l-z-o-j-u/gD2P6Ple2L

WatchGuard Patches Third Critical IKEv2 RCE in Firebox Appliances

WatchGuard patched a critical pre-authentication RCE vulnerability (CVE-2026-13368) in Firebox appliances. The vulnerability allows unauthenticated attackers to gain administrative control. Legacy T15 and T35 models currently do not have a patch.

**If you use WatchGuard Firebox firewalls, read the advisory in detail. Plan a very quick update to Fireware OS 2026.2.1 or 12.12.1. If you run legacy T15/T35 models, disable external LDAP authentication for IKEv2 as a temporary fix, and if you're on version 11.x, migrate to supported hardware since no patch is coming.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/watchguard-patches-third-critical-ikev2-rce-in-firebox-appliances-l-z-o-j-u/gD2P6Ple2L

WatchGuard Firebox vulnerabilities include a critical unauthenticated RCE (CVE-2026-13368, CVSS 9.2) plus six more Fireware OS flaws. Patch now.

#WatchGuard #Firebox #CVE202613368 #FirewareOS #CyberSecurity

https://securityonline.info/watchguard-firebox-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-13368 (CRITICAL, CVSS 9.2): WatchGuard Fireware OS LDAP auth flaw in Mobile VPN with IKEv2 allows remote code execution (iked process). Disable affected configs or restrict access until patch. https://radar.offseq.com/threat/cve-2026-13368-cwe-416-use-after-free-in-watchguar-10bc07017e60512c #OffSeq #WatchGuard #CVE202613368 #Infosec

🔴 CVE-2026-57100 - Critical (9.9)

Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-54998 - High (8.8)

Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54998/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

A public PoC is available for CVE-2026-57517, a critical CVSS 9.8 Control Web Panel SQLi flaw allowing unauthenticated remote code execution.

#CVE202657517 #ControlWebPanel #SQLInjection #CyberSecurity #Vulnerability

https://securityonline.info/cve-2026-57517-control-web-panel-sqli/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-59099 - Critical (9.1)

Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59099/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-58460 - High (7.7)

react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-resident malicious application to write files outside the intended cache directory by supplying a crafted _display_name value containing dot-dot path comp...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58460/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-52830 - Critical (9.4)

fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject pa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-52830/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-58455 - Critical (9.8)

Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58455/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14430 - High (8.8)

Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14430/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last days (2026-06-29 - 2026-06-29)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 195
- High: 612
- Medium: 729
- Low: 114
- None: 230

Status:
- : 68
- Analyzed: 534
- Awaiting Analysis: 109
- Deferred: 568
- Modified: 39
- Received: 443
- Rejected: 6
- Undergoing Analysis: 113

CISA KEVs:
- CISA-2026:0629 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0629)
- CISA-2026:0701 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0701)

Top CNAs:
- Chrome: 434
- VulnCheck: 177
- VulDB: 162
- Patchstack: 125
- Wordfence: 96
- GitHub, Inc.: 81
- N/A: 68
- Microsoft Corporation: 49
- IBM Corporation: 43
- Gitea Limited: 40

Top Affected Products:
- UNKNOWN: 1234
- Google Chrome: 401
- Geovision Inc. Geowebplayer: 16
- Imagemagick: 13
- Langflow: 11
- Nvidia Nemo Megatron Bridge: 11
- Adobe Coldfusion: 10
- Uvnc Ultravnc: 9
- Apache Activemq: 9
- Ibm Websphere Application Server: 8

Top EPSS Score:
- CVE-2026-27771 - 40.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27771)
- CVE-2026-13773 - 3.41 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13773)
- CVE-2026-56413 - 3.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56413)
- CVE-2026-56415 - 3.07 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56415)
- CVE-2026-56782 - 3.02 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56782)
- CVE-2026-13545 - 2.71 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13545)
- CVE-2026-58452 - 2.42 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58452)
- CVE-2026-58453 - 1.69 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58453)
- CVE-2026-56700 - 1.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56700)
- CVE-2026-58457 - 1.67 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58457)

#ZEN #SecDB #InfoSec

📈 CVE Published in last days (2026-06-29 - 2026-06-29)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 195
- High: 612
- Medium: 729
- Low: 114
- None: 230

Status:
- : 68
- Analyzed: 534
- Awaiting Analysis: 109
- Deferred: 568
- Modified: 39
- Received: 443
- Rejected: 6
- Undergoing Analysis: 113

CISA KEVs:
- CISA-2026:0629 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0629)
- CISA-2026:0701 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0701)

Top CNAs:
- Chrome: 434
- VulnCheck: 177
- VulDB: 162
- Patchstack: 125
- Wordfence: 96
- GitHub, Inc.: 81
- N/A: 68
- Microsoft Corporation: 49
- IBM Corporation: 43
- Gitea Limited: 40

Top Affected Products:
- UNKNOWN: 1234
- Google Chrome: 401
- Geovision Inc. Geowebplayer: 16
- Imagemagick: 13
- Langflow: 11
- Nvidia Nemo Megatron Bridge: 11
- Adobe Coldfusion: 10
- Uvnc Ultravnc: 9
- Apache Activemq: 9
- Ibm Websphere Application Server: 8

Top EPSS Score:
- CVE-2026-27771 - 40.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27771)
- CVE-2026-13773 - 3.41 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13773)
- CVE-2026-56413 - 3.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56413)
- CVE-2026-56415 - 3.07 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56415)
- CVE-2026-56782 - 3.02 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56782)
- CVE-2026-13545 - 2.71 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13545)
- CVE-2026-58452 - 2.42 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58452)
- CVE-2026-58453 - 1.69 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58453)
- CVE-2026-56700 - 1.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56700)
- CVE-2026-58457 - 1.67 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58457)

#ZEN #SecDB #InfoSec

IBM WebSphere vulnerabilities like CVE-2026-11712 expose servers to severe XSS and path traversal attacks. Patch systems immediately.

#IBM #WebSphere #CyberSecurity #CVE202611712

https://securityonline.info/ibm-websphere-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

IBM WebSphere vulnerabilities like CVE-2026-11712 expose servers to severe XSS and path traversal attacks. Patch systems immediately.

#IBM #WebSphere #CyberSecurity #CVE202611712

https://securityonline.info/ibm-websphere-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-56004 - Critical (10)

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56004/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last days (2026-06-29 - 2026-06-29)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 195
- High: 612
- Medium: 729
- Low: 114
- None: 230

Status:
- : 68
- Analyzed: 534
- Awaiting Analysis: 109
- Deferred: 568
- Modified: 39
- Received: 443
- Rejected: 6
- Undergoing Analysis: 113

CISA KEVs:
- CISA-2026:0629 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0629)
- CISA-2026:0701 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0701)

Top CNAs:
- Chrome: 434
- VulnCheck: 177
- VulDB: 162
- Patchstack: 125
- Wordfence: 96
- GitHub, Inc.: 81
- N/A: 68
- Microsoft Corporation: 49
- IBM Corporation: 43
- Gitea Limited: 40

Top Affected Products:
- UNKNOWN: 1234
- Google Chrome: 401
- Geovision Inc. Geowebplayer: 16
- Imagemagick: 13
- Langflow: 11
- Nvidia Nemo Megatron Bridge: 11
- Adobe Coldfusion: 10
- Uvnc Ultravnc: 9
- Apache Activemq: 9
- Ibm Websphere Application Server: 8

Top EPSS Score:
- CVE-2026-27771 - 40.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27771)
- CVE-2026-13773 - 3.41 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13773)
- CVE-2026-56413 - 3.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56413)
- CVE-2026-56415 - 3.07 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56415)
- CVE-2026-56782 - 3.02 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56782)
- CVE-2026-13545 - 2.71 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13545)
- CVE-2026-58452 - 2.42 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58452)
- CVE-2026-58453 - 1.69 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58453)
- CVE-2026-56700 - 1.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56700)
- CVE-2026-58457 - 1.67 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58457)

#ZEN #SecDB #InfoSec

📈 CVE Published in last days (2026-06-29 - 2026-06-29)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs:

Severity:
- Critical: 195
- High: 612
- Medium: 729
- Low: 114
- None: 230

Status:
- : 68
- Analyzed: 534
- Awaiting Analysis: 109
- Deferred: 568
- Modified: 39
- Received: 443
- Rejected: 6
- Undergoing Analysis: 113

CISA KEVs:
- CISA-2026:0629 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0629)
- CISA-2026:0701 (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0701)

Top CNAs:
- Chrome: 434
- VulnCheck: 177
- VulDB: 162
- Patchstack: 125
- Wordfence: 96
- GitHub, Inc.: 81
- N/A: 68
- Microsoft Corporation: 49
- IBM Corporation: 43
- Gitea Limited: 40

Top Affected Products:
- UNKNOWN: 1234
- Google Chrome: 401
- Geovision Inc. Geowebplayer: 16
- Imagemagick: 13
- Langflow: 11
- Nvidia Nemo Megatron Bridge: 11
- Adobe Coldfusion: 10
- Uvnc Ultravnc: 9
- Apache Activemq: 9
- Ibm Websphere Application Server: 8

Top EPSS Score:
- CVE-2026-27771 - 40.74 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27771)
- CVE-2026-13773 - 3.41 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13773)
- CVE-2026-56413 - 3.08 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56413)
- CVE-2026-56415 - 3.07 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56415)
- CVE-2026-56782 - 3.02 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56782)
- CVE-2026-13545 - 2.71 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-13545)
- CVE-2026-58452 - 2.42 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58452)
- CVE-2026-58453 - 1.69 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58453)
- CVE-2026-56700 - 1.68 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-56700)
- CVE-2026-58457 - 1.67 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-58457)

#ZEN #SecDB #InfoSec

A critical IBM Db2 RCE flaw (CVE-2026-10109) allows pre-auth code execution. IBM patched it plus two other Db2 bugs. Update 11.5 and 12.1 now.

https://securityonline.info/ibm-db2-rce-cve-2026-10109/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-57683: CRITICAL SQL injection (CVSS 9.3) in Epsiloncool WP Fast Total Search ≤1.80.280 enables unauthenticated exploitation. Patch pending — monitor for fixes and restrict access. https://radar.offseq.com/threat/cve-2026-57683-cwe-89-improper-neutralization-of-s-608880638f90634f #OffSeq #WordPress #Infosec #Vuln

🟠 CVE-2026-55112 - High (7.5)

A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55112/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56842 - High (7.5)

A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UniFi Network Application to persist privileges within UniFi Network Application after such access had been r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56842/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56841 - High (8.8)

A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application to escalate privileges on the host device.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56841/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

@cR0w ../ spotted!

Summary 7 of 25

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.

CVE-2026-54403

CVE-2026-5524: Divi Form Builder <=5.1.8 has a CRITICAL file upload vuln (CVSS 9.8). Unauth RCE possible via PHP extensions not blocked by .htaccess, esp. on Nginx. Restrict uploads, monitor for patch. https://radar.offseq.com/threat/cve-2026-5524-cwe-434-unrestricted-upload-of-file--ef397843e92862b0 #OffSeq #WordPress #Infosec #CVE2026_5524

Unprivileged root via an out-of-bounds write in the FUSE readdir cache (CVE-2026-31694) https://lobste.rs/s/0kc445 #linux #security
https://cyberstan.co.uk/fuse-readdir-oob/

🤖 Researchers at runZero say AI-assisted testing found 7 security flaws in the FatFs FAT/exFAT filesystem library (CVE-2026-6682 to CVE-2026-6688), potentially exposing millions of embedded devices via malicious USB drives/SD cards—and sometimes OTA update paths. 🔓📉 https://cyberinsider.com/ai-helps-find-flaws-in-fatfs-library-used-in-millions-of-devices/ #cybersecurity #IoT #vulnerabilities #embedded

🤖 Researchers at runZero say AI-assisted testing found 7 security flaws in the FatFs FAT/exFAT filesystem library (CVE-2026-6682 to CVE-2026-6688), potentially exposing millions of embedded devices via malicious USB drives/SD cards—and sometimes OTA update paths. 🔓📉 https://cyberinsider.com/ai-helps-find-flaws-in-fatfs-library-used-in-millions-of-devices/ #cybersecurity #IoT #vulnerabilities #embedded