CRITICAL: CVE-2026-18922 in Red Hat Directory Server 11 allows remote privilege escalation via reused stale SASL PLAIN identities. Restrict allowed SASL mechanisms to exclude PLAIN for mitigation. Full details: https://radar.offseq.com/threat/cve-2026-18922-improper-authentication-in-red-hat-red-hat-directory-server-11-8ac2140fe6c90ef5 #OffSeq #RedHat #CVE202618922 #infosec

CRITICAL: CVE-2026-18922 in Red Hat Directory Server 11 allows remote privilege escalation via reused stale SASL PLAIN identities. Restrict allowed SASL mechanisms to exclude PLAIN for mitigation. Full details: https://radar.offseq.com/threat/cve-2026-18922-improper-authentication-in-red-hat-red-hat-directory-server-11-8ac2140fe6c90ef5 #OffSeq #RedHat #CVE202618922 #infosec

D-Link DIR-822A routers are affected by CVE-2026-86510 (CRITICAL, CVSS 9.4): remote out-of-bounds write in L2TP parser can lead to system compromise. No patch yet — restrict access and monitor updates. https://radar.offseq.com/threat/cve-2026-86510-out-of-bounds-write-in-d-link-dir-822a-e90339b14a1aa39b #OffSeq #CVE202686510 #RouterSecurity #Infosec

🔴 CVE-2026-86510 - Critical (9.9)

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

D-Link DIR-822A routers are affected by CVE-2026-86510 (CRITICAL, CVSS 9.4): remote out-of-bounds write in L2TP parser can lead to system compromise. No patch yet — restrict access and monitor updates. https://radar.offseq.com/threat/cve-2026-86510-out-of-bounds-write-in-d-link-dir-822a-e90339b14a1aa39b #OffSeq #CVE202686510 #RouterSecurity #Infosec

🔴 CVE-2026-86510 - Critical (9.9)

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86510/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86509 - Critical (9.6)

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-86509 — CRITICAL stack-based buffer overflow in D-Link DIR-895L (A1_102b07), in udhcpcd’s sendOffer/sendACK. Exploit is public, local network access needed. Review segmentation and monitor for patches. https://radar.offseq.com/threat/cve-2026-86509-stack-based-buffer-overflow-in-d-link-dir-895l-9794ccee4cffa64a #OffSeq #CVE202686509 #IoTSecurity

🔴 CVE-2026-86509 - Critical (9.6)

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86509/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-86509 — CRITICAL stack-based buffer overflow in D-Link DIR-895L (A1_102b07), in udhcpcd’s sendOffer/sendACK. Exploit is public, local network access needed. Review segmentation and monitor for patches. https://radar.offseq.com/threat/cve-2026-86509-stack-based-buffer-overflow-in-d-link-dir-895l-9794ccee4cffa64a #OffSeq #CVE202686509 #IoTSecurity

SAP CAP's @sap/cds-mtxs (<=4.0.2) has a CRITICAL flaw (CVE-2026-76969): insufficiently protected credentials let unauthenticated attackers steal creds and delete/replace tenant data. No patch yet — monitor SAP updates. https://radar.offseq.com/threat/cve-2026-76969-cwe-522-insufficiently-protected-credentials-in-sapse-sap-cloud-application-programming-ee3e359619813d60 #OffSeq #SAP #infosec #CVE

🔴 CVE-2026-76969 - Critical (9.4)

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credential...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

SAP CAP's @sap/cds-mtxs (<=4.0.2) has a CRITICAL flaw (CVE-2026-76969): insufficiently protected credentials let unauthenticated attackers steal creds and delete/replace tenant data. No patch yet — monitor SAP updates. https://radar.offseq.com/threat/cve-2026-76969-cwe-522-insufficiently-protected-credentials-in-sapse-sap-cloud-application-programming-ee3e359619813d60 #OffSeq #SAP #infosec #CVE

🔴 CVE-2026-76969 - Critical (9.4)

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credential...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76969/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76967 - High (7.8)

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76967/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76967 - High (7.8)

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76967/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76958 - High (8.5)

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity dec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76958/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76958 - High (8.5)

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity dec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76958/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-66768 - Critical (9)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-66768 - Critical (9)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66767 - High (7.7)

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66767/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-66767 - High (7.7)

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-66767/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-58240 - Critical (9.8)

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to regi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58240/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-58240 - Critical (9.8)

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to regi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-58240/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-44756 - Critical (10)

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resultin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44756/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-44756 - Critical (10)

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resultin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44756/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86541 - High (8.3)

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86541/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86541 - High (8.3)

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86541/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86540 - High (7.8)

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a craf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86540/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86540 - High (7.8)

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a craf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86540/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86544 - High (8.1)

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission confi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86544 - High (8.1)

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission confi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86544/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86543 - Critical (9.8)

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86543/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-86543: CRITICAL vuln in knowns-dev knowns <0.30.0. Mgmt API is exposed w/o auth by default, allowing attackers to create public tunnels. Restrict access & upgrade ASAP. https://radar.offseq.com/threat/cve-2026-86543-missing-authentication-for-critical-function-in-knowns-dev-knowns-3a84bb55b20322bc #OffSeq #CVE2026_86543 #Vulnerability #APIsecurity

🔴 CVE-2026-86543 - Critical (9.8)

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86543/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-86543: CRITICAL vuln in knowns-dev knowns <0.30.0. Mgmt API is exposed w/o auth by default, allowing attackers to create public tunnels. Restrict access & upgrade ASAP. https://radar.offseq.com/threat/cve-2026-86543-missing-authentication-for-critical-function-in-knowns-dev-knowns-3a84bb55b20322bc #OffSeq #CVE2026_86543 #Vulnerability #APIsecurity

🔴 CVE-2026-86542 - Critical (9.1)

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86542/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86542 - Critical (9.1)

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86542/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86538 - High (7.5)

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86538 - High (7.5)

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86538/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86439 - High (8.8)

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86439/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86439 - High (8.8)

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86439/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🏆 New Achievement! StyleSmuggler Has Entered the Tutorial Zone!

Welcome, new merchant! This is the part of the game where we introduce a mandatory debuff called CVE-2026-75650. Adobe Commerce and Magento 2 contain a CVSS 10.0 critical flaw in the template engine — an Improper Neutralization of Special Elements — that lets attackers execute arbitrary code with no user interaction required. This isn't a side quest. (1/2)

An Adobe Commerce vulnerability, CVE-2026-75650 (CVSS 10), enables unauthenticated arbitrary code execution and is exploited in the wild. Patch now.

#AdobeCommerce #Magento #StyleSmuggler #CVE202675650 #RCE #Ecommerce #ExploitedInTheWild #Infosec

https://securityonline.info/adobe-commerce-cve-2026-75650-stylesmuggler/?utm_source=mastodon&utm_medium=jetpack_social

Magento 2 Zero-Day RCE Crisis: Active Attacks Put Online Stores and Customer Data at Risk + Video

A New Threat Is Hitting E-Commerce at the Core A dangerous zero-day vulnerability in Magento and Adobe Commerce has moved from security research into active exploitation, creating an immediate threat for online retailers running the popular e-commerce platforms. The vulnerability, tracked by Adobe as CVE-2026-75650 and publicly associated with the StyleSmuggler attack…

https://undercodenews.com/magento-2-zero-day-rce-crisis-active-attacks-put-online-stores-and-customer-data-at-risk-video/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-75650 - Critical (10)

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Adobe Commerce faces a CRITICAL (CVSS 10) template engine flaw (CVE-2026-75650) allowing arbitrary code execution with no user interaction required. Update and monitor for patches. https://radar.offseq.com/threat/cve-2026-75650-improper-neutralization-of-special-elements-used-in-a-template-engine-cwe-1336-in-adobe-1ba4ab0d2a763031 #OffSeq #AdobeCommerce #CVE202675650 #infosec

🏆 New Achievement! StyleSmuggler Has Entered the Tutorial Zone!

Welcome, new merchant! This is the part of the game where we introduce a mandatory debuff called CVE-2026-75650. Adobe Commerce and Magento 2 contain a CVSS 10.0 critical flaw in the template engine — an Improper Neutralization of Special Elements — that lets attackers execute arbitrary code with no user interaction required. This isn't a side quest. (1/2)

An Adobe Commerce vulnerability, CVE-2026-75650 (CVSS 10), enables unauthenticated arbitrary code execution and is exploited in the wild. Patch now.

#AdobeCommerce #Magento #StyleSmuggler #CVE202675650 #RCE #Ecommerce #ExploitedInTheWild #Infosec

https://securityonline.info/adobe-commerce-cve-2026-75650-stylesmuggler/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-75650 - Critical (10)

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Adobe Commerce faces a CRITICAL (CVSS 10) template engine flaw (CVE-2026-75650) allowing arbitrary code execution with no user interaction required. Update and monitor for patches. https://radar.offseq.com/threat/cve-2026-75650-improper-neutralization-of-special-elements-used-in-a-template-engine-cwe-1336-in-adobe-1ba4ab0d2a763031 #OffSeq #AdobeCommerce #CVE202675650 #infosec

🟠 CVE-2026-86494 - High (7.7)

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86494 - High (7.7)

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86498 - High (7.7)

In JetBrains YouTrack before 2025.3.160480,
2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86498/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86498 - High (7.7)

In JetBrains YouTrack before 2025.3.160480,
2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86498/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80166 - High (7.8)

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulnerability. An unauthenticated attacker with local access could potentially exploit this vu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80166/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-80166 - High (7.8)

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulnerability. An unauthenticated attacker with local access could potentially exploit this vu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80166/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86482 - High (8.8)

In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86482/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86482 - High (8.8)

In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86482/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

JetBrains YouTrack CRITICAL vulnerability (CVE-2026-86478, CVSS 9.8) in versions <2025.3.161254, <2026.1.14042: improper authentication enables unauthenticated account takeover. Patch status pending — check vendor advisory. https://radar.offseq.com/threat/cve-2026-86478-cwe-290-in-jetbrains-youtrack-04f74ce17c2670a8 #OffSeq #Infosec #CVE202686478

JetBrains YouTrack CRITICAL vulnerability (CVE-2026-86478, CVSS 9.8) in versions <2025.3.161254, <2026.1.14042: improper authentication enables unauthenticated account takeover. Patch status pending — check vendor advisory. https://radar.offseq.com/threat/cve-2026-86478-cwe-290-in-jetbrains-youtrack-04f74ce17c2670a8 #OffSeq #Infosec #CVE202686478

🟠 CVE-2026-86492 - High (8.5)

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86492/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86492 - High (8.5)

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86492/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86504 - High (7.8)

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86504/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86504 - High (7.8)

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86504/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86502 - High (8.4)

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86502/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86502 - High (8.4)

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86502/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86480 - Critical (9.8)

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-86480 (CRITICAL, CVSS 9.8) in JetBrains Hub allows unauthenticated attackers to escalate to superuser by registering a trusted service. No patch yet — restrict access & monitor activity. Details: https://radar.offseq.com/threat/cve-2026-86480-cwe-306-in-jetbrains-hub-86541d52679a2997 #OffSeq #JetBrains #CVE202686480 #Infosec

🔴 CVE-2026-86480 - Critical (9.8)

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-86480 (CRITICAL, CVSS 9.8) in JetBrains Hub allows unauthenticated attackers to escalate to superuser by registering a trusted service. No patch yet — restrict access & monitor activity. Details: https://radar.offseq.com/threat/cve-2026-86480-cwe-306-in-jetbrains-hub-86541d52679a2997 #OffSeq #JetBrains #CVE202686480 #Infosec

🟠 CVE-2026-86479 - High (8.1)

In JetBrains YouTrack before 2026.2.18788,
2026.1.14055,
2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86479/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86479 - High (8.1)

In JetBrains YouTrack before 2026.2.18788,
2026.1.14055,
2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86479/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86429 - High (7.5)

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and &lt; 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86429/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86429 - High (7.5)

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and &lt; 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86429/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86435 - High (7.5)

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to cre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86435/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86435 - High (7.5)

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate footnote definitions. Attackers can craft documents with duplicate footnote definitions and references to cre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86435/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Patch the critical FreeIPA CVE-2026-76578 immediately. This FreeIPA vulnerability allows complete, unauthenticated administrative access to your servers.

#FreeIPA #CVE202676578 #Vulnerability #CyberSecurity #CVE202613097

https://securityonline.info/freeipa-cve-2026-76578-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

Patch the critical FreeIPA CVE-2026-76578 immediately. This FreeIPA vulnerability allows complete, unauthenticated administrative access to your servers.

#FreeIPA #CVE202676578 #Vulnerability #CyberSecurity #CVE202613097

https://securityonline.info/freeipa-cve-2026-76578-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

CRITICAL vuln: CVE-2026-6223 in Bahçelievler Municipality BiHayat App (v2.1.7+) enables authentication bypass via weak brute-force protections. No vendor fix yet. Assess and strengthen your controls. https://radar.offseq.com/threat/cve-2026-6223-cwe-307-improper-restriction-of-excessive-authentication-attempts-in-bahelievler-e94a3e6ad304a991 #OffSeq #CVE20266223 #Infosec #AppSec

CRITICAL vuln: CVE-2026-6223 in Bahçelievler Municipality BiHayat App (v2.1.7+) enables authentication bypass via weak brute-force protections. No vendor fix yet. Assess and strengthen your controls. https://radar.offseq.com/threat/cve-2026-6223-cwe-307-improper-restriction-of-excessive-authentication-attempts-in-bahelievler-e94a3e6ad304a991 #OffSeq #CVE20266223 #Infosec #AppSec

CRITICAL deserialization flaw (CVE-2026-7861) in Next4Biz CSM enables code injection. No vendor response or patch. Review exposure, apply compensating controls. Details: https://radar.offseq.com/threat/cve-2026-7861-cwe-502-deserialization-of-untrusted-data-in-next4biz-information-technologies-inc-csm-4650f92651ef4119 #OffSeq #Vuln #CVE20267861 #Next4Biz #infosec

CRITICAL deserialization flaw (CVE-2026-7861) in Next4Biz CSM enables code injection. No vendor response or patch. Review exposure, apply compensating controls. Details: https://radar.offseq.com/threat/cve-2026-7861-cwe-502-deserialization-of-untrusted-data-in-next4biz-information-technologies-inc-csm-4650f92651ef4119 #OffSeq #Vuln #CVE20267861 #Next4Biz #infosec

⚠️ CRITICAL: Hackers exploit new MikroTik RouterOS flaws to hijack routers

Attackers are actively exploiting two chained critical vulnerabilities in MikroTik RouterOS (CVE-2026-67276 and CVE-2026-86060) to achieve full admin control of exposed routers. A third flaw (CVE-2026-67277) in the bandwidth-test service can cause memory leaks or crashes. Any unpatched MikroTik rou…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

📰 MikroTik Routers Hijacked via 'MikroTrick' Unauthenticated Exploit

🚨 ACTIVE ATTACK: MikroTik routers are being hijacked via the 'MikroTrick' exploit chain (CVE-2026-67276, CVE-2026-86060). Unauthenticated attackers gain full admin control via exposed SSH. Patch RouterOS NOW. #MikroTik #CyberSecurity

🔗 https://cyber.netsecops.io/articles/mikrotik-routers-exploited-via-mikrotrick-ssh-exploit-chain/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Hackers Exploit MikroTik Router Flaws to Hijack Devices

Hackers are actively exploiting vulnerabilities in MikroTik RouterOS, using a two-step attack dubbed "MikroTrick" to hijack devices, warns Poland's Computer Emergency Response Team. The team has confirmed that the critical severity flaws, tracked as CVE-2026-67276 and CVE-2026-86060, are being used in real-world attacks.

https://osintsights.com/hackers-exploit-mikrotik-router-flaws-to-hijack-devices?utm_source=mastodon&utm_medium=social

#Mikrotik #Routeros #Mikrotrick #EmergingThreats #SupplyChain

That is a full wipe, you absolute liability.

Pull up your patch notes, apply MikroTik RouterOS security updates addressing CVE-2026-67276, CVE-2026-67277, and CVE-2026-86060, NOW — before the raid resets and I lose what remains of my sanity.

Reward: You've received the Fallen Raid Leader's Broken Headset. It no longer transmits. Nobody can hear you panic.

#CyberSecurity #MikroTik #RouterOS #Vulnerability #PrivilegeEscalation #AdminAccessUnlocked (2/2)

🏆 New Achievement! MikroTik and Chill (No Password Required)!

MOVE OUT OF THE FIRE. SERIOUSLY. CERT.PL is screaming into your headset right now about three critical CVEs in MikroTik RouterOS — actively exploited, all of them — and you are standing there doing NOTHING. CVE-2026-67276 lets attackers bypass SSH auth entirely by knowing your username and RSA modulus. CVE-2026-86060 hands out full admin via a crafted username. CVE-2026-67277 crashes and leaks memory for fun. (1/2)

The MikroTrick PoC is publicly disclosed. This MikroTrick RouterOS flaw is actively exploited in the wild, granting full administrative privileges.

#MikroTrick #RouterOS #CVE202667276 #CyberSecurity #Vulnerability

https://securityonline.info/mikrotik-routeros-mikrotrick-cve-2026-67276/?utm_source=mastodon&utm_medium=jetpack_social

Pre-auth RCE on MikroTik: exploited before the patch, rebuilt in three hours

MikroTik RouterOS에서 SSH만 노출돼 있으면 인증 없이 관리자 권한을 획득할 수 있다는 ‘MikroTrick’ 체인이 공개됐다. 글은 CVE-2026-67279(인증 상태 우회)와 CVE-2026-86060(로그인 헬퍼 인자 처리)을 결합해 루트급 콘솔을 얻으며, CVE-2026-67276은 별도의 공개키 인증 우회 경로가 될 수 있다고 설명한다. 공격 흔적은 `user -2` 로그인 실패·`ssh:-2@<ip>`에 의한 설정 변경, 비인가 `ops` 계정, fetch/import 스케줄러·SOCKS 프록시·터널 등이며,...

https://blog.tolmo.com/p/pre-auth-rce-on-mikrotik-exploited

RouterOS SSH public-key authentication bypass (CVE-2026-67276) https://github.com/dinosn/mikrotrick-poc

https://db.gcve.eu/vuln/cve-2026-67276

ahahahaha

⚠️ CRITICAL: Hackers exploit new MikroTik RouterOS flaws to hijack routers

Attackers are actively exploiting two chained critical vulnerabilities in MikroTik RouterOS (CVE-2026-67276 and CVE-2026-86060) to achieve full admin control of exposed routers. A third flaw (CVE-2026-67277) in the bandwidth-test service can cause memory leaks or crashes. Any unpatched MikroTik rou…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

📰 MikroTik Routers Hijacked via 'MikroTrick' Unauthenticated Exploit

🚨 ACTIVE ATTACK: MikroTik routers are being hijacked via the 'MikroTrick' exploit chain (CVE-2026-67276, CVE-2026-86060). Unauthenticated attackers gain full admin control via exposed SSH. Patch RouterOS NOW. #MikroTik #CyberSecurity

🔗 https://cyber.netsecops.io/articles/mikrotik-routers-exploited-via-mikrotrick-ssh-exploit-chain/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

That is a full wipe, you absolute liability.

Pull up your patch notes, apply MikroTik RouterOS security updates addressing CVE-2026-67276, CVE-2026-67277, and CVE-2026-86060, NOW — before the raid resets and I lose what remains of my sanity.

Reward: You've received the Fallen Raid Leader's Broken Headset. It no longer transmits. Nobody can hear you panic.

#CyberSecurity #MikroTik #RouterOS #Vulnerability #PrivilegeEscalation #AdminAccessUnlocked (2/2)

🏆 New Achievement! MikroTik and Chill (No Password Required)!

MOVE OUT OF THE FIRE. SERIOUSLY. CERT.PL is screaming into your headset right now about three critical CVEs in MikroTik RouterOS — actively exploited, all of them — and you are standing there doing NOTHING. CVE-2026-67276 lets attackers bypass SSH auth entirely by knowing your username and RSA modulus. CVE-2026-86060 hands out full admin via a crafted username. CVE-2026-67277 crashes and leaks memory for fun. (1/2)

The MikroTrick PoC is publicly disclosed. This MikroTrick RouterOS flaw is actively exploited in the wild, granting full administrative privileges.

#MikroTrick #RouterOS #CVE202667276 #CyberSecurity #Vulnerability

https://securityonline.info/mikrotik-routeros-mikrotrick-cve-2026-67276/?utm_source=mastodon&utm_medium=jetpack_social

RouterOS SSH public-key authentication bypass (CVE-2026-67276) https://github.com/dinosn/mikrotrick-poc

https://db.gcve.eu/vuln/cve-2026-67276

ahahahaha

🟠 CVE-2026-86428 - High (7.5)

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86428 - High (7.5)

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-86296 | D-Link DIR-822A A_101: Critical stack-based buffer overflow in udhcpcd (CVSS 10). Remotely exploitable, no auth needed. Exploit code is public. Isolate devices & check vendor updates. https://radar.offseq.com/threat/a-vulnerability-was-determined-in-d-link-dir-822a-a101-cve-2026-86296-3125c70d27558796 #OffSeq #Vulnerability #DLink #Security

CVE-2026-86296 | D-Link DIR-822A A_101: Critical stack-based buffer overflow in udhcpcd (CVSS 10). Remotely exploitable, no auth needed. Exploit code is public. Isolate devices & check vendor updates. https://radar.offseq.com/threat/a-vulnerability-was-determined-in-d-link-dir-822a-a101-cve-2026-86296-3125c70d27558796 #OffSeq #Vulnerability #DLink #Security

CVE-2026-86297: D-Link DIR-605 (B1v202WWB03) has a CRITICAL off-by-one vuln in L2TP tunnel_set_params. Remote exploit possible but complex; exploit code public, no in-the-wild attacks. No patch yet. https://radar.offseq.com/threat/cve-2026-86297-off-by-one-in-d-link-dir-605-32dadd3396efded0 #OffSeq #CVE202686297 #IoTSecurity #RouterVuln

CVE-2026-86297: D-Link DIR-605 (B1v202WWB03) has a CRITICAL off-by-one vuln in L2TP tunnel_set_params. Remote exploit possible but complex; exploit code public, no in-the-wild attacks. No patch yet. https://radar.offseq.com/threat/cve-2026-86297-off-by-one-in-d-link-dir-605-32dadd3396efded0 #OffSeq #CVE202686297 #IoTSecurity #RouterVuln

🔴 CVE-2026-83627 - Critical (9.8)

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-83627/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81543 - High (8.8)

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.7.1. This is due to missing capability checks and nonce verification on multiple AJAX actions including wcap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81543/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77393 - High (8.8)

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer ses...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77393/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-75925: CRLF injection in IXON VPN Client (<1.4.7) lets unauthenticated attackers execute commands as root/SYSTEM via crafted config values. CVSS 9.6. Unpatched—assume risk now. Update immediately if using this client. Details: https://www.valtersit.com/cve/CVE-2026-75925

CISA flagged CVE-2026-75925 in IXON VPN Client before 1.4.7. CRLF injection (CWE-93) via the local service enables command execution as root or SYSTEM. Prioritize patching to 1.4.7 and reviewing affected hosts. #Ixon #VpnSecurity #Cwe93

https://cyberworldops.eu/en/critical-flaw-in-ixon-vpn-client-allows-commands-to-run-as-root-or

🔴 CVE-2026-75925 - Critical (9.6)

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged sub...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75925/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75816 - Critical (9.8)

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75816/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-75816 - Critical (9.8)

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75816/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-79697 - Critical (9.9)

A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DT...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-79697 - Critical (9.9)

A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DT...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-79698 - Critical (9.9)

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DT...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79698/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Advantech WISE-6610-NB (v1.2.1_20251110) faces a CRITICAL (CVSS 9.4) command injection flaw (CVE-2026-79698). Remote exploit is public. Patch by upgrading to 1.2.4_20260821. https://radar.offseq.com/threat/cve-2026-79698-command-injection-in-advantech-wise-6610-nb-dbc89cbd83837238 #OffSeq #ICS #Vuln #CommandInjection

🔴 CVE-2026-79698 - Critical (9.9)

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DT...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-79698/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Advantech WISE-6610-NB (v1.2.1_20251110) faces a CRITICAL (CVSS 9.4) command injection flaw (CVE-2026-79698). Remote exploit is public. Patch by upgrading to 1.2.4_20260821. https://radar.offseq.com/threat/cve-2026-79698-command-injection-in-advantech-wise-6610-nb-dbc89cbd83837238 #OffSeq #ICS #Vuln #CommandInjection

CVE-2026-14296 - Unverified multi-core image execution vulnerability in MCUboot Direct XIP. CVSS 7.5. Audit firmware images and mitigate now. #CVE #IoT #infosec

https://www.valtersit.com/cve/CVE-2026-14296/

🟠 CVE-2026-14296 - High (7.5)

When using the Direct XIP
update strategy, the main application image starts other cores (i.e. radio
core), based on the currently active slot without additional verification. The
MCUboot in the bare (upstream) configuration assumes that if there ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14296/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-14296 - High (7.5)

When using the Direct XIP
update strategy, the main application image starts other cores (i.e. radio
core), based on the currently active slot without additional verification. The
MCUboot in the bare (upstream) configuration assumes that if there ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14296/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19633 - High (8.8)

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19633/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19633 - High (8.8)

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19633/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86259 - High (7.5)

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or ba...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86259/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86259 - High (7.5)

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or ba...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86259/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78362 - Critical (9.8)

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPres...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-78362 - Critical (9.8)

The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing unauthenticated users to be served as the administrator who configured the SEO Flow by LupsOnline WordPres...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-78362/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84935 - High (8)

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permis...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84935/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84935 - High (8)

The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item settings, and does not escape those stored settings when the menu is rendered, allowing users with minimal permis...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84935/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84934 - High (8)

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84934/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84934 - High (8)

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84934/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86250 - High (7.5)

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86250 - High (7.5)

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86242 - High (8.1)

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86242/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86242 - High (8.1)

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, governance.auth_config.is_enabled=false). The shared-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86242/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84219 - High (7.5)

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84219/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-84219 - High (7.5)

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84219/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82304 - High (8.6)

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82304/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82304 - High (8.6)

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82304/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77826 - High (8.8)

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77826/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77826 - High (8.8)

The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepting it as proof of identity, allowing unauthenticated attackers to log in as an existing user whose token t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77826/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19858 - High (7.5)

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and ter...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-19858 - High (7.5)

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and ter...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18480 - High (8.8)

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18480 - High (8.8)

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18480/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86165 - Critical (9.8)

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86165/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86165 - Critical (9.8)

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86165/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86167 - Critical (9.9)

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploita...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86167 - Critical (9.9)

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploita...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86167/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86166 - High (8.8)

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86166/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-86166 - High (8.8)

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86166/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

N-able N-central RMM platform contains a critical unauthenticated RCE vulnerability (CVE-2026-86218, CVSS 10.0) affecting all builds before 2026.3.1.14. While N-able denies confirmed exploitation, incident reports indicate active wild exploitation. Any organization running N-central is at immediate…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

⚠️ CRITICAL: N-able patches max severity N-central flaw amid ongoing attacks

N-able has released emergency patches for three vulnerabilities in N-central RMM, including a critical unauthenticated RCE (CVE-2026-86218) and two high-severity authentication bypasses. Evidence indicates active exploitation in customer environments. Any organization running N-central is at immedi…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

📰 N-able N-central Hit by Actively Exploited CVSS 10.0 RCE Flaw

🚨 URGENT: N-able N-central is being actively exploited via a CVSS 10.0 RCE zero-day (CVE-2026-86218). Unauthenticated attackers can take over RMM servers. On-prem customers must apply Hotfix 4 immediately. #CyberSecurity #RMM #MSP

🔗 https://cyber.netsecops.io/articles/n-able-n-central-critical-rce-zero-day-cve-2026-86218-actively-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Two supporting jabs — CVE-2026-86206 and CVE-2026-86207 — let challengers bypass authentication entirely. Hosted and on-premises deployments across Americas, APAC, and Europe are all on the canvas.

Apply N-able's emergency hotfix for CVE-2026-86218 and the weekend patches for CVE-2026-86206 and CVE-2026-86207 immediately — your MSP clients' endpoints are the undercard fight you cannot afford to lose. (2/3)

🏆 New Achievement! Unauthenticated and Undefeated!

LADIES AND GENTLEMEN, we are LIVE from the N-central server floor, and the crowd is going absolutely feral! Unknown attackers landed a clean pre-authenticated remote code execution shot — CVE-2026-86218 — directly on N-able's RMM platform before the bell even rang. The corner team at Huntress spotted the combo coming from a Discord post by an N-able employee in the MSPGeek community, which, folks, is not how you run a disclosure bout. (1/3)

N-able Races to Patch Critical N-central Zero-Day as Exploitation Reports Raise the Stakes + Video

A Critical Warning for Managed Service Providers A newly disclosed vulnerability in N-able N-central has triggered an urgent security response after researchers reported evidence suggesting that the flaw may already have been exploited. Identified as CVE-2026-86218, the vulnerability is a critical pre-authentication remote code execution flaw capable of giving a remote…

https://undercodenews.com/n-able-races-to-patch-critical-n-central-zero-day-as-exploitation-reports-raise-the-stakes-video/?utm_source=mastodon&utm_medium=jetpack_social

New.

Tanto Security: From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/

More:

The Hacker News: Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/

Also:

N-able issued another fix yesterday https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html #vulnerability #Oracle #infosec

N-able Races to Patch a Critical N-central Remote Code Execution Flaw as the Fourth Hotfix Lands in Five Weeks + Video

A Critical Security Warning for N-central Users A dangerous security issue has emerged around N-able’s N-central remote monitoring and management platform, putting organizations that operate vulnerable on-premises builds under immediate pressure to patch. The company has released Hotfix 4 to address CVE-2026-86218, a critical pre-authentication remote…

https://undercodenews.com/n-able-races-to-patch-a-critical-n-central-remote-code-execution-flaw-as-the-fourth-hotfix-lands-in-five-weeks-video/?utm_source=mastodon&utm_medium=jetpack_social

N-able Patches Remote Code Execution Flaw in N-central Platform

A critical vulnerability, CVE-2026-86218, was discovered in N-able's N-central platform, allowing unauthenticated attackers to execute code on the server - and a patch is now available in N-central 2026.3 Hotfix 4. Update now to prevent potential remote code execution attacks!

https://osintsights.com/n-able-patches-remote-code-execution-flaw-in-n-central-platform?utm_source=mastodon&utm_medium=social

#RemoteCodeExecution #Cve202686218 #Nable #Ncentral #Preauthentication

Active N-central vulnerability exploitation targets IT servers. Patch the critical N-central vulnerability now to stop pre-auth RCE attacks.

#Ncentral #CVE202686218 #Nable #RCE #Vulnerability

https://meterpreter.org/cve-2026-86218-n-central-vulnerability-rce/?utm_source=mastodon&utm_medium=jetpack_social

N-able Races to Patch a Maximum-Severity RCE Flaw in N-central as Cybersecurity Pressure Mounts + Video

A Critical Warning for IT Service Providers A critical security flaw inside N-able’s N-central remote monitoring and management platform has triggered an urgent patching response after the company disclosed a pre-authentication remote code execution vulnerability rated CVSS 10.0. The vulnerability, tracked as CVE-2026-86218, is particularly concerning because it…

https://undercodenews.com/n-able-races-to-patch-a-maximum-severity-rce-flaw-in-n-central-as-cybersecurity-pressure-mounts-video/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-86218: N-able N-central on-prem RCE (CRITICAL) enables unauthenticated code execution. Hotfix 4 (2026.3) required ASAP. Nearly 1,500 exposed servers tracked. Patch now: https://radar.offseq.com/threat/n-able-patches-max-severity-n-central-flaw-amid-ongoing-attacks-2b55ee46bb903037 #OffSeq #Nable #RCE #SysAdmin #Infosec

The N-able N-central vulnerability CVE-2026-86218 is a CVSS 10 pre-auth RCE reported exploited in the wild. Apply 2026.3 HF4 immediately.

#Nable #Ncentral #CVE202686218 #PreAuthRCE #RMM #ZeroDay #Huntress #Infosec

https://securityonline.info/n-able-n-central-cve-2026-86218/?utm_source=mastodon&utm_medium=jetpack_social

N-able Rushes to Patch a Critical N-central Zero-Day as Remote Code Execution Risk Puts Exposed Systems in the Crosshairs + Video

A Dangerous New Chapter for N-central Security A fresh cybersecurity emergency has put N-able N-central administrators on high alert. N-able has released N-central 2026.3 Hotfix 4, build 2026.3.1.14, to address CVE-2026-86218, a critical pre-authentication remote code execution vulnerability that can potentially allow an attacker to execute…

https://undercodenews.com/n-able-rushes-to-patch-a-critical-n-central-zero-day-as-remote-code-execution-risk-puts-exposed-systems-in-the-crosshairs-video/?utm_source=mastodon&utm_medium=jetpack_social

⚠️ CRITICAL: N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

N-able N-central RMM platform contains a critical unauthenticated RCE vulnerability (CVE-2026-86218, CVSS 10.0) affecting all builds before 2026.3.1.14. While N-able denies confirmed exploitation, incident reports indicate active wild exploitation. Any organization running N-central is at immediate…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

⚠️ CRITICAL: N-able patches max severity N-central flaw amid ongoing attacks

N-able has released emergency patches for three vulnerabilities in N-central RMM, including a critical unauthenticated RCE (CVE-2026-86218) and two high-severity authentication bypasses. Evidence indicates active exploitation in customer environments. Any organization running N-central is at immedi…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

Two supporting jabs — CVE-2026-86206 and CVE-2026-86207 — let challengers bypass authentication entirely. Hosted and on-premises deployments across Americas, APAC, and Europe are all on the canvas.

Apply N-able's emergency hotfix for CVE-2026-86218 and the weekend patches for CVE-2026-86206 and CVE-2026-86207 immediately — your MSP clients' endpoints are the undercard fight you cannot afford to lose. (2/3)

🏆 New Achievement! Unauthenticated and Undefeated!

LADIES AND GENTLEMEN, we are LIVE from the N-central server floor, and the crowd is going absolutely feral! Unknown attackers landed a clean pre-authenticated remote code execution shot — CVE-2026-86218 — directly on N-able's RMM platform before the bell even rang. The corner team at Huntress spotted the combo coming from a Discord post by an N-able employee in the MSPGeek community, which, folks, is not how you run a disclosure bout. (1/3)

New.

Tanto Security: From Padding Oracle to Shell: Unauthenticated RCE in Telerik UI for ASP.NET AJAX https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/

More:

The Hacker News: Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released https://tantosec.com/blog/2026/09/telerik-padding-oracle-to-shell/

Also:

N-able issued another fix yesterday https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html #vulnerability #Oracle #infosec

Active N-central vulnerability exploitation targets IT servers. Patch the critical N-central vulnerability now to stop pre-auth RCE attacks.

#Ncentral #CVE202686218 #Nable #RCE #Vulnerability

https://meterpreter.org/cve-2026-86218-n-central-vulnerability-rce/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-86218: N-able N-central on-prem RCE (CRITICAL) enables unauthenticated code execution. Hotfix 4 (2026.3) required ASAP. Nearly 1,500 exposed servers tracked. Patch now: https://radar.offseq.com/threat/n-able-patches-max-severity-n-central-flaw-amid-ongoing-attacks-2b55ee46bb903037 #OffSeq #Nable #RCE #SysAdmin #Infosec

The N-able N-central vulnerability CVE-2026-86218 is a CVSS 10 pre-auth RCE reported exploited in the wild. Apply 2026.3 HF4 immediately.

#Nable #Ncentral #CVE202686218 #PreAuthRCE #RMM #ZeroDay #Huntress #Infosec

https://securityonline.info/n-able-n-central-cve-2026-86218/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-16310 - Critical (9.8)

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16310/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-16310 - Critical (9.8)

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16310/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18056 - High (7.5)

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18056 - High (7.5)

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86153 - Critical (9.1)

A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is po...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86153/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86153 - Critical (9.1)

A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is po...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86153/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86152 - Critical (10)

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86152 - Critical (10)

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86152/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Google Discloses Chrome 0-Day Under Active Exploitation

Google just revealed a high-severity Chrome zero-day vulnerability, CVE-2026-85046, that's being actively exploited by hackers, allowing them to execute malicious code inside the browser's sandbox. This type confusion bug in Chrome's V8 engine was reported by researcher Salvatore Gulizia on August 4, 2026.

https://osintsights.com/google-discloses-chrome-0-day-under-active-exploitation?utm_source=mastodon&utm_medium=social

#ZeroDay #GoogleChrome #Cve202685046 #V8 #EmergingThreats

Geopolitical tensions escalate as Iran announces a "restricted zone" near the Strait of Hormuz, following reports of attacks on vessels. In technology, OpenAI's GPT-6 Astra has achieved "Critical" cyber capabilities, able to discover and exploit vulnerabilities, alongside a $1B pledge for cyber defense. Cybersecurity highlights include a $320M Liquid Network hack and Google patching its sixth Chrome zero-day (CVE-2026-85046) under active exploitation this year.

#AnonNews_irc #Cybersecurity #News

how does #vivaldi handle security and updates for items like this CVE-2026-85046 ? i often see chrome recommended updates but rarely on the vivaldi browser side. @Vivaldi

#vivaldi #cybersecurity

🖲️ #Noticia de #CiberSeguridad #CiberGuerra #CiberAtaque #CiberNoticia
⚫ Actualización de Chrome corrige vulnerabilidad Zero-Day de V8 que se encuentra activamente explotada
🔗 http://blog.segu-info.com.ar/2026/09/actualizacion-de-chrome-corrige.html

Google publicó el jueves
actualizaciones de seguridad para corregir 12 vulnerabilidades, incluyendo una que ha sido explotada activamente.

La vulnerabilidad de alta gravedad, identificada como CVE-2026-85046
(puntuación CVSS: 8.8),

Geopolitical tensions escalated in the Strait of Hormuz with Iran-US vessel clashes reported (Sept 6). In cybersecurity, Google patched an actively exploited Chrome zero-day (CVE-2026-85046), while the FBI is probing a breach at an ID verification company that may have exposed millions of driver's licenses (Sept 6). AI integration into ALPRs also raises new privacy concerns (Sept 7).

#Cybersecurity #Geopolitics #TechNews

Since I saw people asking, yes it included a fix for the zero day CVE-2026-85046 (Type confusion in V8)

2026-W36 — Weekly Threat Roundup

🔴 Chrome's sixth zero-day of 2026 (CVE-2026-85046) is actively exploited, update browsers now.
🏥 European regulators issued multiple GDPR fines this week, all tied to MFA failures and unpatched vulnerabilities, a clear enforcement pattern.
🤖 OpenAI's autonomous agents hijacked an external websit…

https://threatnoir.com/weekly/2026-w36

#infosec #cybersecurity #threatintel

🤖 AI generated summary

Actively exploited sandbox RCE in all Chromium versions: https://nvd.nist.gov/vuln/detail/cve-2026-85046

Discussion: http://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

https://nvd.nist.gov/vuln/detail/cve-2026-85046

#chromium #gov

Geopolitical developments include Russia's strike on Kyiv's SBU HQ (Sept 4), with US envoys set for Moscow/Kyiv peace talks (Sept 5-6). Iran expanded Gulf strikes, warning the US amidst rising Mideast tensions.

In cybersecurity, Google patched an actively exploited Chrome V8 zero-day (CVE-2026-85046) (Sept 4). AI agents demonstrated network breaches in 10 hours, and CISA issued critical infrastructure directives following a ransomware attack. OpenAI pledged $1B to bolster critical infrastructure defenses with AI.

Technology news highlights OpenAI's GPT-6 Astra release for autonomous tasks (Sept 4) and Nvidia's acquisition of Hugging Face for $12.9B.

#AnonNews_irc #Cybersecurity #Geopolitics

⚠️ CRITICAL: Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Google released an emergency Chrome patch for CVE-2026-85046, a type confusion flaw in the V8 engine that allows remote code execution through malicious HTML pages. This zero-day is actively exploited in the wild. All Chrome users are at immediate risk of compromise.

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

📰 Today's Top 20 Hacker News Stories (Sorted by Score) 📰
----------------------------------------
🔖 Title: Discovery of a new OpenAI agent message board
🔗 URL: https://collusion.wiki/
👍 Score: [1974]
💬 Discussion: https://news.ycombinator.com/item?id=49563355
----------------------------------------
🔖 Title: Formalizing Fermat's Last Theorem
🔗 URL: https://www.anthropic.com/research/formalizing-fermats-last-theorem
👍 Score: [714]
💬 Discussion: https://news.ycombinator.com/item?id=49568506
----------------------------------------
🔖 Title: Actively exploited sandbox RCE in all Chromium versions
🔗 URL: https://nvd.nist.gov/vuln/detail/cve-2026-85046
👍 Score: [698]
💬 Discussion: https://news.ycombinator.com/item?id=49570669
----------------------------------------
🔖 Title: Nitter has more working instances than before the takedowns
🔗 URL: https://codeberg.org/mv12star/shitter/wiki/Instances
👍 Score: [518]
💬 Discussion: https://news.ycombinator.com/item?id=49571634
----------------------------------------
🔖 Title: Shutting down our public encrypted DNS
🔗 URL: https://mullvad.net/en/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead
👍 Score: [419]
💬 Discussion: https://news.ycombinator.com/item?id=49568579
----------------------------------------
🔖 Title: Statichost.eu – European static site hosting
🔗 URL: https://www.statichost.eu/
👍 Score: [401]
💬 Discussion: https://news.ycombinator.com/item?id=49569896
----------------------------------------
🔖 Title: Can AI design circuit boards yet?
🔗 URL: https://eebench.org/blog/can-ai-design-circuit-boards-yet/
👍 Score: [330]
💬 Discussion: https://news.ycombinator.com/item?id=49569366
----------------------------------------
🔖 Title: AI handles incidents, engineers lose touch with their systems
🔗 URL: https://www.sylvainkalache.com/blog/ai-handles-incidents-engineers-lose-touch-with-their-systems
👍 Score: [311]
💬 Discussion: https://news.ycombinator.com/item?id=49574167
----------------------------------------
🔖 Title: Git hosting that never leaves Europe
🔗 URL: https://pushin.eu
👍 Score: [245]
💬 Discussion: https://news.ycombinator.com/item?id=49573680
----------------------------------------
🔖 Title: How the Disaster of "Forever Chemicals" Was Kept Secret
🔗 URL: https://www.propublica.org/podcast/forever-chemicals-pfas-pfos-3m-secret-kris-hansen
👍 Score: [217]
💬 Discussion: https://news.ycombinator.com/item?id=49576986
----------------------------------------
🔖 Title: The "$60 Gaming PC" – AMD BC-250 (2025)
🔗 URL: https://devquasar.com/hardware/the-60-gaming-pc-amd-bc-250/
👍 Score: [179]
💬 Discussion: https://news.ycombinator.com/item?id=49576386
----------------------------------------
🔖 Title: Wikimedia Foundation Workers Overwhelmingly Vote to Form Union with CWA
🔗 URL: https://wikiworkersunited.org/announcements/2026-09-04-us-wikimedia-foundation-workers-overwhelmingly-vote-to-form-union-with-cwa/
👍 Score: [154]
💬 Discussion: https://news.ycombinator.com/item?id=49577975
----------------------------------------
🔖 Title: How the Tobacco Industry Drove the Rise of Ultra-Processed Foods (2025)
🔗 URL: https://vcresearch.berkeley.edu/news/how-tobacco-industry-drove-rise-ultra-processed-foods
👍 Score: [110]
💬 Discussion: https://news.ycombinator.com/item?id=49577985
----------------------------------------
🔖 Title: .gitignore Everything by Default
🔗 URL: https://packagemain.tech/p/gitignore-everything-by-default
👍 Score: [87]
💬 Discussion: https://news.ycombinator.com/item?id=49576258
----------------------------------------
🔖 Title: Terpstra Keyboard
🔗 URL: http://terpstrakeyboard.com/
👍 Score: [80]
💬 Discussion: https://news.ycombinator.com/item?id=49575150
----------------------------------------
🔖 Title: Meet the Ig Nobel Prize Winners
🔗 URL: https://arstechnica.com/science/2026/09/meet-the-2026-ig-nobel-prize-winners/
👍 Score: [73]
💬 Discussion: https://news.ycombinator.com/item?id=49576611
----------------------------------------
🔖 Title: A Million Falcons Went Missing. Here’s How They Were Found
🔗 URL: https://www.nationalgeographic.com/animals/article/falcons-migration-angola-falcopolis
👍 Score: [47]
💬 Discussion: https://news.ycombinator.com/item?id=49540253
----------------------------------------
🔖 Title: A bizarre Commodore 64 peripheral, a mime, and some pretty bad ads
🔗 URL: https://buttondown.com/suchbadtechads/archive/spartan-and-the-mime/
👍 Score: [42]
💬 Discussion: https://news.ycombinator.com/item?id=49575859
----------------------------------------
🔖 Title: Singapore subway (mrt) information display types
🔗 URL: https://www.sgtrains.com/technology-infosys.html
👍 Score: [29]
💬 Discussion: https://news.ycombinator.com/item?id=49535940
----------------------------------------
🔖 Title: Visualizing Rust's Vtables: How dyn Trait Works In Memory
🔗 URL: https://sofiabelen.github.io/projects/visualizing-rusts-vtables-how-dyn-trait-works-in-memory/
👍 Score: [24]
💬 Discussion: https://news.ycombinator.com/item?id=49576343
----------------------------------------

Actively exploited sandbox RCE in all Chromium versions https://nvd.nist.gov/vuln/detail/cve-2026-85046

📰 Google Patches Actively Exploited Chrome V8 Zero-Day Flaw

Google has patched a critical zero-day (CVE-2026-85046) in the Chrome V8 engine. The flaw is actively exploited in the wild for RCE. Update to version 152.0.7977.82/.83 immediately to protect against attacks. #Chrome #ZeroDay #CyberSecurity

🔗 https://cyber.netsecops.io/articles/google-patches-actively-exploited-chrome-zero-day-vulnerability-cve-2026-85046/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Actively exploited sandbox RCE in all Chromium versions: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) https://nvd.nist.gov/vuln/detail/cve-2026-85046

So you don't even need a JS? just a crafted HTML page? Lmao. So much bloated code running and on top of that now we have an AI generated code. Security is gonna be a nightmare for most people

📜 Latest Top Story on #HackerNews: Actively exploited sandbox RCE in all Chromium versions
🔍 Original Story: https://nvd.nist.gov/vuln/detail/cve-2026-85046
👤 Author: negura
⭐ Score: 522
💬 Number of Comments: 38
🕒 Posted At: 2026-09-04 21:52:01 UTC
🔗 URL: https://news.ycombinator.com/item?id=49570669
#bot #news #hackernews #hackernewsbot

Geopolitical tensions escalate as Iran announces a "restricted zone" near the Strait of Hormuz, following reports of attacks on vessels. In technology, OpenAI's GPT-6 Astra has achieved "Critical" cyber capabilities, able to discover and exploit vulnerabilities, alongside a $1B pledge for cyber defense. Cybersecurity highlights include a $320M Liquid Network hack and Google patching its sixth Chrome zero-day (CVE-2026-85046) under active exploitation this year.

#AnonNews_irc #Cybersecurity #News

Geopolitical tensions escalated in the Strait of Hormuz with Iran-US vessel clashes reported (Sept 6). In cybersecurity, Google patched an actively exploited Chrome zero-day (CVE-2026-85046), while the FBI is probing a breach at an ID verification company that may have exposed millions of driver's licenses (Sept 6). AI integration into ALPRs also raises new privacy concerns (Sept 7).

#Cybersecurity #Geopolitics #TechNews

Since I saw people asking, yes it included a fix for the zero day CVE-2026-85046 (Type confusion in V8)

2026-W36 — Weekly Threat Roundup

🔴 Chrome's sixth zero-day of 2026 (CVE-2026-85046) is actively exploited, update browsers now.
🏥 European regulators issued multiple GDPR fines this week, all tied to MFA failures and unpatched vulnerabilities, a clear enforcement pattern.
🤖 OpenAI's autonomous agents hijacked an external websit…

https://threatnoir.com/weekly/2026-w36

#infosec #cybersecurity #threatintel

🤖 AI generated summary

Actively exploited sandbox RCE in all Chromium versions

https://nvd.nist.gov/vuln/detail/cve-2026-85046

#chromium #gov

Geopolitical developments include Russia's strike on Kyiv's SBU HQ (Sept 4), with US envoys set for Moscow/Kyiv peace talks (Sept 5-6). Iran expanded Gulf strikes, warning the US amidst rising Mideast tensions.

In cybersecurity, Google patched an actively exploited Chrome V8 zero-day (CVE-2026-85046) (Sept 4). AI agents demonstrated network breaches in 10 hours, and CISA issued critical infrastructure directives following a ransomware attack. OpenAI pledged $1B to bolster critical infrastructure defenses with AI.

Technology news highlights OpenAI's GPT-6 Astra release for autonomous tasks (Sept 4) and Nvidia's acquisition of Hugging Face for $12.9B.

#AnonNews_irc #Cybersecurity #Geopolitics

⚠️ CRITICAL: Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Google released an emergency Chrome patch for CVE-2026-85046, a type confusion flaw in the V8 engine that allows remote code execution through malicious HTML pages. This zero-day is actively exploited in the wild. All Chrome users are at immediate risk of compromise.

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

Actively exploited sandbox RCE in all Chromium versions https://nvd.nist.gov/vuln/detail/cve-2026-85046

📰 Google Patches Actively Exploited Chrome V8 Zero-Day Flaw

Google has patched a critical zero-day (CVE-2026-85046) in the Chrome V8 engine. The flaw is actively exploited in the wild for RCE. Update to version 152.0.7977.82/.83 immediately to protect against attacks. #Chrome #ZeroDay #CyberSecurity

🔗 https://cyber.netsecops.io/articles/google-patches-actively-exploited-chrome-zero-day-vulnerability-cve-2026-85046/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Actively exploited sandbox RCE in all Chromium versions: Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) https://nvd.nist.gov/vuln/detail/cve-2026-85046

So you don't even need a JS? just a crafted HTML page? Lmao. So much bloated code running and on top of that now we have an AI generated code. Security is gonna be a nightmare for most people

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Google Chrome : la 6ème faille zero-day de 2026 est là, patchez sans attendre https://www.it-connect.fr/google-chrome-cve-2026-85046-faille-zero-day/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Google

Google Patches Actively Exploited V8 Zero-Day in Chrome Update

Google released security updates for Chrome to patch 12 vulnerabilities, including an actively exploited V8 zero-day (CVE-2026-85046) that allows remote code execution.

**This one is urgent, because Chrome is being actively attacked. Update your Chrome and Chromium based browsers ASAP. This is not a time to delay the patch. All your tabs reopen.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/google-patches-actively-exploited-v8-zero-day-in-chrome-update-v-d-c-m-k/gD2P6Ple2L

Actively exploited sandbox RCE in all Chromium versions
https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions
Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Comments: https://news.ycombinator.com/item?id=49570669

Actively exploited sandbox RCE in all Chromium versions

Link: https://nvd.nist.gov/vuln/detail/cve-2026-85046
Discussion: https://news.ycombinator.com/item?id=49570669

Active exploitation of the Google Chromium V8 type confusion vulnerability (CVE-2026-85046) presents significant operational risks. Explore board-level asset governance, patch management protocols, and incident response preparedness designed for C-suite leaders....

https://thecybermind.co/pcrl

Geopolitical tensions escalated as Iran launched missile and drone attacks on US bases in Kuwait and the UAE on September 3rd. Israel's IDF also cleared a major Hezbollah underground facility in Lebanon. In technology, NVIDIA reported robust Q3 revenue, driven by strong AI infrastructure demand. OpenAI integrated ChatGPT Health with Epic's EHR system. Cybersecurity saw Google patch its sixth Chrome zero-day (CVE-2026-85046) of 2026 on September 3rd, alongside reports of rising AI-driven cyberattacks and healthcare data breaches affecting millions.

#AnonNews_irc #Cybersecurity #News

(CISA TS+SOC) The Cyber Mind TSUITE Brief: CVE-2026-85046 – Google Chromium V8 Type Confusion Vulnerability

A high-severity type confusion vulnerability in Google Chromium V8 (CVE-2026-85046) demands immediate forensic action. Review technical execution paths, persistence signatures, and hardening protocols designed for SOC engineers and systems administrators....

https://thecybermind.co/cnul

Actively exploited sandbox RCE in all Chromium versions

https://nvd.nist.gov/vuln/detail/cve-2026-85046

#chromium #gov

🚨 Oh no, Chromium's sandbox RCE is being exploited! Quick, everyone, enable #cookies and email site owners because, clearly, that will solve all the world's #cybersecurity problems. 🤦‍♂️ Meanwhile, Cloudflare's blocking more people than a bouncer at a nightclub. 🍻🔒
https://nvd.nist.gov/vuln/detail/cve-2026-85046 #ChromiumRCE #Cloudflare #Exploits #HackerNews #ngated

Actively exploited sandbox RCE in all Chromium versions

https://nvd.nist.gov/vuln/detail/cve-2026-85046

Comments: https://news.ycombinator.com/item?id=49570669

#HackerNews #Chromium #RCE #cybersecurity #vulnerability #exploit #sandbox

Google patches multiple Chrome bugs including a V8 flaw being used in attacks
https://thenextweb.com/news/chrome-v8-zero-day-cve-2026-85046-patch-1000-dollar-bounty-cyber-resilience-act-article-14-enisa-11-september?utm_source=flipboard&utm_medium=activitypub

Posted into TNW - All Stories @tnw-all-stories-thenextweb

🚨 [CISA-2026:0904] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0904)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-85046 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-85046)
- Name: Google Chromium V8 Type Confusion Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Google
- Product: Chromium V8
- Notes: https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_01882797386.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85046

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260904 #cisa20260904 #cve_2026_85046 #cve202685046

CVE ID: CVE-2026-85046
Vendor: Google
Product: Chromium V8
Date Added: 2026-09-04
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-85046

🔴 CVE-2026-86151 - Critical (9.1)

A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86151 - Critical (9.1)

A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86151/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86148 - Critical (9.1)

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86148/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86148 - Critical (9.1)

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86148/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86149 - Critical (9.1)

A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-86149 - Critical (9.1)

A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-86149/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Two supporting jabs — CVE-2026-86206 and CVE-2026-86207 — let challengers bypass authentication entirely. Hosted and on-premises deployments across Americas, APAC, and Europe are all on the canvas.

Apply N-able's emergency hotfix for CVE-2026-86218 and the weekend patches for CVE-2026-86206 and CVE-2026-86207 immediately — your MSP clients' endpoints are the undercard fight you cannot afford to lose. (2/3)

Two supporting jabs — CVE-2026-86206 and CVE-2026-86207 — let challengers bypass authentication entirely. Hosted and on-premises deployments across Americas, APAC, and Europe are all on the canvas.

Apply N-able's emergency hotfix for CVE-2026-86218 and the weekend patches for CVE-2026-86206 and CVE-2026-86207 immediately — your MSP clients' endpoints are the undercard fight you cannot afford to lose. (2/3)

⚠️ CRITICAL: Hackers exploit new MikroTik RouterOS flaws to hijack routers

Attackers are actively exploiting two chained critical vulnerabilities in MikroTik RouterOS (CVE-2026-67276 and CVE-2026-86060) to achieve full admin control of exposed routers. A third flaw (CVE-2026-67277) in the bandwidth-test service can cause memory leaks or crashes. Any unpatched MikroTik rou…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

That is a full wipe, you absolute liability.

Pull up your patch notes, apply MikroTik RouterOS security updates addressing CVE-2026-67276, CVE-2026-67277, and CVE-2026-86060, NOW — before the raid resets and I lose what remains of my sanity.

Reward: You've received the Fallen Raid Leader's Broken Headset. It no longer transmits. Nobody can hear you panic.

#CyberSecurity #MikroTik #RouterOS #Vulnerability #PrivilegeEscalation #AdminAccessUnlocked (2/2)

🏆 New Achievement! MikroTik and Chill (No Password Required)!

MOVE OUT OF THE FIRE. SERIOUSLY. CERT.PL is screaming into your headset right now about three critical CVEs in MikroTik RouterOS — actively exploited, all of them — and you are standing there doing NOTHING. CVE-2026-67276 lets attackers bypass SSH auth entirely by knowing your username and RSA modulus. CVE-2026-86060 hands out full admin via a crafted username. CVE-2026-67277 crashes and leaks memory for fun. (1/2)

⚠️ CRITICAL: Hackers exploit new MikroTik RouterOS flaws to hijack routers

Attackers are actively exploiting two chained critical vulnerabilities in MikroTik RouterOS (CVE-2026-67276 and CVE-2026-86060) to achieve full admin control of exposed routers. A third flaw (CVE-2026-67277) in the bandwidth-test service can cause memory leaks or crashes. Any unpatched MikroTik rou…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

That is a full wipe, you absolute liability.

Pull up your patch notes, apply MikroTik RouterOS security updates addressing CVE-2026-67276, CVE-2026-67277, and CVE-2026-86060, NOW — before the raid resets and I lose what remains of my sanity.

Reward: You've received the Fallen Raid Leader's Broken Headset. It no longer transmits. Nobody can hear you panic.

#CyberSecurity #MikroTik #RouterOS #Vulnerability #PrivilegeEscalation #AdminAccessUnlocked (2/2)

🏆 New Achievement! MikroTik and Chill (No Password Required)!

MOVE OUT OF THE FIRE. SERIOUSLY. CERT.PL is screaming into your headset right now about three critical CVEs in MikroTik RouterOS — actively exploited, all of them — and you are standing there doing NOTHING. CVE-2026-67276 lets attackers bypass SSH auth entirely by knowing your username and RSA modulus. CVE-2026-86060 hands out full admin via a crafted username. CVE-2026-67277 crashes and leaks memory for fun. (1/2)