🟠 CVE-2026-8679 - High (7.5)

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8679/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔈 CVE-2026-8679 (HIGH): AudioIgniter Music Player plugin ≤2.0.2 lets unauthenticated attackers access any playlist's metadata — including private & draft tracks — via insecure playlist ID handling. Restrict access & monitor for patches. https://radar.offseq.com/threat/cve-2026-8679-cwe-639-authorization-bypass-through-07a73ddb #OffSeq #WordPress #Vuln

🟠 CVE-2026-8679 - High (7.5)

The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the handle_playlist_endpoint() function (hooked to template_redirect) accepting a user-controlled playl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8679/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔈 CVE-2026-8679 (HIGH): AudioIgniter Music Player plugin ≤2.0.2 lets unauthenticated attackers access any playlist's metadata — including private & draft tracks — via insecure playlist ID handling. Restrict access & monitor for patches. https://radar.offseq.com/threat/cve-2026-8679-cwe-639-authorization-bypass-through-07a73ddb #OffSeq #WordPress #Vuln

🟠 CVE-2026-45250 - High (7.8)

The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validatin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45250 - High (7.8)

The setcred(2) system call is only available to privileged users. However, before the privilege level of the caller is checked, the user-supplied list of supplementary groups is copied into a fixed-size kernel stack buffer without first validatin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45250/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

"No way to prevent this" say users of only language where this regularly happens https://xeiaso.net/shitposts/no-way-to-prevent-this/CVE-2026-45250/

"No way to prevent this" say u...

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/CVE-2026-45250/?utm_campaign=mi_irl&utm_medium=social&utm_source=mastodon

🟠 CVE-2026-9018 - High (8.8)

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via the `easyel_handle_register()` function. This is due to the `wp_ajax_nopriv_e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9018/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9018 - High (8.8)

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via the `easyel_handle_register()` function. This is due to the `wp_ajax_nopriv_e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9018/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4834 - High (7.5)

The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4834/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4834 - High (7.5)

The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4834/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41054 - High (7.8)

In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowle...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41054/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-34908 (CVSS 10.0): Ubiquiti UniFi OS Server has a critical improper access control flaw, allowing unauthenticated remote compromise. No patch yet — restrict network access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-34908-cwe-284-improper-access-control-gen-70db5de1 #OffSeq #UniFi #Vuln #BlueTeam

🔴 CVE-2026-34908 - Critical (10)

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34908/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-34908 (CVSS 10.0): Ubiquiti UniFi OS Server has a critical improper access control flaw, allowing unauthenticated remote compromise. No patch yet — restrict network access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-34908-cwe-284-improper-access-control-gen-70db5de1 #OffSeq #UniFi #Vuln #BlueTeam

🔴 CVE-2026-34908 - Critical (10)

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34908/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-9264 in Trimble SketchUp 2026 allows RCE & file exfiltration via malicious SKP files (Dynamic Components, IE11 browser). No patch yet. Avoid untrusted SKP files. More: https://radar.offseq.com/threat/cve-2026-9264-cwe-94-improper-control-of-generatio-9d9e29a0 #OffSeq #SketchUp #Vuln #InfoSec

⚠️ CRITICAL: CVE-2026-9264 in Trimble SketchUp 2026 allows RCE & file exfiltration via malicious SKP files (Dynamic Components, IE11 browser). No patch yet. Avoid untrusted SKP files. More: https://radar.offseq.com/threat/cve-2026-9264-cwe-94-improper-control-of-generatio-9d9e29a0 #OffSeq #SketchUp #Vuln #InfoSec

🟠 CVE-2026-34911 - High (7.7)

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34911/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34911 - High (7.7)

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34911/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-34910: CRITICAL improper input validation in Ubiquiti UniFi OS Server allows unauthenticated command injection (CVSS 10.0). No patch yet. Restrict network access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-34910-cwe-20-improper-input-validation-in-54cb0e00 #OffSeq #Vuln #Ubiquiti #Infosec

🔴 CVE-2026-34910 - Critical (10)

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34910/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-34910: CRITICAL improper input validation in Ubiquiti UniFi OS Server allows unauthenticated command injection (CVSS 10.0). No patch yet. Restrict network access & monitor vendor updates. https://radar.offseq.com/threat/cve-2026-34910-cwe-20-improper-input-validation-in-54cb0e00 #OffSeq #Vuln #Ubiquiti #Infosec

🔴 CVE-2026-34910 - Critical (10)

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34910/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 CRITICAL: CVE-2026-34909 - Path Traversal in Ubiquiti UniFi OS Server (CVSS 10). Allows arbitrary file access & manipulation. No patch yet — restrict access & monitor! Details: https://radar.offseq.com/threat/cve-2026-34909-cwe-22-path-traversal-in-ubiquiti-i-4d93b8c5 #OffSeq #UniFi #Vuln #BlueTeam

🔴 CVE-2026-34909 - Critical (10)

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34909/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 CRITICAL: CVE-2026-34909 - Path Traversal in Ubiquiti UniFi OS Server (CVSS 10). Allows arbitrary file access & manipulation. No patch yet — restrict access & monitor! Details: https://radar.offseq.com/threat/cve-2026-34909-cwe-22-path-traversal-in-ubiquiti-i-4d93b8c5 #OffSeq #UniFi #Vuln #BlueTeam

🔴 CVE-2026-34909 - Critical (10)

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34909/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33000 - Critical (9.1)

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33000/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-33000 (CVSS 9.1): Ubiquiti UniFi OS Server has a critical improper input validation flaw. High-privileged attackers on the network can execute command injection. Mitigation steps not published yet. Stay tuned: https://radar.offseq.com/threat/cve-2026-33000-cwe-20-improper-input-validation-in-983d26ac #OffSeq #Infosec #UniFiOS

🔴 CVE-2026-33000 - Critical (9.1)

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33000/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-33000 (CVSS 9.1): Ubiquiti UniFi OS Server has a critical improper input validation flaw. High-privileged attackers on the network can execute command injection. Mitigation steps not published yet. Stay tuned: https://radar.offseq.com/threat/cve-2026-33000-cwe-20-improper-input-validation-in-983d26ac #OffSeq #Infosec #UniFiOS

🚩 HIGH severity: CVE-2026-46473 in Authen::TOTP (<0.1.1, Perl) — secrets generated with rand are predictable, weakening TOTP security. Upgrade to 0.1.1+ when possible. More: https://radar.offseq.com/threat/cve-2026-46473-cwe-331-insufficient-entropy-in-tch-3d3628d8 #OffSeq #Vulnerability #Perl #MFA #CVE202646473

🟠 CVE-2026-46473 - High (7.5)

Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand.

Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46473/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚩 HIGH severity: CVE-2026-46473 in Authen::TOTP (<0.1.1, Perl) — secrets generated with rand are predictable, weakening TOTP security. Upgrade to 0.1.1+ when possible. More: https://radar.offseq.com/threat/cve-2026-46473-cwe-331-insufficient-entropy-in-tch-3d3628d8 #OffSeq #Vulnerability #Perl #MFA #CVE202646473

🟠 CVE-2026-46473 - High (7.5)

Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand.

Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46473/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6960 - Critical (9.8)

The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it poss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6960/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-6960 in BookingPress Appointment Booking Pro (≤5.6) allows unauthenticated file uploads — risk of RCE! Remove signature fields & monitor uploads. No patch yet — stay vigilant. https://radar.offseq.com/threat/cve-2026-6960-cwe-434-unrestricted-upload-of-file--eb314579 #OffSeq #WordPress #Vulnerability #CyberAlert

🔴 CVE-2026-6960 - Critical (9.8)

The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it poss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6960/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CRITICAL: CVE-2026-6960 in BookingPress Appointment Booking Pro (≤5.6) allows unauthenticated file uploads — risk of RCE! Remove signature fields & monitor uploads. No patch yet — stay vigilant. https://radar.offseq.com/threat/cve-2026-6960-cwe-434-unrestricted-upload-of-file--eb314579 #OffSeq #WordPress #Vulnerability #CyberAlert

🟠 CVE-2026-28764 - High (7.8)

MediaArea MediaInfoLib LXF element parsing heap-based buffer overflow vulnerability

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-28764/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47114 - High (8.8)

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters through the iina://open custom URL scheme handler. Attacker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47114/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47114 - High (8.8)

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters through the iina://open custom URL scheme handler. Attacker...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47114/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47102 - High (8.8)

LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47102/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47102 - High (8.8)

LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47102/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47101 - High (8.8)

LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47101 - High (8.8)

LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47101/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Trend Micro Patches Actively Exploited Directory Traversal in Apex One

Trend Micro patched eight vulnerabilities in Apex One and Vision One, including a directory traversal flaw (CVE-2026-34926) that is exploited in the wild to inject malicious code into security agents.

**If you're using Trend Micro Apex One (on-premise) or Vision One, you are under attack. Immediately update to the patched versions (SP1 CP Build 18012 / SP1 Build 17079 for on-premise, or agent build 14.0.20731+ for cloud) since one of its flaws is actively exploited to push malware through your own security tools. Even if the exploited flaw requires authentication, obviously that is not difficult to obtain for hackers.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/trend-micro-patches-actively-exploited-directory-traversal-in-apex-one-r-u-9-l-z/gD2P6Ple2L

CISA Flags Actively Exploited Langflow, Trend Micro Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm on two major vulnerabilities, CVE-2025-34291 and CVE-2026-34926, currently being exploited by hackers, and is requiring federal agencies to patch them by June 4, 2026. These weaknesses, found in Langflow and Trend Micro Apex One, could…

https://osintsights.com/cisa-flags-actively-exploited-langflow-trend-micro-vulnerabilities?utm_source=mastodon&utm_medium=social

#KnownExploitedVulnerabilities #Cve202534291 #Cve202634926 #Langflow #TrendMicro

🟡 New security advisory:

CVE-2026-34926 affects multiple systems.

• Impact: Security weakness that could be exploited
• Risk: Potential for targeted attacks
• Mitigation: Schedule patching in your next maintenance window

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-34926-apex-one-dir-traversal-exploited-in-wild

#CVE #ZeroDay #ThreatIntel

🚨 [CISA-2026:0521] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0521)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-34291 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-34291)
- Name: Langflow Origin Validation Error Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/langflow-ai/langflow ; https://github.com/langflow-ai/langflow/releases/tag/v1.9.3; https://github.com/langflow-ai/langflow/issues/11465#event-25774545848 ; https://nvd.nist.gov/vuln/detail/CVE-2025-34291

⚠️ CVE-2026-34926 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34926)
- Name: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Trend Micro
- Product: Apex One
- Notes: https://success.trendmicro.com/en-US/solution/KA-0023430 ; https://nvd.nist.gov/vuln/detail/CVE-2026-34926

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260521 #cisa20260521 #cve_2025_34291 #cve_2026_34926 #cve202534291 #cve202634926

CVE ID: CVE-2026-34926
Vendor: Trend Micro
Product: Apex One
Date Added: 2026-05-21
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34926

Trend Micro Patches Actively Exploited Directory Traversal in Apex One

Trend Micro patched eight vulnerabilities in Apex One and Vision One, including a directory traversal flaw (CVE-2026-34926) that is exploited in the wild to inject malicious code into security agents.

**If you're using Trend Micro Apex One (on-premise) or Vision One, you are under attack. Immediately update to the patched versions (SP1 CP Build 18012 / SP1 Build 17079 for on-premise, or agent build 14.0.20731+ for cloud) since one of its flaws is actively exploited to push malware through your own security tools. Even if the exploited flaw requires authentication, obviously that is not difficult to obtain for hackers.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/trend-micro-patches-actively-exploited-directory-traversal-in-apex-one-r-u-9-l-z/gD2P6Ple2L

🚨 [CISA-2026:0521] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0521)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-34291 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-34291)
- Name: Langflow Origin Validation Error Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/langflow-ai/langflow ; https://github.com/langflow-ai/langflow/releases/tag/v1.9.3; https://github.com/langflow-ai/langflow/issues/11465#event-25774545848 ; https://nvd.nist.gov/vuln/detail/CVE-2025-34291

⚠️ CVE-2026-34926 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34926)
- Name: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Trend Micro
- Product: Apex One
- Notes: https://success.trendmicro.com/en-US/solution/KA-0023430 ; https://nvd.nist.gov/vuln/detail/CVE-2026-34926

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260521 #cisa20260521 #cve_2025_34291 #cve_2026_34926 #cve202534291 #cve202634926

CVE ID: CVE-2026-34926
Vendor: Trend Micro
Product: Apex One
Date Added: 2026-05-21
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34926

EITW ../ in Trend Micro Apex One. :brdAlert:

https://success.trendmicro.com/en-US/solution/KA-0023430

CVE-2026-34926

TrendAI has released updates to Apex One (on-premise), Apex One as a Service and Vision One - Standard Endpoint Protection (SEP) to resolve multiple vulnerabilities.

CISA Flags Actively Exploited Langflow, Trend Micro Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm on two major vulnerabilities, CVE-2025-34291 and CVE-2026-34926, currently being exploited by hackers, and is requiring federal agencies to patch them by June 4, 2026. These weaknesses, found in Langflow and Trend Micro Apex One, could…

https://osintsights.com/cisa-flags-actively-exploited-langflow-trend-micro-vulnerabilities?utm_source=mastodon&utm_medium=social

#KnownExploitedVulnerabilities #Cve202534291 #Cve202634926 #Langflow #TrendMicro

🚨 [CISA-2026:0521] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0521)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-34291 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-34291)
- Name: Langflow Origin Validation Error Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/langflow-ai/langflow ; https://github.com/langflow-ai/langflow/releases/tag/v1.9.3; https://github.com/langflow-ai/langflow/issues/11465#event-25774545848 ; https://nvd.nist.gov/vuln/detail/CVE-2025-34291

⚠️ CVE-2026-34926 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34926)
- Name: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Trend Micro
- Product: Apex One
- Notes: https://success.trendmicro.com/en-US/solution/KA-0023430 ; https://nvd.nist.gov/vuln/detail/CVE-2026-34926

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260521 #cisa20260521 #cve_2025_34291 #cve_2026_34926 #cve202534291 #cve202634926

CVE ID: CVE-2025-34291
Vendor: Langflow
Product: Langflow
Date Added: 2026-05-21
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-34291

🚨 [CISA-2026:0521] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0521)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2025-34291 (https://secdb.nttzen.cloud/cve/detail/CVE-2025-34291)
- Name: Langflow Origin Validation Error Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Langflow
- Product: Langflow
- Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/langflow-ai/langflow ; https://github.com/langflow-ai/langflow/releases/tag/v1.9.3; https://github.com/langflow-ai/langflow/issues/11465#event-25774545848 ; https://nvd.nist.gov/vuln/detail/CVE-2025-34291

⚠️ CVE-2026-34926 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34926)
- Name: Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Trend Micro
- Product: Apex One
- Notes: https://success.trendmicro.com/en-US/solution/KA-0023430 ; https://nvd.nist.gov/vuln/detail/CVE-2026-34926

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260521 #cisa20260521 #cve_2025_34291 #cve_2026_34926 #cve202534291 #cve202634926

CVE ID: CVE-2025-34291
Vendor: Langflow
Product: Langflow
Date Added: 2026-05-21
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-34291

🟠 CVE-2026-24216 - High (7.8)

NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24216/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4858 - High (8)

Mattermost versions 11.6.x &lt;= 11.6.0, 11.5.x &lt;= 11.5.3, 11.4.x &lt;= 11.4.4, 10.11.x &lt;= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Matt...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4858/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-20239 - High (7.5)

In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the `_internal` index could view session cookies and r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20239/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-48207 in Apache Fory <1.0.0 — Deserialization flaw in PyFory ReduceSerializer bypasses DeserializationPolicy, risking RCE if strict mode is off. Upgrade to 1.0.0+ ASAP! https://radar.offseq.com/threat/cve-2026-48207-cwe-502-deserialization-of-untruste-97a80f2c #OffSeq #CVE202648207 #Vulnerability #ApacheFory

🔴 CVE-2026-48207 - Critical (9.8)

Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deseri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-48207 in Apache Fory <1.0.0 — Deserialization flaw in PyFory ReduceSerializer bypasses DeserializationPolicy, risking RCE if strict mode is off. Upgrade to 1.0.0+ ASAP! https://radar.offseq.com/threat/cve-2026-48207-cwe-502-deserialization-of-untruste-97a80f2c #OffSeq #CVE202648207 #Vulnerability #ApacheFory

🔴 CVE-2026-48207 - Critical (9.8)

Deserialization of untrusted data in Apache Fory PyFory. PyFory's ReduceSerializer could bypass documented DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deseri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-39531 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection.

This issue affects WP Directory Kit: from n/a through 1.5.0.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39531/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9089 - High (8.8)

The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9089/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-48235 - High (8.2)

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestamp values parsed from external GPS tracking service XML/JSON responses (InstaMapper and G...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48235/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-48242 in Open ISES Tickets <3.44.2 — Hardcoded MySQL creds in public code could enable unauthorized DB access. No patch yet. Rotate creds & review deployments immediately. https://radar.offseq.com/threat/cve-2026-48242-use-of-hard-coded-credentials-in-op-348559d8 #OffSeq #Vulnerability #InfoSec #CVE202648242

🟠 CVE-2026-45251 - High (7.8)

A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45251/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45251 - High (7.8)

A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor. Because the blocked thread does not hold a reference to the underlying object, this closure may result in the object being freed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45251/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45253 - High (8.4)

ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to debug a process may trigger arbitrary code execution in the kernel, even if the target proc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45253/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45253 - High (8.4)

ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls. As a result, a user with the ability to debug a process may trigger arbitrary code execution in the kernel, even if the target proc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45253/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-8631: Critical heap buffer overflow in HP Linux Imaging & Printing Software (CVSS 9.3). Remote, unauthenticated code execution possible. No patch yet — restrict print service access & monitor jobs. Details: https://radar.offseq.com/threat/cve-2026-8631-cwe-122-heap-based-buffer-overflow-i-d4679b19 #OffSeq #Vulnerability #HP

🚨 CRITICAL: Open ISES Tickets <3.44.2 has hardcoded MySQL creds in loader.php (CVE-2026-48241), exposing DBs to attack if reachable. Restrict file & DB access, rotate creds now. No official fix yet. https://radar.offseq.com/threat/cve-2026-48241-use-of-hard-coded-credentials-in-op-e794805b #OffSeq #Vulnerability #MySQL #AppSec

🟠 CVE-2026-48241 - High (8.1)

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48241/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47783 - High (8.1)

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47783/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47784 - High (8.1)

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47784/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9111 - High (8.8)

Use after free in WebRTC in Google Chrome on Linux prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9111/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9114 - High (8.8)

Use after free in QUIC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9114/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9118 - High (8.8)

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9118/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9119 - High (8.8)

Heap buffer overflow in WebRTC in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9123 - High (7.5)

Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: Medium)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9126 - High (8.8)

Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9126/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-47372 - Critical (9.1)

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.

These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-47372 - Critical (9.1)

Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts.

These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: CVE-2026-23734 in XWiki Platform (xwiki-commons) allows unauthenticated path traversal — attackers can read config files via crafted 'resource' parameters. Patch to 18.1.0-rc-1, 17.10.3, 17.4.9, or 16.10.17+ now! https://radar.offseq.com/threat/cve-2026-23734-cwe-23-relative-path-traversal-in-x-16518aab #OffSeq #xwiki #vuln

🚨 CRITICAL: CVE-2026-33137 impacts XWiki Platform (<16.10.17, <17.4.9, <17.10.3, <18.1.0-rc-1). Unauthenticated users can create/modify documents via missing auth on POST /wikis/{wikiName}. Patch now! https://radar.offseq.com/threat/cve-2026-33137-cwe-862-missing-authorization-in-xw-b0399ab5 #OffSeq #XWiki #CVE #Infosec

🟠 CVE-2026-40092 - High (7.5)

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In versions 1.3.0 and below, a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The maliciously crafted record wou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40092/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

#OT #Advisory VDE-2026-052
CODESYS Visualization - Insufficiently Protected Credentials

A vulnerability in the CODESYS Visualization login dialog has been identified. During logins within the CODESYS Visualization, authentication data may not be sufficiently isolated when multiple users perform login operations concurrently.
#CVE CVE-2026-0393

https://certvde.com/en/advisories/vde-2026-052/

#CSAF https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2026/advisory2026-07_vde-2026-052.json

🟠 CVE-2026-45255 - High (7.5)

When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network. This is implemented using a shell script, and the code which handled n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45255/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45255 - High (7.5)

When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network. This is implemented using a shell script, and the code which handled n...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45255/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71217 - High (7.8)

An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71217/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71217 - High (7.8)

An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71217/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71214 - High (7.8)

An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71214 - High (7.8)

An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71214/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34930 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different process protection mechanism.

Please note: an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34930/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34929 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different inter-process communication mechanism.

Please ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34929/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34928 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different named pipe communication mechanism.

Please not...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34927 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34927/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34930 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different process protection mechanism.

Please note: an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34930/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34929 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different inter-process communication mechanism.

Please ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34929/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34928 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different named pipe communication mechanism.

Please not...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34927 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34927/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45206 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45207 but exists in a different process protection communication mechanism.

Pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45206 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45207 but exists in a different process protection communication mechanism.

Pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45207 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45206 but exists in a different process protection communication mechanism.

Pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45206 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45207 but exists in a different process protection communication mechanism.

Pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45206 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45207 but exists in a different process protection communication mechanism.

Pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45206/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45207 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45206 but exists in a different process protection communication mechanism.

Pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71211 - Critical (9.8)

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71211 - Critical (9.8)

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13479 - High (7.5)

Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd. QR Menu allows Exploitation of Trusted Identifiers.

This issue affects QR Menu: through 21052026. NOTE: The vendor was contacted earl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13479/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-13479 - High (7.5)

Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd. QR Menu allows Exploitation of Trusted Identifiers.

This issue affects QR Menu: through 21052026. NOTE: The vendor was contacted earl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13479/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42001 - High (7.5)

Insufficient Validation of Autoprimary SOA Queries

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42001/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2740 - High (8.4)

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2740/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2740 - High (8.4)

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2740/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-24188 - High (8.2)

NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to data tampering.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-24188/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9157 - High (8.4)

Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion.

This issue affects Web Fax: from 3.0 before 3.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9157/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9157 - High (8.4)

Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion.

This issue affects Web Fax: from 3.0 before 3.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9157/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ Drupal corregge una falla SQL: aggiornare subito è la miglior difesa, perché gli exploit potrebbero arrivare a breve. #Drupal #CyberSecurity

🔗 https://www.tomshw.it/hardware/drupal-cve-2026-9082-sql-injection-postgresql

🚨 Drupal sites using PostgreSQL face a highly critical SQL injection vuln (CVE-2026-9082), risking RCE & data exposure. Patch versions 11.3, 11.2, 10.6, 10.5.x ASAP. Update Symfony & Twig too. No active exploitation yet. https://radar.offseq.com/threat/drupal-patches-highly-critical-vulnerability-expos-a1486e66 #OffSeq #Drupal #SQLInjection #Infosec

Drupal – CVE-2026-9082 : cette faille critique de type injection SQL menace les sites Web https://www.it-connect.fr/drupal-cve-2026-9082-cette-faille-critique-de-type-injection-sql-menace-les-sites-web/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Web

Si votre CMS est un #Drupal, ou si vous connaissez quelqu’un qui administre un site Drupal : c’est le moment de vérifier la version.

La faille CVE-2026-9082 touche Drupal Core avec base PostgreSQL : injection SQL critique, exploitable sans compte, pouvant mener à fuite de données, élévation de privilèges voire RCE selon le contexte.

À corriger en priorité :
Drupal 10.5 → 10.5.10
Drupal 10.6 → 10.6.9
Drupal 11.2 → 11.2.12
Drupal 11.3 → 11.3.10

MySQL/MariaDB ne semblent pas concernés par cette SQLi, mais les mises à jour incluent aussi Symfony/Twig : patch recommandé pour tout le monde.
👇
https://www.drupal.org/sa-core-2026-004

"Drupal – CVE-2026-9082 : cette faille critique de type injection SQL menace les sites Web"
👇
https://www.it-connect.fr/drupal-cve-2026-9082-cette-faille-critique-de-type-injection-sql-menace-les-sites-web/

🔍 (à noter la diff entre estimation LLM VLAI et attribution CVSS officielle en Medium)
👇
https://vulnerability.circl.lu/vuln/CVE-2026-9082

💬
⬇️
https://infosec.pub/

#CyberVeille #CVE_2026_9082

⚠️ CRITICAL: Frappe LMS <2.50.1 is vulnerable (CVE-2026-39405, CVSS 9.4). Path traversal lets course editors write files outside restricted dirs via SCORM ZIP upload. Upgrade to 2.50.1 ASAP! https://radar.offseq.com/threat/cve-2026-39405-cwe-22-improper-limitation-of-a-pat-fc462187 #OffSeq #infosec #vuln #FrappeLMS

🟠 CVE-2026-39310 - High (8.6)

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Clipper API in Trilium Desktop (v0.101.3) allows full authentication bypass when running...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39310/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40165 - High (8.7)

authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass through SAML NameID XML Comment Injection. Due to how authentik extracted the NameID v...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40165/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9133 - High (7.7)

Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme (arn:aws-debug:file) accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform ar...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9133/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44052 - High (7.5)

Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44052/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44052 - High (7.5)

Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44052/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44051 - High (8.1)

An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker to read arbitrary files or overwrite arbitrary files via attacker-controlled symlink creation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44051/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44051 - High (8.1)

An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker to read arbitrary files or overwrite arbitrary files via attacker-controlled symlink creation.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44051/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-44050 - Critical (9.9)

A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code with escalated privileges or cause a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44050/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-44050 - Critical (9.9)

A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code with escalated privileges or cause a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44050/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44049 - High (7.5)

An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44049 - High (7.5)

An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44048 - High (8.8)

A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44048/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44048 - High (8.8)

A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44048/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44055 - High (7.5)

A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44055/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44055 - High (7.5)

A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44055/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5118 - Critical (9.8)

The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without valida...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5118/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5118 - Critical (9.8)

The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2. This is due to the plugin accepting a user-controlled 'role' parameter from POST data during user registration without valida...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5118/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔥 CRITICAL vuln in Divi Form Builder (≤5.1.2) — improper privilege management lets attackers create admin accounts via role parameter abuse. Restrict registration & watch for patches! CVE-2026-5118 https://radar.offseq.com/threat/cve-2026-5118-cwe-269-improper-privilege-managemen-c310b7ad #OffSeq #WordPress #CVE20265118 #Infosec

🚨 CRITICAL: CVE-2026-5118 in Divi Form Builder (≤5.1.2) lets unauth'd users gain admin privileges via unvalidated 'role' parameter. Disable registration & monitor for patches! https://radar.offseq.com/threat/cve-2026-5118-cwe-269-improper-privilege-managemen-c310b7ad #OffSeq #WordPress #PrivilegeEscalation #Vuln

🚨 CRITICAL: Avada (Fusion) Builder ≤3.15.2 has unauth RCE bug (CVE-2026-6279). Attackers can run PHP via exposed AJAX endpoint. Disable plugin or restrict access ASAP. Patch status: unconfirmed. https://radar.offseq.com/threat/cve-2026-6279-cwe-74-improper-neutralization-of-sp-f70da2f6 #OffSeq #WordPress #CVE20266279 #infosec

🔴 CVE-2026-6279 - Critical (9.8)

The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp_conditional_tags` case in `Fusion_Builder_Cond...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45444 - Critical (10)

Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files.

This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45444/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔐 CVE-2026-9139: Taiko AG1000-01A SMS Alert Gateway (Revs 7.3, 8, UM-AG1000_R7.2) has a CRITICAL flaw (CVSS 9.8) — hard-coded admin creds in client JS. No patch yet. Restrict access, isolate device, monitor closely. https://radar.offseq.com/threat/cve-2026-9139-cwe-798-use-of-hard-coded-credential-8aa594cc #OffSeq #Vulnerability #CVE20269139

🔴 CVE-2026-9139 - Critical (9.8)

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is implemented entirely in client-side JavaScript in login.zhtml, exposing static ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9139/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-9141 (CRITICAL, CVSS 9.8): Taiko AG1000-01A SMS Alert Gateway web config lets unauthenticated attackers get full admin rights. No patch available — restrict access & monitor now. https://radar.offseq.com/threat/cve-2026-9141-cwe-306-missing-authentication-for-c-ffd85a83 #OffSeq #CVE #IoTSecurity #Vuln

🔴 CVE-2026-9141 - Critical (9.8)

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unauthenticated attackers to access internal application pages without any session managem...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9141/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9144 - High (7.6)

Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authenticated attackers to execute persistent JavaScript by fragmenting malicious pay...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9144/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71216 - High (7.8)

A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71216/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71216 - High (7.8)

A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71216/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71213 - High (7.8)

An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71213 - High (7.8)

An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71212 - High (7.8)

A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-71212 - High (7.8)

A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71211 - Critical (9.8)

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71210 - Critical (9.8)

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations.

Please note: although this vulnerability carries a technical critical CVSS rat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71210/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71211 - Critical (9.8)

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-71210 - Critical (9.8)

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations.

Please note: although this vulnerability carries a technical critical CVSS rat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-71210/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34930 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different process protection mechanism.

Please note: an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34930/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34930 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different process protection mechanism.

Please note: an ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34930/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34929 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different inter-process communication mechanism.

Please ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34929/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34929 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different inter-process communication mechanism.

Please ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34929/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34928 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different named pipe communication mechanism.

Please not...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34928 - High (7.8)

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different named pipe communication mechanism.

Please not...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34928/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45208 - High (7.8)

A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45208 - High (7.8)

A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path

A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-46333, went unnoticed for nearly nine years.

Researchers from Qualys Threat Research Unit say the vulnerability could allow attackers to steal sensitive information, including SSH private keys, and run arbitrary commands with root-level privileges on affected systems.

#Qualys #Security #Advisory

Logic bug in the #Linux kernel's __ptrace_may_access() function
(CVE-2026-46333)

https://cdn2.qualys.com/advisory/2026/05/20/cve-2026-46333-ptrace.txt

Logic bug in the Linux kernel's __ptrace_may_access() function (CVE-2026-46333) https://lobste.rs/s/nwdn3w #linux #security
https://cdn2.qualys.com/advisory/2026/05/20/cve-2026-46333-ptrace.txt

Qualys has published their full write-up of CVE-2026-46333: https://www.openwall.com/lists/oss-security/2026/05/20/15

This includes a PoC to full root via `accounts-daemon` demonstrated in Debian 13, Fedora Workstation 43/44, so goes well beyond the initial "you need a program that opens a given file and you get to read it" assumption.

🚨 [CISA-2026:0520] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0520)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2008-4250 (https://secdb.nttzen.cloud/cve/detail/CVE-2008-4250)
- Name: Microsoft Windows Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067 ; https://nvd.nist.gov/vuln/detail/CVE-2008-4250

⚠️ CVE-2009-1537 (https://secdb.nttzen.cloud/cve/detail/CVE-2009-1537)
- Name: Microsoft DirectX NULL Byte Overwrite Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: DirectX
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028 ; https://nvd.nist.gov/vuln/detail/CVE-2009-1537

⚠️ CVE-2009-3459 (https://secdb.nttzen.cloud/cve/detail/CVE-2009-3459)
- Name: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities ; https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports ; https://nvd.nist.gov/vuln/detail/CVE-2009-3459

⚠️ CVE-2010-0249 (https://secdb.nttzen.cloud/cve/detail/CVE-2010-0249)
- Name: Microsoft Internet Explorer Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Internet Explorer
- Notes: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0249

⚠️ CVE-2010-0806 (https://secdb.nttzen.cloud/cve/detail/CVE-2010-0806)
- Name: Microsoft Internet Explorer Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Internet Explorer
- Notes: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0806

⚠️ CVE-2026-41091 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41091)
- Name: Microsoft Defender Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Defender
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41091

⚠️ CVE-2026-45498 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-45498)
- Name: Microsoft Defender Denial of Service Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Defender
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498 ; https://nvd.nist.gov/vuln/detail/CVE-2026-45498

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260520 #cisa20260520 #cve_2008_4250 #cve_2009_1537 #cve_2009_3459 #cve_2010_0249 #cve_2010_0806 #cve_2026_41091 #cve_2026_45498 #cve20084250 #cve20091537 #cve20093459 #cve20100249 #cve20100806 #cve202641091 #cve202645498

CVE ID: CVE-2008-4250
Vendor: Microsoft
Product: Windows
Date Added: 2026-05-20
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2008-4250

🚨 [CISA-2026:0520] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0520)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2008-4250 (https://secdb.nttzen.cloud/cve/detail/CVE-2008-4250)
- Name: Microsoft Windows Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067 ; https://nvd.nist.gov/vuln/detail/CVE-2008-4250

⚠️ CVE-2009-1537 (https://secdb.nttzen.cloud/cve/detail/CVE-2009-1537)
- Name: Microsoft DirectX NULL Byte Overwrite Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: DirectX
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028 ; https://nvd.nist.gov/vuln/detail/CVE-2009-1537

⚠️ CVE-2009-3459 (https://secdb.nttzen.cloud/cve/detail/CVE-2009-3459)
- Name: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities ; https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports ; https://nvd.nist.gov/vuln/detail/CVE-2009-3459

⚠️ CVE-2010-0249 (https://secdb.nttzen.cloud/cve/detail/CVE-2010-0249)
- Name: Microsoft Internet Explorer Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Internet Explorer
- Notes: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0249

⚠️ CVE-2010-0806 (https://secdb.nttzen.cloud/cve/detail/CVE-2010-0806)
- Name: Microsoft Internet Explorer Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Internet Explorer
- Notes: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0806

⚠️ CVE-2026-41091 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41091)
- Name: Microsoft Defender Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Defender
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41091

⚠️ CVE-2026-45498 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-45498)
- Name: Microsoft Defender Denial of Service Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Defender
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498 ; https://nvd.nist.gov/vuln/detail/CVE-2026-45498

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260520 #cisa20260520 #cve_2008_4250 #cve_2009_1537 #cve_2009_3459 #cve_2010_0249 #cve_2010_0806 #cve_2026_41091 #cve_2026_45498 #cve20084250 #cve20091537 #cve20093459 #cve20100249 #cve20100806 #cve202641091 #cve202645498

CVE ID: CVE-2009-1537
Vendor: Microsoft
Product: DirectX
Date Added: 2026-05-20
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2009-1537

🚨 [CISA-2026:0520] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0520)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2008-4250 (https://secdb.nttzen.cloud/cve/detail/CVE-2008-4250)
- Name: Microsoft Windows Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067 ; https://nvd.nist.gov/vuln/detail/CVE-2008-4250

⚠️ CVE-2009-1537 (https://secdb.nttzen.cloud/cve/detail/CVE-2009-1537)
- Name: Microsoft DirectX NULL Byte Overwrite Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: DirectX
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028 ; https://nvd.nist.gov/vuln/detail/CVE-2009-1537

⚠️ CVE-2009-3459 (https://secdb.nttzen.cloud/cve/detail/CVE-2009-3459)
- Name: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities ; https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports ; https://nvd.nist.gov/vuln/detail/CVE-2009-3459

⚠️ CVE-2010-0249 (https://secdb.nttzen.cloud/cve/detail/CVE-2010-0249)
- Name: Microsoft Internet Explorer Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Internet Explorer
- Notes: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0249

⚠️ CVE-2010-0806 (https://secdb.nttzen.cloud/cve/detail/CVE-2010-0806)
- Name: Microsoft Internet Explorer Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Internet Explorer
- Notes: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0806

⚠️ CVE-2026-41091 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41091)
- Name: Microsoft Defender Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Defender
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41091

⚠️ CVE-2026-45498 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-45498)
- Name: Microsoft Defender Denial of Service Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Defender
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498 ; https://nvd.nist.gov/vuln/detail/CVE-2026-45498

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260520 #cisa20260520 #cve_2008_4250 #cve_2009_1537 #cve_2009_3459 #cve_2010_0249 #cve_2010_0806 #cve_2026_41091 #cve_2026_45498 #cve20084250 #cve20091537 #cve20093459 #cve20100249 #cve20100806 #cve202641091 #cve202645498

CVE ID: CVE-2010-0806
Vendor: Microsoft
Product: Internet Explorer
Date Added: 2026-05-20
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2010-0806

🚨 [CISA-2026:0520] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0520)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2008-4250 (https://secdb.nttzen.cloud/cve/detail/CVE-2008-4250)
- Name: Microsoft Windows Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067 ; https://nvd.nist.gov/vuln/detail/CVE-2008-4250

⚠️ CVE-2009-1537 (https://secdb.nttzen.cloud/cve/detail/CVE-2009-1537)
- Name: Microsoft DirectX NULL Byte Overwrite Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: DirectX
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028 ; https://nvd.nist.gov/vuln/detail/CVE-2009-1537

⚠️ CVE-2009-3459 (https://secdb.nttzen.cloud/cve/detail/CVE-2009-3459)
- Name: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities ; https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports ; https://nvd.nist.gov/vuln/detail/CVE-2009-3459

⚠️ CVE-2010-0249 (https://secdb.nttzen.cloud/cve/detail/CVE-2010-0249)
- Name: Microsoft Internet Explorer Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Internet Explorer
- Notes: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0249

⚠️ CVE-2010-0806 (https://secdb.nttzen.cloud/cve/detail/CVE-2010-0806)
- Name: Microsoft Internet Explorer Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Internet Explorer
- Notes: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/981374 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0806

⚠️ CVE-2026-41091 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-41091)
- Name: Microsoft Defender Link Following Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Defender
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-41091 ; https://nvd.nist.gov/vuln/detail/CVE-2026-41091

⚠️ CVE-2026-45498 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-45498)
- Name: Microsoft Defender Denial of Service Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Defender
- Notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-45498 ; https://nvd.nist.gov/vuln/detail/CVE-2026-45498

#SecDB #InfoSec #CVE #CISA_KEV #cisa_20260520 #cisa20260520 #cve_2008_4250 #cve_2009_1537 #cve_2009_3459 #cve_2010_0249 #cve_2010_0806 #cve_2026_41091 #cve_2026_45498 #cve20084250 #cve20091537 #cve20093459 #cve20100249 #cve20100806 #cve202641091 #cve202645498

CVE ID: CVE-2010-0249
Vendor: Microsoft
Product: Internet Explorer
Date Added: 2026-05-20
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2010-0249

CVE ID: CVE-2010-0249
Vendor: Microsoft
Product: Internet Explorer
Date Added: 2026-06-03
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2010-0249

🚨 [CISA-2026:0520] CISA Adds 7 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0520)

CISA has added 7 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2008-4250 (https://secdb.nttzen.cloud/cve/detail/CVE-2008-4250)
- Name: Microsoft Windows Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Windows
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-067 ; https://nvd.nist.gov/vuln/detail/CVE-2008-4250

⚠️ CVE-2009-1537 (https://secdb.nttzen.cloud/cve/detail/CVE-2009-1537)
- Name: Microsoft DirectX NULL Byte Overwrite Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: DirectX
- Notes: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028 ; https://nvd.nist.gov/vuln/detail/CVE-2009-1537

⚠️ CVE-2009-3459 (https://secdb.nttzen.cloud/cve/detail/CVE-2009-3459)
- Name: Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Adobe
- Product: Acrobat and Reader
- Notes: https://www.cisa.gov/news-events/alerts/2009/10/13/adobe-reader-and-acrobat-vulnerabilities ; https://web.archive.org/web/20120324170253/http://www.adobe.com/support/security/bulletins/apsb09-15.html#:~:text=CVE%2D2009%2D3459).-,NOTE%3A,-There%20are%20reports ; https://nvd.nist.gov/vuln/detail/CVE-2009-3459

⚠️ CVE-2010-0249 (https://secdb.nttzen.cloud/cve/detail/CVE-2010-0249)
- Name: Microsoft Internet Explorer Use-After-Free Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Microsoft
- Product: Internet Explorer
- Notes: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2010/979352 ; https://nvd.nist.gov/vuln/detail/CVE-2010-0249