CVE-2026-78676 | GitPython <3.1.59 has a CRITICAL argument injection flaw: multi-line git-config values can become active directives, enabling arbitrary code execution via git hooks. Patch status unknown — avoid untrusted configs. https://radar.offseq.com/threat/cve-2026-78676-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-in-98aef85f24190fbe #OffSeq #CVE202678676 #git #infosec

CVE-2026-78676 | GitPython <3.1.59 has a CRITICAL argument injection flaw: multi-line git-config values can become active directives, enabling arbitrary code execution via git hooks. Patch status unknown — avoid untrusted configs. https://radar.offseq.com/threat/cve-2026-78676-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-in-98aef85f24190fbe #OffSeq #CVE202678676 #git #infosec

CVE-2026-32556 - Unauthenticated XSS in Boost <= 2.0.4. CVSS 7.1. Currently unpatched. Audit systems and mitigate risk immediately. #CVE #XSS #infosec

https://www.valtersit.com/cve/CVE-2026-32556/

CVE-2026-32556 - Unauthenticated XSS in Boost <= 2.0.4. CVSS 7.1. Currently unpatched. Audit systems and mitigate risk immediately. #CVE #XSS #infosec

https://www.valtersit.com/cve/CVE-2026-32556/

CVE-2026-78267 (CRITICAL, CVSS 9.8): Cozmoslabs TranslatePress <=3.3.2 is vulnerable to unauthenticated privilege escalation (CWE-266). No patch yet — monitor vendor advisories for updates. https://radar.offseq.com/threat/cve-2026-78267-cwe-266-incorrect-privilege-assignment-in-cozmoslabs-translatepress-ba0caba45d17d814 #OffSeq #WordPress #Vuln #PrivilegeEscalation

🔴 CVE-2026-78267 - Critical (9.8)

Unauthenticated Privilege Escalation in TranslatePress &lt;= 3.3.2 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78267/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-78267 (CRITICAL, CVSS 9.8): Cozmoslabs TranslatePress <=3.3.2 is vulnerable to unauthenticated privilege escalation (CWE-266). No patch yet — monitor vendor advisories for updates. https://radar.offseq.com/threat/cve-2026-78267-cwe-266-incorrect-privilege-assignment-in-cozmoslabs-translatepress-ba0caba45d17d814 #OffSeq #WordPress #Vuln #PrivilegeEscalation

🔴 CVE-2026-78267 - Critical (9.8)

Unauthenticated Privilege Escalation in TranslatePress &lt;= 3.3.2 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78267/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78268 - High (7.5)

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads &lt;= 1.2.0 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78268 - High (7.5)

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads &lt;= 1.2.0 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78284 - High (8.6)

Unauthenticated Arbitrary File Deletion in MasterStudy LMS &lt;= 3.7.42 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78284 - High (8.6)

Unauthenticated Arbitrary File Deletion in MasterStudy LMS &lt;= 3.7.42 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL CVE-2026-78265: Nexcess The Events Calendar <=6.17.2 has unauthenticated PHP Object Injection (CWE-502). Full system compromise possible. No patch yet — remove or disable plugin for now. https://radar.offseq.com/threat/cve-2026-78265-cwe-502-deserialization-of-untrusted-data-in-nexcess-the-events-calendar-3dd3af18547313e0 #OffSeq #WordPress #Infosec #CVE2026_78265

🔴 CVE-2026-78265 - Critical (9.8)

Unauthenticated PHP Object Injection in The Events Calendar &lt;= 6.17.2 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78265/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL CVE-2026-78265: Nexcess The Events Calendar <=6.17.2 has unauthenticated PHP Object Injection (CWE-502). Full system compromise possible. No patch yet — remove or disable plugin for now. https://radar.offseq.com/threat/cve-2026-78265-cwe-502-deserialization-of-untrusted-data-in-nexcess-the-events-calendar-3dd3af18547313e0 #OffSeq #WordPress #Infosec #CVE2026_78265

🔴 CVE-2026-78265 - Critical (9.8)

Unauthenticated PHP Object Injection in The Events Calendar &lt;= 6.17.2 versions.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78265/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

i uSe lInUx bEcAuSe iT'S SeCuRe.

https://access.redhat.com/security/cve/cve-2026-19685

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.

i uSe lInUx bEcAuSe iT'S SeCuRe.

https://access.redhat.com/security/cve/cve-2026-19685

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.

🟠 CVE-2026-19568 - High (7.8)

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19568/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19568 - High (7.8)

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19568/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7455 - High (7.8)

A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the conte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7455/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7455 - High (7.8)

A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the conte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7455/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61419 - High (7.8)

Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61419/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-61419 - High (7.8)

Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61419/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16783 - High (7.8)

A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the conte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16783/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16783 - High (7.8)

A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the conte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16783/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71366 - High (7.7)

A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without valid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71366 - High (7.7)

A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without valid...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77567 - High (8.1)

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77567/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77567 - High (8.1)

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77567/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

TP-Link patched an unauthenticated OS command injection flaw (CVE-2026-9254) and other risks like CVE-2026-16348 and CVE-2026-78541 in Archer routers.

#TPLink #CyberSecurity #CVE20269254 #CommandInjection

https://securityonline.info/cve-2026-9254-unauthenticated-os-command-injection/?utm_source=mastodon&utm_medium=jetpack_social

TP-Link patched an unauthenticated OS command injection flaw (CVE-2026-9254) and other risks like CVE-2026-16348 and CVE-2026-78541 in Archer routers.

#TPLink #CyberSecurity #CVE20269254 #CommandInjection

https://securityonline.info/cve-2026-9254-unauthenticated-os-command-injection/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-63310 - MITM package injection flaw in NLTK downloader module. CVSS 7.1. Update NLTK to 3.9.3+ immediately. #CVE #Python #infosec

https://www.valtersit.com/cve/CVE-2026-63310/

CVE-2026-63310: NLTK <3.9.3 has a CRITICAL flaw where package integrity isn't checked post-download in the downloader module. Exposes users to MITM & DNS poisoning attacks. Upgrade to 3.9.3+ or avoid insecure networks. https://radar.offseq.com/threat/nltk-before-393-fails-to-verify-file-integrity-after-downloading-packages-and-before-extraction-in-the-f6492d4a6dda17c2 #OffSeq #NLTK #CVE202663310 #infosec

CVE-2026-63310 - MITM package injection flaw in NLTK downloader module. CVSS 7.1. Update NLTK to 3.9.3+ immediately. #CVE #Python #infosec

https://www.valtersit.com/cve/CVE-2026-63310/

CVE-2026-63310: NLTK <3.9.3 has a CRITICAL flaw where package integrity isn't checked post-download in the downloader module. Exposes users to MITM & DNS poisoning attacks. Upgrade to 3.9.3+ or avoid insecure networks. https://radar.offseq.com/threat/nltk-before-393-fails-to-verify-file-integrity-after-downloading-packages-and-before-extraction-in-the-f6492d4a6dda17c2 #OffSeq #NLTK #CVE202663310 #infosec

🟠 CVE-2026-61824 - High (8.2)

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-61824/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-60084 - High (8.7)

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-60084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-60084 - High (8.7)

SiYuan versions before v3.7.4 contain an arbitrary file deletion vulnerability in the /api/search/removeTemplate endpoint that accepts an unvalidated path parameter passed directly to os.RemoveAll. Authenticated admin attackers can supply absolute...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-60084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Metal Gear Online 3 RCE vulnerability CVE-2026-19874 fixed. Update the game to prevent attackers from executing remote code on your system.

#MetalGearOnline3 #CyberSecurity #Vulnerability #CVE202619874

https://securityonline.info/metal-gear-online-3-rce-cve-2026-19874/?utm_source=mastodon&utm_medium=jetpack_social

Metal Gear Online 3 RCE vulnerability CVE-2026-19874 fixed. Update the game to prevent attackers from executing remote code on your system.

#MetalGearOnline3 #CyberSecurity #Vulnerability #CVE202619874

https://securityonline.info/metal-gear-online-3-rce-cve-2026-19874/?utm_source=mastodon&utm_medium=jetpack_social

CISA warned that the CVE-2026-21962 Oracle flaw with a CVSS 10 score is actively exploited in the wild. Patch Oracle Fusion Middleware systems now.

#Oracle #CVE202621962 #CyberSecurity #CISA #Vulnerability

https://securityonline.info/cve-2026-21962-oracle-flaw/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0824] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0824)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-21962 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21962)
- Name: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Oracle
- Product: HTTP Server and Oracle Weblogic Server Proxy Plug-in
- Notes: https://www.oracle.com/security-alerts/cpujan2026.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21962

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260824 #cisa20260824 #cve_2026_21962 #cve202621962

CVE ID: CVE-2026-21962
Vendor: Oracle
Product: HTTP Server and Oracle Weblogic Server Proxy Plug-in
Date Added: 2026-08-24
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21962

CISA warned that the CVE-2026-21962 Oracle flaw with a CVSS 10 score is actively exploited in the wild. Patch Oracle Fusion Middleware systems now.

#Oracle #CVE202621962 #CyberSecurity #CISA #Vulnerability

https://securityonline.info/cve-2026-21962-oracle-flaw/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0824] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0824)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-21962 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-21962)
- Name: Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Oracle
- Product: HTTP Server and Oracle Weblogic Server Proxy Plug-in
- Notes: https://www.oracle.com/security-alerts/cpujan2026.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-21962

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260824 #cisa20260824 #cve_2026_21962 #cve202621962

CVE ID: CVE-2026-21962
Vendor: Oracle
Product: HTTP Server and Oracle Weblogic Server Proxy Plug-in
Date Added: 2026-08-24
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21962

CVE-2026-7808 | justhtml <1.16.0 faces CRITICAL XSS risk via HTML sanitization bypass in advanced use cases. Upgrade to 1.16.0+ to fix. Impacts apps with custom/mutated policies. Details: https://radar.offseq.com/threat/cve-2026-7808-improper-input-validation-in-emilstenstrom-justhtml-86dd54d29e0645e9 #OffSeq #CVE20267808 #infosec #XSS

🔴 CVE-2026-7808 - Critical (9.8)

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7808/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-7808 | justhtml <1.16.0 faces CRITICAL XSS risk via HTML sanitization bypass in advanced use cases. Upgrade to 1.16.0+ to fix. Impacts apps with custom/mutated policies. Details: https://radar.offseq.com/threat/cve-2026-7808-improper-input-validation-in-emilstenstrom-justhtml-86dd54d29e0645e9 #OffSeq #CVE20267808 #infosec #XSS

🔴 CVE-2026-7808 - Critical (9.8)

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7808/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76070 - Critical (9.8)

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76070/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76070 - Critical (9.8)

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76070/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-68766 - Code execution in hashcat. Command-line option injection via restore files enables arbitrary file writes. CVSS 7.8. Avoid untrusted restore files. #CVE #hashcat #infosec

https://www.valtersit.com/cve/CVE-2026-68766/

🟠 CVE-2026-68766 - High (7.8)

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-contr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68766/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-68766 - High (7.8)

hashcat fails to restrict command-line options when parsing restore files, allowing attackers to inject output-redirecting options like --outfile and --potfile-path. Attackers can craft restore files with malicious options to append attacker-contr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-68766/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-63312 - Arbitrary local file read in NLTK StreamBackedCorpusView bypasses pathsec. CVSS 7.5. Exposes sensitive system files. Update to NLTK 3.10.0+. #CVE #Python #infosec

https://www.valtersit.com/cve/CVE-2026-63312/

🟠 CVE-2026-63312 - High (7.5)

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63312/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-63312 - Arbitrary local file read in NLTK StreamBackedCorpusView bypasses pathsec. CVSS 7.5. Exposes sensitive system files. Update to NLTK 3.10.0+. #CVE #Python #infosec

https://www.valtersit.com/cve/CVE-2026-63312/

🟠 CVE-2026-63312 - High (7.5)

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63312/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76835 - Critical (9.1)

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/ut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76835/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76835 - Critical (9.1)

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/ut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76835/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76838 - High (8.5)

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserved ranges...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76838 - High (8.5)

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserved ranges...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76838/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76071 - Critical (9.8)

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-76071 - Critical (9.8)

Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76073 - High (8.8)

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76073/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76073 - High (8.8)

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76073/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9769 - High (7.5)

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9769 - High (7.5)

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() unconditionally calls _populate_selectedcontent(), which recursively traverses the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9769/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

TP-Link patched an unauthenticated OS command injection flaw (CVE-2026-9254) and other risks like CVE-2026-16348 and CVE-2026-78541 in Archer routers.

#TPLink #CyberSecurity #CVE20269254 #CommandInjection

https://securityonline.info/cve-2026-9254-unauthenticated-os-command-injection/?utm_source=mastodon&utm_medium=jetpack_social

TP-Link patched an unauthenticated OS command injection flaw (CVE-2026-9254) and other risks like CVE-2026-16348 and CVE-2026-78541 in Archer routers.

#TPLink #CyberSecurity #CVE20269254 #CommandInjection

https://securityonline.info/cve-2026-9254-unauthenticated-os-command-injection/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-78170 - High (8.8)

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78170/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78170 - High (8.8)

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78170/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

TP-Link patched an unauthenticated OS command injection flaw (CVE-2026-9254) and other risks like CVE-2026-16348 and CVE-2026-78541 in Archer routers.

#TPLink #CyberSecurity #CVE20269254 #CommandInjection

https://securityonline.info/cve-2026-9254-unauthenticated-os-command-injection/?utm_source=mastodon&utm_medium=jetpack_social

TP-Link patched an unauthenticated OS command injection flaw (CVE-2026-9254) and other risks like CVE-2026-16348 and CVE-2026-78541 in Archer routers.

#TPLink #CyberSecurity #CVE20269254 #CommandInjection

https://securityonline.info/cve-2026-9254-unauthenticated-os-command-injection/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-77683 - Critical (9.9)

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation of the argument timestr results in command injection. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77683/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-77683 - Critical (9.9)

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone. The manipulation of the argument timestr results in command injection. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77683/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77234 - High (8.8)

Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. To remediate this issue, users should upgrade to version 11.3.1 or later.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77234/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

https://nvd.nist.gov/vuln/detail/CVE-2026-59568

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.

https://nvd.nist.gov/vuln/detail/CVE-2026-59568

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.

CVE-2026-77995 (CRITICAL, CVSS 10): miniOrange OAuth Client for Joomla (v1.0.0 – 3.1.9) allows arbitrary account takeover via cookie manipulation. Patch to 3.2.0+ required. https://radar.offseq.com/threat/cve-2026-77995-cwe-639-authorization-bypass-through-user-controlled-key-in-miniorangecom-miniorange-0e8da876ce4c7e51 #OffSeq #Joomla #Vuln #OAuth

CVE-2026-77995 (CRITICAL, CVSS 10): miniOrange OAuth Client for Joomla (v1.0.0 – 3.1.9) allows arbitrary account takeover via cookie manipulation. Patch to 3.2.0+ required. https://radar.offseq.com/threat/cve-2026-77995-cwe-639-authorization-bypass-through-user-controlled-key-in-miniorangecom-miniorange-0e8da876ce4c7e51 #OffSeq #Joomla #Vuln #OAuth

🔴 CVE-2026-78155 - Critical (9.9)

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-78155: OnGres StackGres operator has a critical (CVSS 9.9) priv esc vuln via untrusted search path (CWE-426). No patch yet. Restrict tenant privileges & monitor for escalation attempts. More info: https://radar.offseq.com/threat/cve-2026-78155-cwe-426-untrusted-search-path-in-ongres-stackgres-7d9e77e1189aa5d6 #OffSeq #Vulnerability #PrivilegeEscalation

🔴 CVE-2026-78155 - Critical (9.9)

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78155/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-78155: OnGres StackGres operator has a critical (CVSS 9.9) priv esc vuln via untrusted search path (CWE-426). No patch yet. Restrict tenant privileges & monitor for escalation attempts. More info: https://radar.offseq.com/threat/cve-2026-78155-cwe-426-untrusted-search-path-in-ongres-stackgres-7d9e77e1189aa5d6 #OffSeq #Vulnerability #PrivilegeEscalation

CVE-2026-47895 - Double-Free vulnerability in strongSwan EAP identity parsing. CVSS 7.5. Update to version 6.0.7 immediately. #CVE #strongSwan #infosec

https://www.valtersit.com/cve/CVE-2026-47895/

🟠 CVE-2026-47895 - High (7.5)

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47895/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47895 - High (7.5)

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47895/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CISA Sounds the Alarm: Actively Exploited Zimbra Vulnerability Puts Mail Servers at Risk + Video

A Critical Warning for Zimbra Administrators A serious cybersecurity warning has emerged for organizations running Zimbra Collaboration Suite, as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-73570 to its Known Exploited Vulnerabilities catalog. The vulnerability is reportedly being exploited in the wild, turning what might otherwise be…

https://undercodenews.com/cisa-sounds-the-alarm-actively-exploited-zimbra-vulnerability-puts-mail-servers-at-risk-video/?utm_source=mastodon&utm_medium=jetpack_social

⚠️ CRITICAL: CISA orders urgent patching of actively exploited Zimbra flaw

Zimbra Collaboration Suite (ZCS) has a critical unauthenticated RCE vulnerability (CVE-2026-73570) that is actively exploited in the wild. Any organization running ZCS is at immediate risk of full system compromise. CISA has mandated U.S. government agencies patch within three days.

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CVE-2026-73570 is an OS command injection in Zimbra Collaboration Suite being actively exploited. CISA added it to the KEV catalog with a 72-hour remediation window. This class of flaw allows full remote code execution, making it one of the most severe issues in any mail and collaboration platform.

#Zimbra #CVE202673570 #CISA #KnownExploitedVulnerabilities

https://cyberworldops.eu/en/zimbra-under-attack-command-injection-exploited-in-the-wild-cisa

CVE-2026-73570: Actively exploited CRITICAL RCE in Zimbra Collaboration Suite <10.1.20 via SNMP command injection. Patch to 10.1.20 now. Watch for suspicious service restarts & files in /opt/zimbra/jetty/webapps/. Details: https://radar.offseq.com/threat/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw-b89f77b410f3bb5f #OffSeq #Zimbra #Infosec #RCE

CISA Mandates Emergency Patching for Exploited Zimbra Flaw

A critical Zimbra flaw, CVE-2026-73570, allows hackers to inject malicious code, and the CISA is mandating emergency patching to prevent devastating attacks - don't wait, get protected now!

https://osintsights.com/cisa-mandates-emergency-patching-for-exploited-zimbra-flaw?utm_source=mastodon&utm_medium=social

#Cve202673570 #Zimbra #CommandInjection #RemoteCodeExecution #Snmp

Geopolitical tensions rise as the US escalates economic pressure on Iran, which labels new sanctions as a "declaration of war". Ukraine faces critical missile shortages amid intensified Russian strikes. In technology, major investments continue in AI infrastructure, with Google backing Marvell's custom AI chips. Cybersecurity sees CISA adding a critical Zimbra vulnerability (CVE-2026-73570) to its KEV catalog and new banking Trojans actively exploited globally.

#AnonNews_irc #Cybersecurity #News

Critical Zimbra Vulnerability Enters CISA’s KEV Catalog as Attackers Exploit Unauthenticated Remote Code Execution + Video

A New Warning for Zimbra Administrators A serious security warning is now hanging over organizations running Zimbra Collaboration Suite (ZCS). The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-73570 to its Known Exploited Vulnerabilities (KEV) catalog after Poland’s national cybersecurity response team confirmed…

https://undercodenews.com/critical-zimbra-vulnerability-enters-cisas-kev-catalog-as-attackers-exploit-unauthenticated-remote-code-execution-video/?utm_source=mastodon&utm_medium=jetpack_social

⚠️ CRITICAL: CISA orders urgent patching of actively exploited Zimbra flaw

Zimbra Collaboration Suite (ZCS) has a critical unauthenticated RCE vulnerability (CVE-2026-73570) that is actively exploited in the wild. Any organization running ZCS is at immediate risk of full system compromise. CISA has mandated U.S. government agencies patch within three days.

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

CVE-2026-73570 is an OS command injection in Zimbra Collaboration Suite being actively exploited. CISA added it to the KEV catalog with a 72-hour remediation window. This class of flaw allows full remote code execution, making it one of the most severe issues in any mail and collaboration platform.

#Zimbra #CVE202673570 #CISA #KnownExploitedVulnerabilities

https://cyberworldops.eu/en/zimbra-under-attack-command-injection-exploited-in-the-wild-cisa

CVE-2026-73570: Actively exploited CRITICAL RCE in Zimbra Collaboration Suite <10.1.20 via SNMP command injection. Patch to 10.1.20 now. Watch for suspicious service restarts & files in /opt/zimbra/jetty/webapps/. Details: https://radar.offseq.com/threat/cisa-orders-urgent-patching-of-actively-exploited-zimbra-flaw-b89f77b410f3bb5f #OffSeq #Zimbra #Infosec #RCE

Geopolitical tensions rise as the US escalates economic pressure on Iran, which labels new sanctions as a "declaration of war". Ukraine faces critical missile shortages amid intensified Russian strikes. In technology, major investments continue in AI infrastructure, with Google backing Marvell's custom AI chips. Cybersecurity sees CISA adding a critical Zimbra vulnerability (CVE-2026-73570) to its KEV catalog and new banking Trojans actively exploited globally.

#AnonNews_irc #Cybersecurity #News

🏆 New Achievement! Patch Notes: Server Owned by Community!

CHANGELOG v-Oh-No: ADDED — unauthenticated remote attackers executing arbitrary OS commands as the Zimbra user. ADDED — full control of your enterprise email server, courtesy of CVE-2026-73570. FIXED (by the developers, on July 20, in version 10.1.20) — the exact hole threat actors are currently crawling through, per Poland's CERT Polska. KNOWN ISSUE — you haven't patched yet.

The fix shipped over a month ago. (1/2)

🚨 [CISA-2026:0821] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0821)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-69836 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-69836)
- Name: Microsoft Entra ID Deserialization of Untrusted Data Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Entra ID
- Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-69836

⚠️ CVE-2026-73570 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-73570)
- Name: Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Synacor
- Product: Zimbra Collaboration Suite (ZCS)
- Notes: https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://blog.zimbra.com/2026/07/patch-release-update-zimbra-10-1-20/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-73570

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260821 #cisa20260821 #cve_2026_69836 #cve_2026_73570 #cve202669836 #cve202673570

CVE ID: CVE-2026-73570
Vendor: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Date Added: 2026-08-21
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73570

CVE-2026-28171 - Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7. CVSS 8.6. Currently unpatched. Deactivate plugin now. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-28171/

CVE-2026-77994: CRITICAL SQL injection in Joomla Page Builder CK (v1.0.0-3.6.4). Unauthenticated remote SQL execution possible. No official fix yet — disable/remove vulnerable versions. CVSS 9.3. https://radar.offseq.com/threat/cve-2026-77994-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-d508026cac86e490 #OffSeq #Joomla #SQLInjection #Infosec

CVE-2026-77994: CRITICAL SQL injection in Joomla Page Builder CK (v1.0.0-3.6.4). Unauthenticated remote SQL execution possible. No official fix yet — disable/remove vulnerable versions. CVSS 9.3. https://radar.offseq.com/threat/cve-2026-77994-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-d508026cac86e490 #OffSeq #Joomla #SQLInjection #Infosec

#OT #Advisory VDE-2026-061
Vulnerability in 'Copy learned MAC Addresses' function enables MAC Spoofing on Xelity Switches

An information disclosure vulnerability in the web GUI of Murrelektronik Xelity switches causes MAC addresses from the device's MAC address table to be written into a server-side log that is exposed via the device's web interface to unauthenticated users. The leak is triggered when an authenticated administrator invokes the 'Copy learned MAC Addresses' function, which causes a syslog error that inserts the affected MAC addresses into the log output. Once the error has been triggered, any unauthenticated attacker with network access to the web interface can retrieve the leaked MAC addresses via common browser developer tools. The vulnerable functionality was introduced in version 2.1.0 and is fixed in version 2.1.1.
#CVE CVE-2026-8173

https://certvde.com/en/advisories/vde-2026-061/

#CSAF https://murrelektronik.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-061.json

#OT #Advisory VDE-2026-061
Vulnerability in 'Copy learned MAC Addresses' function enables MAC Spoofing on Xelity Switches

An information disclosure vulnerability in the web GUI of Murrelektronik Xelity switches causes MAC addresses from the device's MAC address table to be written into a server-side log that is exposed via the device's web interface to unauthenticated users. The leak is triggered when an authenticated administrator invokes the 'Copy learned MAC Addresses' function, which causes a syslog error that inserts the affected MAC addresses into the log output. Once the error has been triggered, any unauthenticated attacker with network access to the web interface can retrieve the leaked MAC addresses via common browser developer tools. The vulnerable functionality was introduced in version 2.1.0 and is fixed in version 2.1.1.
#CVE CVE-2026-8173

https://certvde.com/en/advisories/vde-2026-061/

#CSAF https://murrelektronik.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-061.json

4MOSAn GCB Doctor faces a CRITICAL OS Command Injection (CVE-2026-78211, CVSS 9.8). Unauthenticated attackers can execute arbitrary system commands via ADOdb test page parameter. No patch — restrict access & monitor closely. https://radar.offseq.com/threat/cve-2026-78211-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-91902877a695e366 #OffSeq #CVE202678211 #Vuln #BlueTeam

4MOSAn GCB Doctor faces a CRITICAL OS Command Injection (CVE-2026-78211, CVSS 9.8). Unauthenticated attackers can execute arbitrary system commands via ADOdb test page parameter. No patch — restrict access & monitor closely. https://radar.offseq.com/threat/cve-2026-78211-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-91902877a695e366 #OffSeq #CVE202678211 #Vuln #BlueTeam

CRITICAL vuln (CVE-2026-78168) in EFM ipTIME T24000M ≤14.20.0: improper authentication in httpcon_check_session_url enables remote exploit. Public exploit disclosed, no vendor fix. Review access controls now. https://radar.offseq.com/threat/cve-2026-78168-improper-authentication-in-efm-iptime-t24000m-bfa2e716a3fcf0b6 #OffSeq #CVE #IoTSecurity #Exploit

🔴 CVE-2026-78168 - Critical (9.8)

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78168/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL vuln (CVE-2026-78168) in EFM ipTIME T24000M ≤14.20.0: improper authentication in httpcon_check_session_url enables remote exploit. Public exploit disclosed, no vendor fix. Review access controls now. https://radar.offseq.com/threat/cve-2026-78168-improper-authentication-in-efm-iptime-t24000m-bfa2e716a3fcf0b6 #OffSeq #CVE #IoTSecurity #Exploit

🔴 CVE-2026-78168 - Critical (9.8)

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78168/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78169 - Critical (9.9)

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile resul...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78169/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: Stack-based buffer overflow (CVE-2026-78169) in UTT HiPER 1250GW v3.2.7-210907-180535. Public exploit code available — no patch yet. Restrict device access & monitor /goform/aspRemoteApConfTempSend traffic. https://radar.offseq.com/threat/cve-2026-78169-stack-based-buffer-overflow-in-utt-hiper-1250gw-b9697a669a575a95 #OffSeq #CVE #Infosec #IoT

🔴 CVE-2026-78169 - Critical (9.9)

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile resul...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78169/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: Stack-based buffer overflow (CVE-2026-78169) in UTT HiPER 1250GW v3.2.7-210907-180535. Public exploit code available — no patch yet. Restrict device access & monitor /goform/aspRemoteApConfTempSend traffic. https://radar.offseq.com/threat/cve-2026-78169-stack-based-buffer-overflow-in-utt-hiper-1250gw-b9697a669a575a95 #OffSeq #CVE #Infosec #IoT

🔴 CVE-2026-78167 - Critical (10)

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78167 - Critical (10)

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78208 - High (7.5)

exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78208 - High (7.5)

exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78207 - Critical (9.4)

exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78207 - Critical (9.4)

exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78209 - High (8.2)

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78209/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-78209 - High (8.2)

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78209/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18052 - High (8.1)

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18052/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18052 - High (8.1)

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18052/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76793 - High (8.1)

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76793 - High (8.1)

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76793/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76789 - High (8.8)

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76789 - High (8.8)

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76789/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-77002 - Critical (9.8)

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77002/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-77002 - Critical (9.8)

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77002/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: CVE-2026-77002 in SmilePass Selfie Login WP plugin (≤1.0.2) allows full account takeover — no auth needed. Remove/disable plugin until patched. Details: https://radar.offseq.com/threat/cve-2026-77002-cwe-287-improper-authentication-in-smilepass-selfie-login-581c897a80f66e83 #OffSeq #WordPress #Vuln #CVE202677002

🔴 CVE-2026-77001 - Critical (9.8)

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-77001: CRITICAL vuln in Social Login & Sharing buttons with Analytics By SoClever (≤1.2.0). No auth checks — attackers can hijack any user session, including admin. Remove/disable plugin pending fix. https://radar.offseq.com/threat/cve-2026-77001-cwe-287-improper-authentication-in-social-login-sharing-buttons-with-analytics-by-c2f4b63e61e43745 #OffSeq #WordPress #CVE202677001 #Vulnerability

🔴 CVE-2026-77001 - Critical (9.8)

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-77001: CRITICAL vuln in Social Login & Sharing buttons with Analytics By SoClever (≤1.2.0). No auth checks — attackers can hijack any user session, including admin. Remove/disable plugin pending fix. https://radar.offseq.com/threat/cve-2026-77001-cwe-287-improper-authentication-in-social-login-sharing-buttons-with-analytics-by-c2f4b63e61e43745 #OffSeq #WordPress #CVE202677001 #Vulnerability

🔴 CVE-2026-77000 - Critical (9.8)

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, incl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77000/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-77000 - Critical (9.8)

The WP Social Media Login WordPress plugin through 1.0.6 does not verify that a social login was actually completed with the identity provider before authenticating a visitor, allowing unauthenticated attackers to log in as any existing user, incl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77000/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-8445: EmilStenstrom justhtml <=1.11.0 suffers CRITICAL XSS due to improper escaping in Markdown output. Remote attackers can inject scripts. Update to v1.12.0 now. https://radar.offseq.com/threat/cve-2026-8445-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-42aabed1c30bf24b #OffSeq #XSS #AppSec #CVE20268445

🔴 CVE-2026-8445 - Critical (9.8)

justhtml versions &lt;= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters ar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8445/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-8445: EmilStenstrom justhtml <=1.11.0 suffers CRITICAL XSS due to improper escaping in Markdown output. Remote attackers can inject scripts. Update to v1.12.0 now. https://radar.offseq.com/threat/cve-2026-8445-improper-neutralization-of-input-during-web-page-generation-cross-site-scripting-in-42aabed1c30bf24b #OffSeq #XSS #AppSec #CVE20268445

🔴 CVE-2026-8445 - Critical (9.8)

justhtml versions &lt;= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters ar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8445/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4671 - High (7.5)

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings (via query(), matches(), or selector-based transforms), run ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4671/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4671 - High (7.5)

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings (via query(), matches(), or selector-based transforms), run ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4671/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5388 - Critical (9.8)

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Dep...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5388/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5388 - Critical (9.8)

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Dep...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5388/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 New security advisory:

CVE-2026-10053 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-10053-gitlab-rce-via-package-registry-path-traversal-poc

by Yazoul AI

#InfoSec #SecurityPatching #HackerNews

🟠 CVE-2026-10053 - High (8.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10053/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10053 - High (8.5)

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10053/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-13598: RestrictMate <1.3.0 (WordPress) CRITICAL vuln lets unauthenticated users create admin accounts via improper privilege management. Disable user registration or validate roles until patched. https://radar.offseq.com/threat/cve-2026-13598-cwe-269-improper-privilege-management-in-restrictmate-53a767aba3099df7 #OffSeq #WordPress #CVE202613598 #Infosec

CVE-2026-13598: RestrictMate <1.3.0 (WordPress) CRITICAL vuln lets unauthenticated users create admin accounts via improper privilege management. Disable user registration or validate roles until patched. https://radar.offseq.com/threat/cve-2026-13598-cwe-269-improper-privilege-management-in-restrictmate-53a767aba3099df7 #OffSeq #WordPress #CVE202613598 #Infosec

CVE-2026-78136 - High-severity Eval Injection in CHIRP via crafted CSV data. CVSS 7.8. Update to the latest build immediately. #CVE #infosec #cybersecurity

https://www.valtersit.com/cve/CVE-2026-78136/

CVE-2026-78136 - CHIRP RCE via eval injection in crafted CSV (kenwood_itm.py). CVSS 7.8. Unpatched - upgrade once available. #CVE #infosec #CHIRP

https://www.valtersit.com/cve/CVE-2026-78136/

CVE-2026-78136: HIGH severity eval injection in chirpmyradio CHIRP (<39178db). Malicious CSV data can trigger arbitrary code execution. No patch yet — avoid untrusted files. Full details: https://radar.offseq.com/threat/cve-2026-78136-cwe-95-improper-neutralization-of-directives-in-dynamically-evaluated-code-eval-1763cf4fec8c29f0 #OffSeq #chirpmyradio #Vulnerability #InfoSec

🟠 CVE-2026-78136 - High (7.8)

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78136/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-78136: HIGH severity eval injection in chirpmyradio CHIRP (<39178db). Malicious CSV data can trigger arbitrary code execution. No patch yet — avoid untrusted files. Full details: https://radar.offseq.com/threat/cve-2026-78136-cwe-95-improper-neutralization-of-directives-in-dynamically-evaluated-code-eval-1763cf4fec8c29f0 #OffSeq #chirpmyradio #Vulnerability #InfoSec

🟠 CVE-2026-78136 - High (7.8)

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78136/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-16149 - Missing Authorization in WordPress Security Hardener plugin (<=2.4.4). Bypasses REST API protections. CVSS 8.8. Monitor for patch now. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-16149/

CVE-2026-16149 (HIGH, CVSS 8.8): marc4 Security Hardener <=2.4.4 allows Subscriber-level users to create Admin accounts or reset passwords via REST API. Disable plugin or limit API access pending patch. https://radar.offseq.com/threat/cve-2026-16149-cwe-269-improper-privilege-management-in-marc4-security-hardener-a438d1f2a5360b5c #OffSeq #WordPress #Vulnerability #Infosec

🟠 CVE-2026-16149 - High (8.8)

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the rest_e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-16149 (HIGH, CVSS 8.8): marc4 Security Hardener <=2.4.4 allows Subscriber-level users to create Admin accounts or reset passwords via REST API. Disable plugin or limit API access pending patch. https://radar.offseq.com/threat/cve-2026-16149-cwe-269-improper-privilege-management-in-marc4-security-hardener-a438d1f2a5360b5c #OffSeq #WordPress #Vulnerability #Infosec

🟠 CVE-2026-16149 - High (8.8)

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.4. The vulnerability exists because the plugin's user-enumeration protection, which is enabled by default, hooks the rest_e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-78122 - Arbitrary file read in docker-socket-proxy allows leaks of container filesystems and logs. CVSS 7.4. Review and restrict proxy access now. #CVE #Docker #infosec

https://www.valtersit.com/cve/CVE-2026-78122/

CVE-2026-78122: HIGH severity in Tecnativa docker-socket-proxy (CVSS 8.3). Insufficient access control enables attackers to read files & export entire container filesystems via Docker API. Restrict access, check vendor guidance. https://radar.offseq.com/threat/cve-2026-78122-insufficient-granularity-of-access-control-in-tecnativa-docker-socket-proxy-6e8e6aaf03a19cce #OffSeq #Docker #Infosec #Vuln

CVE-2026-78122: HIGH severity in Tecnativa docker-socket-proxy (CVSS 8.3). Insufficient access control enables attackers to read files & export entire container filesystems via Docker API. Restrict access, check vendor guidance. https://radar.offseq.com/threat/cve-2026-78122-insufficient-granularity-of-access-control-in-tecnativa-docker-socket-proxy-6e8e6aaf03a19cce #OffSeq #Docker #Infosec #Vuln

CVE-2026-0551: HIGH severity deserialization vulnerability in buildwps PPWP – Password Protect Pages (<=1.9.18). Contributor+ users can inject PHP objects if a POP chain exists in other plugins/themes. Review access & patch status. https://radar.offseq.com/threat/cve-2026-0551-cwe-502-deserialization-of-untrusted-data-in-buildwps-ppwp-password-protect-pages-dde9c11a2d958ff8 #OffSeq #WordPress #Vuln

🟠 CVE-2026-0551 - High (8.8)

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'post_protection_roles' vulnerable parameter. This makes it...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-0551: HIGH severity deserialization vulnerability in buildwps PPWP – Password Protect Pages (<=1.9.18). Contributor+ users can inject PHP objects if a POP chain exists in other plugins/themes. Review access & patch status. https://radar.offseq.com/threat/cve-2026-0551-cwe-502-deserialization-of-untrusted-data-in-buildwps-ppwp-password-protect-pages-dde9c11a2d958ff8 #OffSeq #WordPress #Vuln

🟠 CVE-2026-0551 - High (8.8)

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'post_protection_roles' vulnerable parameter. This makes it...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-0551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78050 - Critical (9.9)

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_cl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78050/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: CVE-2026-78050 in Comfast CF-N1-S (2.6.0.1) enables remote code execution via stack-based buffer overflow in web mgmt (/cgi-bin/mbox-config). Public exploit out, no patch yet. Restrict access! https://radar.offseq.com/threat/cve-2026-78050-stack-based-buffer-overflow-in-comfast-cf-n1-s-d1eec38193291471 #OffSeq #CVE202678050 #infosec #IoT

🔴 CVE-2026-78050 - Critical (9.9)

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected element is the function sub_41AD7C of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component Web Management. The manipulation of the argument timestr/ntp_cl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78050/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: CVE-2026-78050 in Comfast CF-N1-S (2.6.0.1) enables remote code execution via stack-based buffer overflow in web mgmt (/cgi-bin/mbox-config). Public exploit out, no patch yet. Restrict access! https://radar.offseq.com/threat/cve-2026-78050-stack-based-buffer-overflow-in-comfast-cf-n1-s-d1eec38193291471 #OffSeq #CVE202678050 #infosec #IoT

Speicher-Leck im Linux-Kernel (CVE-2026-74671)

Eine Schwachstelle in der Integritätsmessarchitektur (IMA) bedroht Linux-Systeme. Ein Vorzeichenfehler (Type-Mismatch) in der Funktion xattr_verify() führt bei manipulierten security.ima-Erweiterungen zu einem Unterlauf.

Dadurch entsteht ein gefährlicher Out-of-Bounds-Lesefehler, über den Angreifer potenziell sensible Daten direkt aus dem Speicher abgreifen können. Admins sollten umgehend patchen!

#Linux #CVE #Infosec

CVE-2026-4703 - Critical PHP Object Injection in WS Form for WordPress leads to remote code execution via insecure deserialization. CVSS 9.8. Update now. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-4703/

CVE-2026-4703: WS Form LITE ≤1.10.80 has a CRITICAL PHP Object Injection vuln via form meta deserialization. Exploitable if a POP chain exists in another plugin/theme — possible RCE, file deletion, or data leak. Audit plugins/themes. https://radar.offseq.com/threat/the-ws-form-lite-drag-drop-contact-form-builder-plugin-for-wordpress-is-vulnerable-to-php-object-f688cffee1daa479 #OffSeq #WordPress #CVE20264703

🔴 CVE-2026-4703 - Critical (9.8)

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4703/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-4703: WS Form LITE ≤1.10.80 has a CRITICAL PHP Object Injection vuln via form meta deserialization. Exploitable if a POP chain exists in another plugin/theme — possible RCE, file deletion, or data leak. Audit plugins/themes. https://radar.offseq.com/threat/the-ws-form-lite-drag-drop-contact-form-builder-plugin-for-wordpress-is-vulnerable-to-php-object-f688cffee1daa479 #OffSeq #WordPress #CVE20264703

🔴 CVE-2026-4703 - Critical (9.8)

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.10.80 via deserialization of untrusted input from form submission meta values. This makes it p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4703/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Kritischer Fix im Linux-Kernel (CVE-2026-74708)

Das MITRE-Institut meldet eine behobene Schwachstelle im xsk-Netzwerk-Subsystem. Eine fehlerhafte Größenprüfung von „Launch-time“-Metadaten konnte durch manipulierte Anfragen zu Pipeline-Ausfällen führen.

Die Patches wurden bereits erfolgreich eingepflegt. System-Updates werden empfohlen!

#Linux #CVE #Infosec

CVE-2026-62384 - Symlink sandbox bypass in NLTK leads to arbitrary file read. CVSS 7.5. Update to version 3.10.2 now. #CVE #Python #infosec

https://www.valtersit.com/cve/CVE-2026-62384/

CVE-2026-62384 - Symlink sandbox bypass in NLTK FramenetCorpusReader. Arbitrary XML file read. CVSS 7.5. Update to 3.10.2 now. #CVE #NLTK #infosec

https://www.valtersit.com/cve/CVE-2026-62384/

🟠 CVE-2026-62384 - High (7.5)

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62384/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-62384 - Symlink sandbox bypass in NLTK leads to arbitrary file read. CVSS 7.5. Update to version 3.10.2 now. #CVE #Python #infosec

https://www.valtersit.com/cve/CVE-2026-62384/

🟠 CVE-2026-62384 - High (7.5)

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62384/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-71513 - Critical RCE in NLTK AllowlistUnpickler. Attribute traversal bypasses allowlist to execute arbitrary code via crafted transition-parser models. CVSS 8.8. Update to NLTK 3.10.3 immediately. #CVE #NLTK #infosec

https://www.valtersit.com/cve/CVE-2026-71513/

🟠 CVE-2026-71513 - High (8.8)

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71513/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-71513 - High (8.8)

NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only the pickle module string and not the global name, allowing attackers to resolve dotted names by attribute traversal to callables outside th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-71513/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62243 - High (7.5)

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62243/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62243 - High (7.5)

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62243/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2996 - High (7.5)

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2996/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2996 - High (7.5)

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2996/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62388 - High (7.5)

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62388/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-62388 - High (7.5)

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-62388/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59808 - High (8.8)

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin() conver...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59808/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59808 - High (8.8)

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin() conver...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59808/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57998 - High (7.8)

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57998/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-57998 - High (7.8)

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57998/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-66393 - DoS vulnerability in NLTK. Deeply nested JSON triggers unhandled recursion crash in Python. CVSS 7.5. Update to 3.9.4 immediately. #CVE #Python #infosec

https://www.valtersit.com/cve/CVE-2026-66393/

🟠 CVE-2026-66393 - High (7.5)

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66393/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-66393 - DoS vulnerability in NLTK. Deeply nested JSON triggers unhandled recursion crash in Python. CVSS 7.5. Update to 3.9.4 immediately. #CVE #Python #infosec

https://www.valtersit.com/cve/CVE-2026-66393/

🟠 CVE-2026-66393 - High (7.5)

NLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66393/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59256 - High (7.5)

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. A...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-59256 - High (7.5)

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. A...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-59256/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-77946 - Critical stack buffer overflow in TRENDnet TEW-821DAP NTP handler. Remote exploit public, unpatched. CVSS 10. Isolate/disable affected devices until patch. #CVE #TRENDnet #infosec

https://www.valtersit.com/cve/CVE-2026-77946/

CVE-2026-77946: Stack-based buffer overflow in TRENDnet TEW-821DAP v2.2.01b05 (CRITICAL, CVSS 10). Remote code execution possible via NTP config. No patch — limit exposure & monitor traffic. https://radar.offseq.com/threat/cve-2026-77946-stack-based-buffer-overflow-in-trendnet-tew-821dap-679ce40e9d7aa62a #OffSeq #CVE202677946 #infosec #vulnerability

🔴 CVE-2026-77946 - Critical (10)

A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cgi-bin/apply_time.cgi of the component NTP Timezone Configuration Handler. Executing a manipulation of the a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77946/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-77946: Stack-based buffer overflow in TRENDnet TEW-821DAP v2.2.01b05 (CRITICAL, CVSS 10). Remote code execution possible via NTP config. No patch — limit exposure & monitor traffic. https://radar.offseq.com/threat/cve-2026-77946-stack-based-buffer-overflow-in-trendnet-tew-821dap-679ce40e9d7aa62a #OffSeq #CVE202677946 #infosec #vulnerability

🔴 CVE-2026-77946 - Critical (10)

A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cgi-bin/apply_time.cgi of the component NTP Timezone Configuration Handler. Executing a manipulation of the a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77946/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-77945 - Command injection in TRENDnet TEW-821DAP 2.2.01b05 via /cgi-bin/upload.cgi. CVSS 7.4. Unpatched. Disable remote access now. #CVE #TRENDnet #infosec

https://www.valtersit.com/cve/CVE-2026-77945/

🔴 CVE-2026-78003 - Critical (9.8)

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78003/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: Mailgun for WordPress ≤2.2.0 vulnerable to SSRF (CVE-2026-78003). Attackers can exploit input validation in add_list() to hijack admin resets & compromise sites. Update/disable plugin now. https://radar.offseq.com/threat/cve-2026-78003-cwe-918-server-side-request-forgery-ssrf-in-mailgun-mailgun-for-wordpress-6ee94923f1ee4923 #OffSeq #WordPress #Infosec #SSRF

🔴 CVE-2026-78003 - Critical (9.8)

The Mailgun for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) via path traversal in versions up to and including 2.2.0. This is due to insufficient input validation in the add_list() function, which accepts use...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78003/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL: Mailgun for WordPress ≤2.2.0 vulnerable to SSRF (CVE-2026-78003). Attackers can exploit input validation in add_list() to hijack admin resets & compromise sites. Update/disable plugin now. https://radar.offseq.com/threat/cve-2026-78003-cwe-918-server-side-request-forgery-ssrf-in-mailgun-mailgun-for-wordpress-6ee94923f1ee4923 #OffSeq #WordPress #Infosec #SSRF

CRITICAL (CVSS 9.3): CVE-2026-12710 in Google Cloud Application Integration (QueryEngineTask) enabled unauthorized data access. Patched by Google on 2026-04-04 — no customer action needed. Details: https://radar.offseq.com/threat/cve-2026-12710-cwe-862-missing-authorization-in-google-cloud-application-integration-f732bf9f6ab56812 #OffSeq #CloudSecurity #CVE #Vuln

CRITICAL (CVSS 9.3): CVE-2026-12710 in Google Cloud Application Integration (QueryEngineTask) enabled unauthorized data access. Patched by Google on 2026-04-04 — no customer action needed. Details: https://radar.offseq.com/threat/cve-2026-12710-cwe-862-missing-authorization-in-google-cloud-application-integration-f732bf9f6ab56812 #OffSeq #CloudSecurity #CVE #Vuln

IBM patches two Power Systems Firmware flaws, CVE-2026-16687 and CVE-2026-16835, both CVSS 9.6, that grant full control of the managed system.

#IBM #PowerSystems #Firmware #CVE #RCE #AuthBypass #InfoSec #PatchNow

https://securityonline.info/ibm-power-firmware-cve-2026-16687/?utm_source=mastodon&utm_medium=jetpack_social

IBM patches two Power Systems Firmware flaws, CVE-2026-16687 and CVE-2026-16835, both CVSS 9.6, that grant full control of the managed system.

#IBM #PowerSystems #Firmware #CVE #RCE #AuthBypass #InfoSec #PatchNow

https://securityonline.info/ibm-power-firmware-cve-2026-16687/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-19883 - High (8.8)

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the wpematico_import_settings function in all versions up to, and inc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19883/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-63343 - Critical (9.9)

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63343/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-63343 - Critical (9.9)

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-63343/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack