🟠 CVE-2026-89236 - High (8.6)

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive info...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89236/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89236 - High (8.6)

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive info...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89236/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88783 - High (8.8)

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88783/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88783 - High (8.8)

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88783/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96451 - High (8.8)

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96451/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96451 - High (8.8)

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96451/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103514 - High (7.5)

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103514/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103514 - High (7.5)

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103514/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101161 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of ser...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101161/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101161 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of ser...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101161/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101159 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101159/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101159 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101159/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96267 - High (7.5)

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96267/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96267 - High (7.5)

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96267/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91078 - High (8.2)

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91078/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91078 - High (8.2)

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91078/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19660 - Critical (9.8)

The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19660/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-15897 - High (8.8)

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its registe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15897/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103624 - High (8.3)

Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromiu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103624 - High (8.3)

Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromiu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101923 - High (8.1)

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101923/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101923 - High (8.1)

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101923/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101160 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101160 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103065 - High (8.2)

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103065/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103065 - High (8.2)

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103065/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105115 - High (8.6)

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* wi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105115/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105115 - High (8.6)

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* wi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105115/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105105 - Critical (9.8)

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

NASA-AMMOS AIT-Core ≤3.1.1 has a CRITICAL vuln (CVE-2026-105105): ZeroMQ bus lacks auth, exposing command & telemetry to remote attackers. Upgrade to 3.1.2 restricts access to loopback. Details: https://radar.offseq.com/threat/cve-2026-105105-cwe-306-missing-authentication-for-critical-function-in-nasa-ammos-ait-core-6642dd3ce660454d #OffSeq #CVE #SpaceSec #Infosec

🔴 CVE-2026-105105 - Critical (9.8)

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

NASA-AMMOS AIT-Core ≤3.1.1 has a CRITICAL vuln (CVE-2026-105105): ZeroMQ bus lacks auth, exposing command & telemetry to remote attackers. Upgrade to 3.1.2 restricts access to loopback. Details: https://radar.offseq.com/threat/cve-2026-105105-cwe-306-missing-authentication-for-critical-function-in-nasa-ammos-ait-core-6642dd3ce660454d #OffSeq #CVE #SpaceSec #Infosec

🟠 CVE-2026-75028 - High (7.5)

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75028/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75028 - High (7.5)

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75028/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94505 - High (8.1)

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94505/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94505 - High (8.1)

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94505/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-92084 - Critical (9.1)

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an acti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-92084 - Critical (9.1)

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an acti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CRITICAL CVE-2026-71885 in Bouncy Castle BC-JAVA (<1.86): Improper X.509 cert validation in MLS lets attackers impersonate users & compromise group comms. Upgrade to 1.86+ ASAP. https://radar.offseq.com/threat/cve-2026-71885-cwe-295-improper-certificate-validation-in-legion-of-the-bouncy-castle-inc-bc-java-13dda4ca65417833 #OffSeq #CVE202671885 #JavaSecurity #Infosec

CRITICAL CVE-2026-71885 in Bouncy Castle BC-JAVA (<1.86): Improper X.509 cert validation in MLS lets attackers impersonate users & compromise group comms. Upgrade to 1.86+ ASAP. https://radar.offseq.com/threat/cve-2026-71885-cwe-295-improper-certificate-validation-in-legion-of-the-bouncy-castle-inc-bc-java-13dda4ca65417833 #OffSeq #CVE202671885 #JavaSecurity #Infosec

CVE-2026-71887 | Legion of the Bouncy Castle BC-JAVA <1.86 has a HIGH severity flaw: improper signature verification can enable signature misattribution via public signing subkeys. Patch to 1.86+ now. https://radar.offseq.com/threat/cve-2026-71887-cwe-347-improper-verification-of-cryptographic-signature-in-legion-of-the-bouncy-castle-0eee2b4a5be9b093 #OffSeq #Vulnerability #Java #Infosec

CVE-2026-71887 | Legion of the Bouncy Castle BC-JAVA <1.86 has a HIGH severity flaw: improper signature verification can enable signature misattribution via public signing subkeys. Patch to 1.86+ now. https://radar.offseq.com/threat/cve-2026-71887-cwe-347-improper-verification-of-cryptographic-signature-in-legion-of-the-bouncy-castle-0eee2b4a5be9b093 #OffSeq #Vulnerability #Java #Infosec

🟠 CVE-2026-18443 - High (8.8)

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18443/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18443 - High (8.8)

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18443/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-87115 - Critical (9.1)

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87115/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

VikAppointments Booking Calendar plugin (<=1.2.21) for WordPress is vulnerable to CRITICAL path traversal (CVE-2026-87115). Unauth attackers can delete files, risking RCE. Check for File-type fields & secure your site! https://radar.offseq.com/threat/cve-2026-87115-cwe-22-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-59a71fc6e6540921 #OffSeq #WordPress #CVE202687115

🔴 CVE-2026-87115 - Critical (9.1)

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87115/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

VikAppointments Booking Calendar plugin (<=1.2.21) for WordPress is vulnerable to CRITICAL path traversal (CVE-2026-87115). Unauth attackers can delete files, risking RCE. Check for File-type fields & secure your site! https://radar.offseq.com/threat/cve-2026-87115-cwe-22-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-59a71fc6e6540921 #OffSeq #WordPress #CVE202687115

🟠 CVE-2026-103913 - High (7.5)

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103913/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103913 - High (7.5)

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103913/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97337 - High (7.5)

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97337/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97337 - High (7.5)

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97337/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97644 - High (8.8)

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97644/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97644 - High (8.8)

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97644/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-92536 - High (8.8)

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the g...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92536/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-92536 - High (8.8)

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the g...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92536/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103622 - High (8.8)

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103622/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103622 - High (8.8)

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103622/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93428 - High (7.5)

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93428 - High (7.5)

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105080 - Critical (9.9)

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105080 - Critical (9.9)

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-105080 (CRITICAL, CVSS 9.4) in C4illin ConvertX <0.19.0: Untrusted .recipe files can execute code via Calibre's ebook-convert. Update to 0.19.0+ recommended. https://radar.offseq.com/threat/cve-2026-105080-cwe-829-inclusion-of-functionality-from-untrusted-control-sphere-in-c4illin-convertx-bd5c3a85ca8190d3 #OffSeq #Vuln #CVE2026105080 #ConvertX #Calibre

🔴 CVE-2026-84411 - Critical (9.8)

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary cod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Saturday morning RouterOS 9.8 :apartyblobcat:

https://db.gcve.eu/vuln/cve-2026-84411

🔴 CVE-2026-84411 - Critical (9.8)

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary cod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Saturday morning RouterOS 9.8 :apartyblobcat:

https://db.gcve.eu/vuln/cve-2026-84411

CVE-2026-84411 (CRITICAL, CVSS 9.8) affects MikroTik RouterOS <7.24. Integer underflow in web mgmt lets unauth'd attackers exec root code or DoS via crafted HTTP. Restrict access & monitor now. https://radar.offseq.com/threat/cve-2026-84411-cwe-191-in-mikrotik-routeros-962ba80173301661 #OffSeq #CVE #MikroTik #InfoSec

🟠 CVE-2026-104433 - High (7.5)

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104433/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104433 - High (7.5)

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104433/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94592 - High (8.4)

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operatin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94592/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94592 - High (8.4)

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operatin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94592/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97363 - High (7.5)

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97363/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97363 - High (7.5)

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97363/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-95102 - Critical (9.4)

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95102/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Monta monta.app faces a CRITICAL risk (CVE-2026-95102, CVSS 9.4): missing auth on WebSocket endpoints allows attackers to impersonate charging stations & access sensitive data. Restrict access, monitor traffic. Details: https://radar.offseq.com/threat/cve-2026-95102-cwe-306-in-monta-montaapp-d0effdc35e6b46a2 #OffSeq #CVE202695102 #InfoSec ⚡️

🔴 CVE-2026-95102 - Critical (9.4)

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95102/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Monta monta.app faces a CRITICAL risk (CVE-2026-95102, CVSS 9.4): missing auth on WebSocket endpoints allows attackers to impersonate charging stations & access sensitive data. Restrict access, monitor traffic. Details: https://radar.offseq.com/threat/cve-2026-95102-cwe-306-in-monta-montaapp-d0effdc35e6b46a2 #OffSeq #CVE202695102 #InfoSec ⚡️

🟠 CVE-2026-94593 - High (7.8)

Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94593/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94593 - High (7.8)

Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94593/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94591 - High (8.4)

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94591/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94591 - High (8.4)

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94591/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Unpatched Apache OpenOffice vulnerability CVE-2026-59265 runs code via crafted files. Apache Directory LDAP API and Traffic Server fixes out.

#Apache #OpenOffice #ApacheDirectory #LDAP #TrafficServer #CVE202659265 #CVE2026103877 #Vulnerability

https://securityonline.info/apache-openoffice-vulnerability-ldap-api-traffic-server/?utm_source=mastodon&utm_medium=jetpack_social

Unpatched Apache OpenOffice vulnerability CVE-2026-59265 runs code via crafted files. Apache Directory LDAP API and Traffic Server fixes out.

#Apache #OpenOffice #ApacheDirectory #LDAP #TrafficServer #CVE202659265 #CVE2026103877 #Vulnerability

https://securityonline.info/apache-openoffice-vulnerability-ldap-api-traffic-server/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-104861 - High (7.5)

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /]*>/, which repeatedly scans to the end of input when attacker-cont...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Fastify/busboy DoS via oversized multipart boundary

@fastify/busboy 3.1.0 이상 3.2.1 미만에서 비정상적으로 긴 multipart boundary를 처리할 때 CPU 바운드 루프가 발생해 Node.js 이벤트 루프를 멈출 수 있는 DoS 취약점(CVE-2026-19484)이 공개됐다. 공격자는 인증 없이 작은 요청 하나로 이를 유발할 수 있으며, @fastify/busboy를 직접 사용하거나 @fastify/multipart를 통해 multipart/form-data를 파싱하는 서비스가 영향을 받는다. 원인은 252바이트 boundary가 내부 검색 needle을 256바이트로 만들며 U...

https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw

🟠 CVE-2026-82039 - High (8.8)

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82039 - High (8.8)

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82044 - High (7.7)

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() meth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82044 - High (7.7)

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() meth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82042 - Critical (9.8)

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82042 - Critical (9.8)

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82041 - Critical (9.9)

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before for...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82041/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82041 - Critical (9.9)

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before for...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82041/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104988 - High (8.1)

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104988 - High (8.1)

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39718 - High (8.8)

Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39718 - High (8.8)

Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96940 - High (8.8)

Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Microsoft lança atualizações urgentes para corrigir falha crítica no Exchange Server, que permite a elevação de privilégios e acesso não autorizado a caixas de correio de outros utilizadores. A falha, CVE-2026-96940, afeta várias versões do Exchange Server local. 🚨

🔗 https://tugatech.com.pt/t92180-microsoft-lanca-atualizacoes-urgentes-para-corrigir-falha-critica-no-exchange-server

#exchange #falha #lan #microsoft #server 

CVE-2026-96940 - Privilege Escalation in Microsoft Exchange Server from weak authorization. CVSS 8.8. Currently unpatched. Restrict network access now. #CVE #Microsoft #infosec

https://www.valtersit.com/cve/CVE-2026-96940/

🟠 CVE-2026-96940 - High (8.8)

Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Microsoft lança atualizações urgentes para corrigir falha crítica no Exchange Server, que permite a elevação de privilégios e acesso não autorizado a caixas de correio de outros utilizadores. A falha, CVE-2026-96940, afeta várias versões do Exchange Server local. 🚨

🔗 https://tugatech.com.pt/t92180-microsoft-lanca-atualizacoes-urgentes-para-corrigir-falha-critica-no-exchange-server

#exchange #falha #lan #microsoft #server 

Microsoft's September 2026 V2 Exchange Server security updates add CVE-2026-96940 for Exchange SE, 2019 and 2016. Install them now.

#Microsoft #ExchangeServer #ExchangeSE #CVE202696940 #SecurityUpdate #PatchManagement #ESU

https://securityonline.info/exchange-server-security-updates-september-2026-v2/?utm_source=mastodon&utm_medium=jetpack_social

PSA: Exchange Server V2 Security Updates for September were published, additionally addressing CVE-2026-96940 https://eightwone.com/2026/10/03/v2-security-updates-exchange-2016-se-sep2026/ #MSExchange

Digi IX Family devices hit by CRITICAL OS command injection (CVE-2026-75937, CVSS 9.4). Unauthenticated remote attackers can execute root commands via HTTP POST. Disable web admin interface to reduce risk. https://radar.offseq.com/threat/cve-2026-75937-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-deedd882034e65bf #OffSeq #Vulnerability #IoT #Infosec

Digi IX Family devices hit by CRITICAL OS command injection (CVE-2026-75937, CVSS 9.4). Unauthenticated remote attackers can execute root commands via HTTP POST. Disable web admin interface to reduce risk. https://radar.offseq.com/threat/cve-2026-75937-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-deedd882034e65bf #OffSeq #Vulnerability #IoT #Infosec

Digi DAL OS vulnerability CVE-2026-75937 (CVSS 9.4) lets attackers run root commands on Digi Accelerated Linux devices. Patch now.

#Digi #DALOS #CVE202675937 #CommandInjection #IoTSecurity #OTSecurity #Vulnerability

https://securityonline.info/digi-dal-os-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

Google Chrome published an empty blog post as a security advisory on Thursday afternoon. They filled it out in the past day, but don't make it easy to grasp the severity of their bugs.

For example, "Critical CVE-2026-103628: Out of bounds write in WebGL." is actually a CVSSv3.1: 9.6 critical because it allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. You'd have to chase down those details yourself on cve.org or elsewhere.

https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html

#google #chrome #CVE

Google Chrome published an empty blog post as a security advisory on Thursday afternoon. They filled it out in the past day, but don't make it easy to grasp the severity of their bugs.

For example, "Critical CVE-2026-103628: Out of bounds write in WebGL." is actually a CVSSv3.1: 9.6 critical because it allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. You'd have to chase down those details yourself on cve.org or elsewhere.

https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html

#google #chrome #CVE

Chrome security update: Chrome 154 fixes 11 flaws, including critical WebGL sandbox escape CVE-2026-103628. Update your browser now.

#Chrome #GoogleChrome #Chrome154 #CVE2026103628 #CVE2026103631 #BrowserSecurity #Vulnerability

https://securityonline.info/chrome-security-update-154/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-51916 - High (7.5)

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowle...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51916/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-51916 - High (7.5)

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowle...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51916/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-48005 - High (7.5)

Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorizati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48005/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56153 - High (7.5)

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56153/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67989 - High (7.5)

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67989 - High (7.5)

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-51907 - High (8.1)

In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51907/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-51907 - High (8.1)

In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51907/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Thales SConnect is affected by CVE-2026-18397 (CVSS 4.0 9.4), which allows a malicious website to reach the native host and achieve remote code execution. This matters because it fronts hardware-token authentication for SWIFT, Qatar Tawtheeq and Sweden Skatteverket. #Thales #SConnect #CriticalVulnerability

https://cyberworldops.eu/en/sconnect-flaw-lets-malicious-websites-reach-a-native-host

Thales SConnect is affected by CVE-2026-18397 (CVSS 4.0 9.4), which allows a malicious website to reach the native host and achieve remote code execution. This matters because it fronts hardware-token authentication for SWIFT, Qatar Tawtheeq and Sweden Skatteverket. #Thales #SConnect #CriticalVulnerability

https://cyberworldops.eu/en/sconnect-flaw-lets-malicious-websites-reach-a-native-host

🔴 CVE-2026-103764 - Critical (9.8)

Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a cr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103764/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103098 - High (7.5)

Transmission of a sensitive key in the URL
over an unencrypted HTTP connection.  The
request is sent over HTTP rather than HTTPS, meaning the key is transmitted in
plaintext across the network. An attacker with the ability to monitor network
traf...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103098/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical GitLab AI Gateway vulnerability (CVE-2026-90970) enables remote code execution on self-hosted servers

https://thecybersecguru.com/exploits/gitlab-ai-gateway-cve-2026-90970/

GitLab Issues Emergency Patches for Actively Exploited Critical AI Gateway and Path Traversal Flaws

GitLab released emergency security updates to fix a critical remote code execution vulnerability in its AI Gateway (CVE-2026-90970) and a maximum-severity path traversal flaw (CVE-2026-85706) that allows unauthenticated attackers to steal sensitive server data.

**If you run self-hosted GitLab (Community or Enterprise Edition) or a self-hosted GitLab AI Gateway for Duo, patch now: upgrade the AI Gateway to 19.2.4, 19.3.2 or 19.4.1 and apply GitLab's latest security release. One of the flaws is already actively exploited. After patching, check your logs for strange flow configurations or file access, and rotate all AI provider API keys and other secrets on those servers.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/gitlab-issues-emergency-patches-for-actively-exploited-critical-ai-gateway-and-path-traversal-flaws-g-e-5-1-b/gD2P6Ple2L

GitLab patched CVE-2026-90970, a sandbox escape in self-hosted AI Gateway allowing authenticated Duo Agent users to execute arbitrary commands via crafted flow configs. Self-hosted deployments should patch and audit for abuse, as gateway compromise can expose AI workflows and downstream systems. #GitLab #AiSecurity #SandboxEscape

https://cyberworldops.eu/en/gitlab-fixes-ai-gateway-sandbox-escape-enabling-command-execution

Critical GitLab AI Gateway vulnerability (CVE-2026-90970) enables remote code execution on self-hosted servers

https://thecybersecguru.com/exploits/gitlab-ai-gateway-cve-2026-90970/

GitLab Issues Emergency Patches for Actively Exploited Critical AI Gateway and Path Traversal Flaws

GitLab released emergency security updates to fix a critical remote code execution vulnerability in its AI Gateway (CVE-2026-90970) and a maximum-severity path traversal flaw (CVE-2026-85706) that allows unauthenticated attackers to steal sensitive server data.

**If you run self-hosted GitLab (Community or Enterprise Edition) or a self-hosted GitLab AI Gateway for Duo, patch now: upgrade the AI Gateway to 19.2.4, 19.3.2 or 19.4.1 and apply GitLab's latest security release. One of the flaws is already actively exploited. After patching, check your logs for strange flow configurations or file access, and rotate all AI provider API keys and other secrets on those servers.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/gitlab-issues-emergency-patches-for-actively-exploited-critical-ai-gateway-and-path-traversal-flaws-g-e-5-1-b/gD2P6Ple2L

GitLab patched CVE-2026-90970, a sandbox escape in self-hosted AI Gateway allowing authenticated Duo Agent users to execute arbitrary commands via crafted flow configs. Self-hosted deployments should patch and audit for abuse, as gateway compromise can expose AI workflows and downstream systems. #GitLab #AiSecurity #SandboxEscape

https://cyberworldops.eu/en/gitlab-fixes-ai-gateway-sandbox-escape-enabling-command-execution

GitLab AI Gateway vulnerability CVE-2026-90970 (CVSS 9.9) lets Duo Agent Platform users run commands. Upgrade self-hosted gateways now.

#GitLab #AIGateway #GitLabDuo #CVE202690970 #RCE #DevSecOps #Vulnerability

https://securityonline.info/gitlab-ai-gateway-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

GitLab AI Gateway flaw CVE-2026-90970 enables RCE

https://fawkes.rocks/2026/10/02/gitlab-ai-gateway-flaw-cve-2026-90970-enables-rce/

Go hack more AI shit.

https://nvd.nist.gov/vuln/detail/cve-2026-90970

sev:CRIT 9.9 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.

Go hack more AI shit.
Go hack more Gitlab.

But most importantly, hack more Gitlab AI shit: https://db.gcve.eu/vuln/cve-2026-90970

🔴 CVE-2026-90970 - Critical (9.9)

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authentic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90970/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Capacitor vulnerability CVE-2026-103922 (CVSS 9.3) affects a package with 5.5M weekly downloads. Update to a patched release now.

#Capacitor #Ionic #CVE2026103922 #MobileSecurity #npm #Android #iOS

https://securityonline.info/capacitor-vulnerability-cve-2026-103922/?utm_source=mastodon&utm_medium=jetpack_social

The Dutch Institute for Vulnerability Disclosure, whose entire ledger is OTHER people's vulnerabilities, has recorded a significant loss in column B.

Agentic AI in the threat actor slot: filed under Equipment Used Against Us. Session tokens: stolen. Root access: granted to strangers. Irony reserves: critically depleted.

Patch Zammad immediately to address CVE-2026-102489 and the second zero-day, and review DIVD's published findings for full remediation guidance. (2/3)

🏆 New Achievement! Auditing the Auditors, Zero Days Found, Zero Days Remaining!

Conducting inventory review of DIVD assets. Status: two zero-day vulnerabilities in Zammad (CVE-2026-102489, CVSS 9.4, and a companion flaw) — unpatched, unaccounted for, now exploited. An AI-powered automated attack chained both flaws to hijack sessions, execute remote code, and escalate privileges to root. In seconds. (1/3)

CISA has updated the catalogue. GMBH is looking like Swiss cheese these days.

- CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-102489

- CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-102490

Yesterday's funny headline:

CISA Launches Cybersecurity Awareness Month: Securing the Next 250 https://www.cisa.gov/news-events/news/cisa-launches-cybersecurity-awareness-month-securing-next-250 #CISA #infosec #vulnerability

CVE ID: CVE-2026-102489
Vendor: Zammad GmbH
Product: Zammad
Date Added: 2026-10-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-102489

🚨 [CISA-2026:1002] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1002)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-102489 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102489)
- Name: Zammad GmbH Zammad Session Fixation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Zammad GmbH
- Product: Zammad
- Notes: https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102489

⚠️ CVE-2026-102490 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102490)
- Name: Zammad GmbH Zammad Improper Privilege Management Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Zammad GmbH
- Product: Zammad
- Notes: https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102490

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261002 #cisa20261002 #cve_2026_102489 #cve_2026_102490 #cve2026102489 #cve2026102490

Attackers exploited Zammad zero-day flaws CVE-2026-102489 and CVE-2026-102490 to gain root at DIVD. Upgrade to Zammad 7 or go offline.

#Zammad #ZeroDay #CVE2026102489 #CVE2026102490 #DIVD #AIAgent #ExploitedInTheWild

https://securityonline.info/zammad-zero-day-cve-2026-102489/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-102667 - High (8.3)

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102667/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CISA has updated the catalogue. GMBH is looking like Swiss cheese these days.

- CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-102489

- CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-102490

Yesterday's funny headline:

CISA Launches Cybersecurity Awareness Month: Securing the Next 250 https://www.cisa.gov/news-events/news/cisa-launches-cybersecurity-awareness-month-securing-next-250 #CISA #infosec #vulnerability

CVE ID: CVE-2026-102490
Vendor: Zammad GmbH
Product: Zammad
Date Added: 2026-10-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-102490

🚨 [CISA-2026:1002] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1002)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-102489 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102489)
- Name: Zammad GmbH Zammad Session Fixation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Zammad GmbH
- Product: Zammad
- Notes: https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102489

⚠️ CVE-2026-102490 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102490)
- Name: Zammad GmbH Zammad Improper Privilege Management Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Zammad GmbH
- Product: Zammad
- Notes: https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102490

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261002 #cisa20261002 #cve_2026_102489 #cve_2026_102490 #cve2026102489 #cve2026102490

Attackers exploited Zammad zero-day flaws CVE-2026-102489 and CVE-2026-102490 to gain root at DIVD. Upgrade to Zammad 7 or go offline.

#Zammad #ZeroDay #CVE2026102489 #CVE2026102490 #DIVD #AIAgent #ExploitedInTheWild

https://securityonline.info/zammad-zero-day-cve-2026-102489/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-102795 - Critical (9.3)

Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102795/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-103648 - Critical (9.1)

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101104 - High (7.7)

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101104/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

A 9.9 Foreman RCE flaw, CVE-2026-96658, lets low-privileged users run commands on Red Hat Satellite. A Viewer bug leaks root passwords.

#Foreman #RedHatSatellite #CVE202696658 #CVE202696659 #CVE202686345 #RCE #LDAP

https://securityonline.info/foreman-rce-cve-2026-96658/?utm_source=mastodon&utm_medium=jetpack_social

CVE-2026-91135: Apache Thrift (<0.25.0) has a CRITICAL heap-based buffer overflow in C++ THeaderTransport when ZLIB is enabled. Exploitable for RCE/DoS. Upgrade to 0.25.0+ now. CVSS 9.2. https://radar.offseq.com/threat/cve-2026-91135-cwe-122-heap-based-buffer-overflow-in-apache-software-foundation-apache-thrift-0aedbcf1ed0ca11f #OffSeq #ApacheThrift #InfoSec #CVE202691135

🟠 CVE-2026-80298 - High (8.8)

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection.

This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-80298/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104410 - High (7.5)

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a publi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104410/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104423 - High (7.5)

Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprio...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104423/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104430 - High (7.5)

Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104430/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104845 - High (7.5)

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104845/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104467 - High (8.1)

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like ap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104467/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104026 - High (7.8)

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104026/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19652 - Critical (9.8)

The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19652/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-104611 - Critical (9.1)

A vulnerability was detected in Tenda AC9 15.03.02.13. Affected is an unknown function of the file /goform/fast_setting_internet_set of the component POST Request Handler. Performing a manipulation of the argument netWanType results in stack-based...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104611/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104456 - High (7.6)

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104456/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-104610 - Critical (10)

A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104610/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

https://www.cve.org/CVERecord?id=CVE-2026-104610

cc: @da_667

📰 Critical Fortinet FortiMail Zero-Day Exploited for RCE

Fortinet warns of critical zero-day (CVE-2026-104286) in FortiMail, actively exploited for RCE. CVSS 9.8. CISA added to KEV. Patches are pending, but urgent workarounds are available. #Fortinet #ZeroDay #CVE2026104286 #CyberSecurity

🔗 https://cyber.netsecops.io/articles/critical-fortinet-fortimail-zero-day-exploited-cve-2026-104286/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

📰 Critical Fortinet FortiMail Zero-Day Exploited for RCE

Fortinet warns of critical zero-day (CVE-2026-104286) in FortiMail, actively exploited for RCE. CVSS 9.8. CISA added to KEV. Patches are pending, but urgent workarounds are available. #Fortinet #ZeroDay #CVE2026104286 #CyberSecurity

🔗 https://cyber.netsecops.io/articles/critical-fortinet-fortimail-zero-day-exploited-cve-2026-104286/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

🚨 Fortinet reports active exploitation of CVE-2026-104286, a critical path traversal vulnerability affecting FortiMail.

Censys observes roughly 2,800 Internet-exposed FortiMail hosts after excluding honeypots. This is an exposure count, not a confirmed-vulnerable count.

No fixed builds have been released as of October 2. Censys ARC covers affected versions, Fortinet’s current workarounds, indicators, and remediation guidance: https://censys.com/advisory/cve-2026-10426/

#CensysARC #Fortinet #FortiMail #Cybersecurity #Vulnerability

🚨 Fortinet sounds the alarm over actively exploited FortiMail zero-day

｢ The flaw, tracked as CVE-2026-104286, carries a CVSS score of 9.8 and affects multiple versions of Fortinet's email security platform ｣

https://www.theregister.com/security/2026/10/02/fortinet-sounds-the-alarm-over-actively-exploited-fortimail-zero-day/5300803

#fortinet #fortimail #cybersecurity

🔴 CVE-2026-104286 - Critical (9.8)

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an una...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Fortinet has a couple of advisories today, one pertaining to a critical vulnerability.

CRITICAL: CVE-2026-104286 - Improper Pathname Restriction Allows Unauthenticated Arbitrary File Write in Fortinet FortiMail https://app.opencve.io/cve/CVE-2026-104286

More:

The Register: Fortinet sounds the alarm over actively exploited FortiMail zero-day https://www.theregister.com/security/2026/10/02/fortinet-sounds-the-alarm-over-actively-exploited-fortimail-zero-day/5300803 @theregister @carlypage #infosec #Fortinet #zeroday #vulnerability

Critical Fortinet FortiMail Zero-Day (CVE-2026-104286) Actively Exploited: Unauthenticated File Write Flaw Exposes Email Security Gateways Worldwide

https://thecybersecguru.com/exploits/fortimail-cve-2026-104286-zero-day/

Critical Threat Advisory: CVE-2026-104286 Fortinet FortiMail

Immediate CISA KEV threat advisory for CVE-2026-104286 affecting Fortinet FortiMail. Includes behavioral workflow analysis, BOD 26-04 patch compliance guidance, and multi-vendor SOC detection queries....

https://thecybermind.co/t645

Just stroll up and write arbitrary files anywhere on the system, courtesy of a path traversal flaw and a NULL-byte handling error working together like a buddy-cop duo nobody asked for.

Fortinet FortiMail administrators: patch CVE-2026-104286 immediately — authentication-free arbitrary file write is not a feature you want enabled by strangers.

Reward: You've received a complimentary Unpatched Appliance Trophy, proudly displayed in your attacker's loot screen. (2/3)

🏆 New Achievement! Write Anything, Pay Nothing!

This achievement is brought to you by Deferred Patch Tuesdays — "Why fix it today when tomorrow is also a day?" Thanks to their generous sponsorship, attackers are actively exploiting CVE-2026-104286, a CVSS 9.8 zero-day in Fortinet FortiMail. No credentials required! (1/3)

⚠️ CVE-2026-104286 (https://vulnerability.circl.lu/vuln/CVE-2026-104286) — FortiMail, vulnérabilité critique et déjà exploitée comme 0-day.

S’il fallait encore des exemples sur le rythme auquel il faut désormais suivre les correctifs des équipements exposés : après Cisco, Citrix, Zimbra… voilà à nouveau FortiMail. 🙃

Sans authentification, un attaquant peut écrire des fichiers et exécuter du code via l’interface de gestion.

"Bien évidemment", il s’agit d’une bonne vieille traversée de chemin .../.../... :dumpster_fire_gif:

➡️ En attendant les versions corrigées : désactiver IBE ou restreindre strictement l’accès à l’interface d’administration.

🩹
👇 https://fortiguard.fortinet.com/psirt/FG-IR-26-175

#Fortinet #FortiMail #CVE

“Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices.”

https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/

🏆 New Achievement! Unauthenticated File Write of Passage!

The System would like to direct your attention, counsel, to Exhibit A: CVE-2026-104286, a CVSS 9.8 zero-day in Fortinet's FortiMail, actively exploited in the wild. My client, the attacker, did not break in — they merely wrote files to a system that, per the public record, required no authentication to do so. Your Honor, the management interface was exposed. The vulnerability was critical. (1/2)

Fortinet FortiMail management interface is impacted by CVE-2026-104286 (CVSS 9.8), exploited in the wild as zero-day for unauthenticated system file writes and command execution. Internet-exposed instances face immediate full-compromise risk; isolate management and patch urgently. #Fortinet #ZeroDay #ThreatIntel

https://cyberworldops.eu/en/fortimail-zero-day-gives-unauthenticated-attackers-a-route-to-system

🟠 CVE-2026-91828 - High (7.5)

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91828/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104448 - High (8.1)

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a log...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104448/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104462 - High (7.5)

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104462/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104472 - High (7.5)

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parame...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104472/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104464 - High (8.6)

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target inter...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104464/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104460 - High (7.5)

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104460/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104416 - High (7.5)

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for hig...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104416/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104422 - High (7.5)

The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Beca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104445 - High (8.2)

YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delet...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104445/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104443 - High (8.1)

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104443/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104414 - High (8.1)

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embeddi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104414/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104431 - High (7.5)

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sig...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104431/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Moxa MGate vulnerabilities CVE-2026-86325 (CVSS 9.4) and CVE-2026-86326 hit MGate protocol gateway firmware. See affected versions and fixes.

#Moxa #MGate #CVE202686325 #CVE202686326 #ICSSecurity #OTSecurity #Vulnerability

https://securityonline.info/moxa-mgate-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269540-cve-2026-86325,-cve-2026-86326-two-vulnerabilities-in-protocol-gateways

CVE-2026-86325

A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the account_name parameter when processing account management requests. An attacker authenticated as a read-only user to the web management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow. Successful exploitation could allow an attacker to read sensitive information from device memory, including credentials, modify arbitrary memory contents, and disrupt device availability.

CVE-2026-86326

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device. Successful exploitation could allow the attacker to execute unauthorized code, compromise the integrity and availability of the device, and persist malicious modifications across subsequent firmware updates.

Given the high severity of these issues, users should apply the solutions immediately to reduce security risks.

🔴 CVE-2026-94541 - Critical (9.8)

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94541/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-94541: CRITICAL auth bypass in WPMobile.App plugin (<=11.82) exposes password-reset URLs via mail-to-push, risking admin account takeover. Disable mail-to-push until patched. https://radar.offseq.com/threat/cve-2026-94541-cwe-862-missing-authorization-in-amauric-wpmobileapp-android-and-ios-app-builder-544a87f570200da9 #OffSeq #WordPress #CVE202694541 #Infosec

Moxa MGate vulnerabilities CVE-2026-86325 (CVSS 9.4) and CVE-2026-86326 hit MGate protocol gateway firmware. See affected versions and fixes.

#Moxa #MGate #CVE202686325 #CVE202686326 #ICSSecurity #OTSecurity #Vulnerability

https://securityonline.info/moxa-mgate-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269540-cve-2026-86325,-cve-2026-86326-two-vulnerabilities-in-protocol-gateways

CVE-2026-86325

A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the account_name parameter when processing account management requests. An attacker authenticated as a read-only user to the web management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow. Successful exploitation could allow an attacker to read sensitive information from device memory, including credentials, modify arbitrary memory contents, and disrupt device availability.

CVE-2026-86326

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device. Successful exploitation could allow the attacker to execute unauthorized code, compromise the integrity and availability of the device, and persist malicious modifications across subsequent firmware updates.

Given the high severity of these issues, users should apply the solutions immediately to reduce security risks.

🟠 CVE-2026-104457 - High (8.6)

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-97637 - Critical (9.8)

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97637/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-97637: CRITICAL auth bypass in parorrey JSON API Auth plugin for WordPress (≤3.1.2). Attackers can steal admin session cookies via cached API responses. Disable affected plugins or controllers now. Details: https://radar.offseq.com/threat/cve-2026-97637-cwe-287-improper-authentication-in-parorrey-json-api-auth-3d3bcedfc67ab8ea #OffSeq #WordPress #Security #CVE2026_97637

cPanel vulns are fun, right? IDK what Adminbin is but I'm sure some of you do. Have fun.

https://support.cpanel.net/hc/en-us/articles/43845931719447-Security-CVE-2026-93698-Vulnerability-in-Multilang-Adminbin-September-29-2026

sev:CRIT 9.9 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

https://nvd.nist.gov/vuln/detail/cve-2026-93698

🔴 CVE-2026-93698 - Critical (9.9)

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93698/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-93697 - Critical (9)

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-93029 - Critical (9)

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93029/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-93029: CRITICAL stored XSS in Webpros cPanel (WHM Manage SSL Hosts). Attackers with low privilege can execute malicious code. Restrict access & monitor systems. Patch status: unconfirmed. https://radar.offseq.com/threat/cve-2026-93029-cwe-79-cross-site-scripting-xss-stored-in-webpros-cpanel-7c14cb89e30db301 #OffSeq #cPanel #XSS #Vuln

🟠 CVE-2026-92820 - High (8.1)

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external (Amazon S3) upload flow. The plugin trusts an attacker-supplied file path from the form su...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92820/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-92174 - High (7.5)

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor-level a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92174/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-14378 - Critical (9.8)

The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to, and including, 2.3.0 This is due to the `revert_switch` handler trusting the attacker-controlled `original_...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14378/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-14378 | CRITICAL vuln in dplugins DevKit Pro (<=2.3.0): Improper authentication lets unauth attackers gain admin access via crafted cookies & nonce. Immediate action: disable or restrict plugin. https://radar.offseq.com/threat/cve-2026-14378-cwe-287-improper-authentication-in-dplugins-devkit-pro-45d2af96cf344d90 #OffSeq #WordPress #Vuln #Infosec

🔴 CVE-2026-15896 - Critical (9.1)

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15896/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-15896 (CRITICAL): Path traversal in WebRehab Super Forms – Drag & Drop Form Builder <=6.3.316 lets unauthenticated users read arbitrary files via vulnerable uploads. Enable 'file_upload_auth' for some mitigation. https://radar.offseq.com/threat/cve-2026-15896-cwe-26-path-traversal-dirfilename-in-webrehab-super-forms-drag-drop-form-builder-fbb29d81b0addec9 #OffSeq #WordPress #Vuln #AppSec

🟠 CVE-2026-103096 - High (7.5)

API
key is hardcoded and retrievable from the application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
directly in the client application may allow unauthorized users to extract and
misuse the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103096/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Discord libdave CRITICAL vuln (CVE-2026-104480, CVSS 9.4): Affected versions 1.1.0 – <1.2.0 let attackers inject unauthorized members into encrypted sessions. Patch status unconfirmed — check https://radar.offseq.com/threat/cve-2026-104480-cwe-390-detection-of-error-condition-without-action-in-discord-libdave-b9a84610b93cd7e9 #OffSeq #Discord #CVE2026104480 #infosec

🟠 CVE-2026-103097 - High (7.5)

An API key is
hardcoded and retrievable from the application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
directly in the client application may allow unauthorized users to extract and
misuse t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103097/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Red Hat Directory Server 11: CVE-2026-86345 (CRITICAL, CVSS 9) allows on-path attackers to inject LDAP messages post-StartTLS, risking auth bypass. Restrict access, check Red Hat advisory https://radar.offseq.com/threat/cve-2026-86345-improper-restriction-of-communication-channel-to-intended-endpoints-in-red-hat-red-hat-bc48a6c684134ace #OffSeq #CVE202686345 #RedHat #LDAP #infosec

🔴 CVE-2026-103765 - Critical (9.4)

Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unauthenticated attackers to read, overwrite, and delete transfer engine metadata keys. Attackers can poison se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103765/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-57941 - Critical (9.8)

Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-57941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack