🛡️ CVE-2026-6597 (CVSS 5.1, MEDIUM): langflow-ai langflow v1.8.0 – 1.8.3 stores credentials without protection in Flow Using API. Public exploit available. Restrict access & rotate credentials until patched. https://radar.offseq.com/threat/cve-2026-6597-unprotected-storage-of-credentials-i-fc1cbce7 #OffSeq #Vulnerability #Langflow

🛡️ CVE-2026-6597 (CVSS 5.1, MEDIUM): langflow-ai langflow v1.8.0 – 1.8.3 stores credentials without protection in Flow Using API. Public exploit available. Restrict access & rotate credentials until patched. https://radar.offseq.com/threat/cve-2026-6597-unprotected-storage-of-credentials-i-fc1cbce7 #OffSeq #Vulnerability #Langflow

MEDIUM severity alert: CVE-2026-6591 – Path traversal in ComfyUI <=0.13.0 (LoadImage Node, folder_paths.py). Exploit public, vendor silent. Assess exposure & monitor for fixes. https://radar.offseq.com/threat/cve-2026-6591-path-traversal-in-comfyui-480d807d #OffSeq #ComfyUI #Vuln #ThreatIntel

MEDIUM severity alert: CVE-2026-6591 – Path traversal in ComfyUI <=0.13.0 (LoadImage Node, folder_paths.py). Exploit public, vendor silent. Assess exposure & monitor for fixes. https://radar.offseq.com/threat/cve-2026-6591-path-traversal-in-comfyui-480d807d #OffSeq #ComfyUI #Vuln #ThreatIntel

🚩 H3C Magic B1 devices ≤100R004 hit by HIGH severity buffer overflow (CVE-2026-6581). Public exploit code out, no vendor patch yet. Restrict management interface access & monitor /goform/aspForm activity. Details: https://radar.offseq.com/threat/cve-2026-6581-buffer-overflow-in-h3c-magic-b1-6a61fe35 #OffSeq #Vuln #InfoSec

🚩 H3C Magic B1 devices ≤100R004 hit by HIGH severity buffer overflow (CVE-2026-6581). Public exploit code out, no vendor patch yet. Restrict management interface access & monitor /goform/aspForm activity. Details: https://radar.offseq.com/threat/cve-2026-6581-buffer-overflow-in-h3c-magic-b1-6a61fe35 #OffSeq #Vuln #InfoSec

🔔 CVE-2026-6572: Collabora KodExplorer (4.0 – 4.52) has a MEDIUM improper authorization bug in fileUpload. High attack complexity, no patch, vendor silent. Restrict endpoint access & monitor for updates. https://radar.offseq.com/threat/cve-2026-6572-improper-authorization-in-collabora--c07f449a #OffSeq #Vulnerability #Cybersecurity

🔔 CVE-2026-6572: Collabora KodExplorer (4.0 – 4.52) has a MEDIUM improper authorization bug in fileUpload. High attack complexity, no patch, vendor silent. Restrict endpoint access & monitor for updates. https://radar.offseq.com/threat/cve-2026-6572-improper-authorization-in-collabora--c07f449a #OffSeq #Vulnerability #Cybersecurity

📢 CVE-2026-6574 (MEDIUM): osuuu LightPicture 1.2.0 – 1.2.2 has hard-coded credentials in API Upload Endpoint (/public/install/lp.sql). No vendor patch yet. Restrict endpoint access & monitor for misuse. More info: https://radar.offseq.com/threat/cve-2026-6574-hard-coded-credentials-in-osuuu-ligh-b66f67a8 #OffSeq #Vulnerability #AppSec

📢 CVE-2026-6574 (MEDIUM): osuuu LightPicture 1.2.0 – 1.2.2 has hard-coded credentials in API Upload Endpoint (/public/install/lp.sql). No vendor patch yet. Restrict endpoint access & monitor for misuse. More info: https://radar.offseq.com/threat/cve-2026-6574-hard-coded-credentials-in-osuuu-ligh-b66f67a8 #OffSeq #Vulnerability #AppSec

🚩 SSRF alert: CVE-2026-6573 in PHPEMS 11.0 (MEDIUM, CVSS 5.3) affects /app/exam/controller/exams.master.php via uploadfile argument. Exploit is public — review exposure! https://radar.offseq.com/threat/cve-2026-6573-server-side-request-forgery-in-phpem-e98897b9 #OffSeq #PHPEMS #SSRF #Vuln

🚩 SSRF alert: CVE-2026-6573 in PHPEMS 11.0 (MEDIUM, CVSS 5.3) affects /app/exam/controller/exams.master.php via uploadfile argument. Exploit is public — review exposure! https://radar.offseq.com/threat/cve-2026-6573-server-side-request-forgery-in-phpem-e98897b9 #OffSeq #PHPEMS #SSRF #Vuln

CVE-2026-6570 (MEDIUM): kodcloud KodExplorer (v4.0 – 4.52) suffers an auth bypass in initInstall, allowing remote unauthorized access. No fix yet — restrict access & monitor for updates. https://radar.offseq.com/threat/cve-2026-6570-authorization-bypass-in-kodcloud-kod-786c22b7 #OffSeq #Vuln #KodExplorer #Infosec

CVE-2026-6570 (MEDIUM): kodcloud KodExplorer (v4.0 – 4.52) suffers an auth bypass in initInstall, allowing remote unauthorized access. No fix yet — restrict access & monitor for updates. https://radar.offseq.com/threat/cve-2026-6570-authorization-bypass-in-kodcloud-kod-786c22b7 #OffSeq #Vuln #KodExplorer #Infosec

CVE-2026-6568: MEDIUM severity path traversal in kodcloud KodExplorer (v4.0 – 4.52). Public exploit released; vendor nonresponsive. Review and restrict public shares, monitor for abuse. More: https://radar.offseq.com/threat/cve-2026-6568-path-traversal-in-kodcloud-kodexplor-1b477f95 #OffSeq #infosec #vulnerability #websecurity

CVE-2026-6568: MEDIUM severity path traversal in kodcloud KodExplorer (v4.0 – 4.52). Public exploit released; vendor nonresponsive. Review and restrict public shares, monitor for abuse. More: https://radar.offseq.com/threat/cve-2026-6568-path-traversal-in-kodcloud-kodexplor-1b477f95 #OffSeq #infosec #vulnerability #websecurity

🟠 CVE-2026-6560 - High (8.8)

A security vulnerability has been detected in H3C Magic B0 up to 100R002. This vulnerability affects the function Edit_BasicSSID of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack can be execu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6560/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH-severity buffer overflow (CVE-2026-6560) in H3C Magic B0 (100R002) allows remote code execution or DoS via Edit_BasicSSID in /goform/aspForm. No patch yet; restrict access & monitor updates. https://radar.offseq.com/threat/cve-2026-6560-buffer-overflow-in-h3c-magic-b0-f38a59da #OffSeq #H3C #Vuln #BufferOverflow

🟠 CVE-2026-6560 - High (8.8)

A security vulnerability has been detected in H3C Magic B0 up to 100R002. This vulnerability affects the function Edit_BasicSSID of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack can be execu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6560/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH-severity buffer overflow (CVE-2026-6560) in H3C Magic B0 (100R002) allows remote code execution or DoS via Edit_BasicSSID in /goform/aspForm. No patch yet; restrict access & monitor updates. https://radar.offseq.com/threat/cve-2026-6560-buffer-overflow-in-h3c-magic-b0-f38a59da #OffSeq #H3C #Vuln #BufferOverflow

🟠 CVE-2026-6563 - High (8.8)

A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to initiate the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6563/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-6563: HIGH severity buffer overflow in H3C Magic B1 ≤100R004 (SetAPWifiorLedInfoById, /goform/aspForm). Public exploit out, vendor silent. Audit exposure, restrict access! https://radar.offseq.com/threat/cve-2026-6563-buffer-overflow-in-h3c-magic-b1-2ad2f98e #OffSeq #vuln #infosec #routers

🟠 CVE-2026-6563 - High (8.8)

A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to initiate the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6563/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-6563: HIGH severity buffer overflow in H3C Magic B1 ≤100R004 (SetAPWifiorLedInfoById, /goform/aspForm). Public exploit out, vendor silent. Audit exposure, restrict access! https://radar.offseq.com/threat/cve-2026-6563-buffer-overflow-in-h3c-magic-b1-2ad2f98e #OffSeq #vuln #infosec #routers

MEDIUM severity alert: CVE-2026-0868 (CVSS 6.4) in EMC – Easily Embed Calendly Scheduling WP plugin (≤4.4) allows contributor-level XSS attacks. No patch yet — restrict access, monitor updates. https://radar.offseq.com/threat/cve-2026-0868-cwe-79-improper-neutralization-of-in-3458e49a #OffSeq #WordPress #Infosec #XSS

MEDIUM severity alert: CVE-2026-0868 (CVSS 6.4) in EMC – Easily Embed Calendly Scheduling WP plugin (≤4.4) allows contributor-level XSS attacks. No patch yet — restrict access, monitor updates. https://radar.offseq.com/threat/cve-2026-0868-cwe-79-improper-neutralization-of-in-3458e49a #OffSeq #WordPress #Infosec #XSS

🟠 CVE-2026-41113 - High (8.1)

sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remote.c.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41113/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Remote Code Execution Vulnerability Discovered in Protobuf.js Library

Protobuf.js patched a critical remote code execution vulnerability (CVE-2026-41242) caused by unsafe dynamic code generation when processing malicious protobuf schemas. The flaw allows attackers to execute arbitrary JavaScript code on servers or developer machines, potentially exposing sensitive credentials and enabling lateral movement.

**If your applications use protobuf.js (or libraries like gRPC, Firebase, or Google Cloud SDKs), update protobuf.js to version 8.0.1 or 7.5.5 ASAP. Run npm audit to catch hidden dependencies. Going forward, only load schemas you control and prefer precompiled static schemas in production to avoid this class of attack entirely.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-remote-code-execution-vulnerability-discovered-in-protobuf-js-library-o-k-k-y-h/gD2P6Ple2L

🚨 CRITICAL: CVE-2026-41242 in protobuf.js (<7.5.5, 8.0.0-experimental <8.0.1) allows code injection via "type" fields — remote code execution possible. Upgrade to 7.5.5 or 8.0.1+ now! https://radar.offseq.com/threat/cve-2026-41242-cwe-94-improper-control-of-generati-3ca40985 #OffSeq #infosec #protobuff #CVE202641242

Critical Remote Code Execution Vulnerability Discovered in Protobuf.js Library

Protobuf.js patched a critical remote code execution vulnerability (CVE-2026-41242) caused by unsafe dynamic code generation when processing malicious protobuf schemas. The flaw allows attackers to execute arbitrary JavaScript code on servers or developer machines, potentially exposing sensitive credentials and enabling lateral movement.

**If your applications use protobuf.js (or libraries like gRPC, Firebase, or Google Cloud SDKs), update protobuf.js to version 8.0.1 or 7.5.5 ASAP. Run npm audit to catch hidden dependencies. Going forward, only load schemas you control and prefer precompiled static schemas in production to avoid this class of attack entirely.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-remote-code-execution-vulnerability-discovered-in-protobuf-js-library-o-k-k-y-h/gD2P6Ple2L

🚨 CRITICAL: CVE-2026-41242 in protobuf.js (<7.5.5, 8.0.0-experimental <8.0.1) allows code injection via "type" fields — remote code execution possible. Upgrade to 7.5.5 or 8.0.1+ now! https://radar.offseq.com/threat/cve-2026-41242-cwe-94-improper-control-of-generati-3ca40985 #OffSeq #infosec #protobuff #CVE202641242

🛡️ CVE-2026-2505: MEDIUM severity stored XSS in Categories Images plugin (≤3.3.1) lets Contributor+ users inject scripts via the 'class' attribute. Restrict access & watch for a patch. https://radar.offseq.com/threat/cve-2026-2505-cwe-79-improper-neutralization-of-in-ce86bd04 #OffSeq #WordPress #XSS #Vuln

🛡️ CVE-2026-2505: MEDIUM severity stored XSS in Categories Images plugin (≤3.3.1) lets Contributor+ users inject scripts via the 'class' attribute. Restrict access & watch for a patch. https://radar.offseq.com/threat/cve-2026-2505-cwe-79-improper-neutralization-of-in-ce86bd04 #OffSeq #WordPress #XSS #Vuln

🛡️ CVE-2026-2986: MEDIUM severity Stored XSS in Contextual Related Posts plugin (≤4.2.1) for WordPress. Contributor+ users can inject scripts — risk to all page viewers. Restrict access & monitor for patches. https://radar.offseq.com/threat/cve-2026-2986-cwe-79-improper-neutralization-of-in-55e6dfdd #OffSeq #WordPress #XSS #Infosec

🛡️ CVE-2026-2986: MEDIUM severity Stored XSS in Contextual Related Posts plugin (≤4.2.1) for WordPress. Contributor+ users can inject scripts — risk to all page viewers. Restrict access & monitor for patches. https://radar.offseq.com/threat/cve-2026-2986-cwe-79-improper-neutralization-of-in-55e6dfdd #OffSeq #WordPress #XSS #Infosec

🟠 CVE-2026-5426 - High (7.5)

Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deseria...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5426/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-5426 in Digital Knowledge KnowledgeDeliver (pre-Feb 2026) allows RCE via hard-coded ASP.NET machineKey & ViewState. No patch yet. Restrict access & monitor for ViewState abuse. https://radar.offseq.com/threat/cve-2026-5426-cwe-321-use-of-hard-coded-cryptograp-c04eb03f #OffSeq #Vuln #AppSec #InfoSec

🔥 HIGH severity: CVE-2026-6518 affects niteo CMP – Coming Soon & Maintenance Plugin (≤4.1.16). Authenticated Admins can trigger RCE via malicious ZIP uploads. No patch yet — restrict admin access & monitor logs. More: https://radar.offseq.com/threat/cve-2026-6518-cwe-434-unrestricted-upload-of-file--f3d41796 #OffSeq #WordPress #RCE #Vuln

🔥 HIGH severity: CVE-2026-6518 affects niteo CMP – Coming Soon & Maintenance Plugin (≤4.1.16). Authenticated Admins can trigger RCE via malicious ZIP uploads. No patch yet — restrict admin access & monitor logs. More: https://radar.offseq.com/threat/cve-2026-6518-cwe-434-unrestricted-upload-of-file--f3d41796 #OffSeq #WordPress #RCE #Vuln

🟠 CVE-2026-6518 - High (8.8)

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload and remote code execution in all versions up to, and including, 4.1.16 via the `cmp_theme_update_install` AJAX action. This is ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6518/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40494 - Critical (9.8)

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302, the TGA codec's RLE decoder in `tga.c` has an asymmetric bounds check ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-40494 in HappySeaFox sail (<45d48d1f2e8...) enables out-of-bounds write in TGA decoder. Heap overflow risk — update to commit 45d48d1f2e8e0d73e80bc1fd5310cb57f4547302. No exploits seen yet. https://radar.offseq.com/threat/cve-2026-40494-cwe-787-out-of-bounds-write-in-happ-d7181ae5 #OffSeq #Vuln #AppSec

🚨 CVE-2026-40492: CRITICAL out-of-bounds write in HappySeaFox sail <36aa5c7ec8. XWD codec flaw may allow RCE or DoS via memory corruption. Patch with latest commit ASAP. No active exploits. https://radar.offseq.com/threat/cve-2026-40492-cwe-787-out-of-bounds-write-in-happ-780830ff #OffSeq #Vulnerability #HappySeaFox #InfoSec

🔴 CVE-2026-40492 - Critical (9.8)

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to commit 36aa5c7ec8a2bb35f6fb867a1177a6f141156b02, the XWD codec resolves pixel format based on `pixmap_depth` but the by...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40492/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔶 New security advisory:

CVE-2026-40487 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-40487-postiz-stored-xss-via-file-upload-poc

#CVE #VulnerabilityManagement #CyberSec

🟠 CVE-2026-40487 - High (8.9)

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to upload arbitrary HTML, SVG, or other executable file types to the server by spoofing the `Content-Type` header....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40487/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35582 - High (8.8)

Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand() is vulnerable to OS command injection because it interpolates temporary file paths into a /bin/sh -c shell command string without any escapi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35582/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40572 - Critical (9)

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (MemoryMapRange) allows Ring 3 user-mode processes to map arbitrary virtual address ranges into their address space without validati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40572/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚩 CRITICAL: CVE-2026-40572 impacts MinecAnton209 NovumOS < 0.24. Syscall 15 flaw allows local privilege escalation by mapping over kernel memory — patch to v0.24+ ASAP! https://radar.offseq.com/threat/cve-2026-40572-cwe-269-improper-privilege-manageme-6ff979fd #OffSeq #CVE202640572 #NovumOS #Infosec

🟠 CVE-2026-40350 - High (8.8)

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can access the user-management endpoints `/settings/users` and use them to enumerate all users and create a new admi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40350/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔍 CVE-2026-40317 (CRITICAL, CVSS 9.4): NovumOS < 0.24 allows local privilege escalation via unchecked entry point in Syscall 12. Patch to 0.24 ASAP or restrict syscalls to mitigate. Full details: https://radar.offseq.com/threat/cve-2026-40317-cwe-269-improper-privilege-manageme-d4098dd0 #OffSeq #Vuln #NovumOS #InfoSec

🔴 CVE-2026-40317 - Critical (9.3)

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 (JumpToUser) accepts an arbitrary entry point address from user-space registers without validation, allowing any Ring 3 user-mode pr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40317/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35465 - High (7.5)

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35465/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 New security advisory:

CVE-2026-5807 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-5807-vault-unauth-denial-of-service-blocks-admin

#Cybersecurity #ZeroDay #ThreatIntel

🟠 CVE-2026-5807 - High (7.5)

Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedly initiate or cancel root token generation or rekey operations, occupying the single in-progress operation slot. This prevents legitimate operators...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4525 - High (7.5)

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4525/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3605 - High (8.1)

An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delet...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3605/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-40582: ChurchCRM < 7.2.0 has a CRITICAL auth bypass (CVSS 9.1). /api/public/user/login lets attackers with a password skip lockout & 2FA to get API access. Upgrade to 7.2.0+ ASAP. https://radar.offseq.com/threat/cve-2026-40582-cwe-288-authentication-bypass-using-58dc9576 #OffSeq #ChurchCRM #CVE202640582 #infosec

🟠 CVE-2026-40581 - High (8.1)

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request wi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40581/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40484 - Critical (9.1)

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40484/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: ChurchCRM <7.2.0 vulnerable to RCE (CVE-2026-40484). Crafted backup restores allow webshell upload; CSRF flaw increases risk. Patch to 7.2.0+ now. Details: https://radar.offseq.com/threat/cve-2026-40484-cwe-269-improper-privilege-manageme-9bb4be14 #OffSeq #CVE202640484 #ChurchCRM #RCE

🟠 CVE-2026-40349 - High (8.8)

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own account to administrator by sending `isAdmin=true` to `PUT /settings/users/{userId}` for thei...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40349/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40348 - High (7.7)

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through `POST /settings/jellyfin/server-url-verify`. ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40348/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL: CVE-2026-40324 in ChilliCream Hot Chocolate allows attackers to crash GraphQL workers via deeply nested queries (StackOverflowException). Denial of service risk. Patch to 12.22.7, 13.9.16, 14.3.1, 15.1.14. Details: https://radar.offseq.com/threat/cve-2026-40324-cwe-674-uncontrolled-recursion-in-c-0796aaf1 #OffSeq #CVE202640324 #GraphQL #DoS

🔴 CVE-2026-40324 - Critical (9.1)

Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1.14, Hot Chocolate's recursive descent parser `Utf8GraphQLParser` has no recursion depth limit. A crafted GraphQL document with deeply nested selec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40324/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-2262 - High (7.5)

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appointments/` REST API endpoint. This is due to the endpoint being regist...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2262/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40478 - Critical (9)

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40478/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 New security advisory:

CVE-2026-40477 affects multiple systems.

• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-40477-thymeleaf-ssti-allows-server-side-code-execution

#Cybersecurity #ZeroDay #ThreatIntel

🔴 CVE-2026-40477 - Critical (9)

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to preve...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40477/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40474 - High (7.6)

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is ne...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40474/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 New security advisory:

CVE-2026-40352 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-40352-fastgpt-nosql-injection-enables-account-takeover

#Cybersecurity #ZeroDay #ThreatIntel

🟠 CVE-2026-40352 - High (8.8)

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to NoSQL injection. An authenticated attacker can bypass the "old password" verification by injecting MongoDB query operators. This...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40352/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40351 - Critical (9.8)

FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses TypeScript type assertion without runtime validation, allowing an unauthenticated attacker to pass a MongoDB query operator object (e.g...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40351/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40321 - High (8)

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.2.2, a user could upload a specially crafted SVG file that could include scripts that can target both authenticated a...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40321/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40258 - Critical (9.1)

The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6.0 through 3.11.0 have a path traversal vulnerability (Zip Slip) in the media archive import feature. An authenticated user with owner-level privile...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40258/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-40258: CRITICAL path traversal in gramps-web-api (1.6.0-3.11.0). Owner-level users can write files outside intended dirs via crafted ZIPs. Upgrade to 3.11.1+ to mitigate! https://radar.offseq.com/threat/cve-2026-40258-cwe-22-improper-limitation-of-a-pat-00f841f8 #OffSeq #CVE202640258 #PathTraversal #Infosec

🔴 CVE-2026-35546 - Critical (9.8)

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted
archives to be accepted, enabling attackers to plant and execute code
and obtain a reverse shell.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35546/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: Anviz CX7 & CX2 Lite firmware vuln (CVE-2026-35546) allows unauthenticated uploads — attackers can execute code & gain reverse shell. All versions affected. No mitigation yet. https://radar.offseq.com/threat/cve-2026-35546-cwe-306-in-anviz-anviz-cx7-firmware-147e04a2 #OffSeq #IoTSecurity #vulnerability

🟠 CVE-2026-40461 - High (7.5)

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug
settings (e.g., enabling SSH), allowing unauthorized state changes that
can facilitate later compromise.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40461/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40525 - Critical (9.1)

OpenViking prior to commit c7bb167 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40525/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40527 - High (7.8)

radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40527/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40303 - High (7.5)

zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and calls make([]string, count) with no upper bound before any token validat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40303/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40434 - High (8.1)

Anviz CrossChex Standard
lacks source verification in the client/server channel, enabling TCP
packet injection by an attacker on the same network to alter or disrupt
application traffic.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40434/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Hey, @cR0w, another ../ for you: https://vuldb.com/cve/CVE-2026-40342

🔴 CVE-2026-40342 - Critical (9.9)

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40342/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40066 - High (8.8)

Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The
device unpacks and executes a script resulting in unauthenticated remote
code execution.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40066/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35682 - High (8.8)

Anviz CX2 Lite is vulnerable to an authenticated command injection via a
filename parameter that enables arbitrary command execution (e.g.,
starting telnetd), resulting in root‑level access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35682/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34232 - High (7.5)

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the xdr_status_vector() function does not handle the isc_arg_cstring type when decoding an op_response packet, causing a server crash w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34232/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32650 - High (7.5)

Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable
encryption, causing database credentials to be sent in plaintext and
enabling unauthorized database access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32650/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32324 - High (7.7)

Anviz CX7 Firmware is 
vulnerable because the application embeds reusable certificate/key
material, enabling decryption of MQTT traffic and potential interaction
with device messaging channels at scale.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32324/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32107 - High (8.8)

xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the privilege drop process. This improper privilege management could allow an authenticated local attacker to es...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32107/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40170 - High (7.5)

ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40170/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33337 - High (7.5)

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdr_datum() function does not validate that a cstring length conforms to the slice descriptor bo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33337/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CRITICAL: Horner Automation Cscape and XL4, XL7 PLC

Horner Automation Cscape v10.0, XL4 PLC v16.32.0, and XL7 PLC v15.60 contain a critical password brute-force vulnerability (CVE-2026-6284, CVSS 9.1) with no rate limiting. This affects manufacturing environments globally and allows unauthenticated network attackers to compromise PLCs controlling cr…

https://threatnoir.com/focus

#infosec #cybersecurity

⚠️ CRITICAL: CVE-2026-6284 hits Horner Automation Cscape v10.0 PLCs. Weak passwords & no input limits allow attackers to brute force access remotely. No patch yet — restrict access, monitor logins, & harden networks. https://radar.offseq.com/threat/cve-2026-6284-cwe-521-in-horner-automation-cscape-17ab7886 #OffSeq #ICS #OTSecurity #Infosec

🔴 CVE-2026-6284 - Critical (9.1)

An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and services. The limited password complexity and no password input limiters makes brute force password enumeration possible.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-65104 - High (7.9)

Firebird is an open-source relational database management system. In versions FB3 of the client library placed incorrect data length values into XSQLDA fields when communicating with FB4 or higher servers, resulting in an information leak. This is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-65104/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40516 - High (8.3)

OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper valida...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40516/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40515 - High (7.5)

OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and glob tool...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40515/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CRITICAL SQL injection (CVE-2026-37749) in CodeAstro Simple Attendance Management System v1.0: Remote unauthenticated attackers can bypass authentication via index.php. Restrict access & deploy WAFs until a patch arrives. https://radar.offseq.com/threat/cve-2026-37749-na-c4c6e5dc #OffSeq #SQLi #Infosec

🔴 CVE-2026-37749 - Critical (9.8)

A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authentication via the username parameter in index.php.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-37749/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5718 - High (8.1)

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file upload in versions up to, and including, 1.3.9.6. This is due to insufficient file type validation that occurs when custom blacklist typ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5710 - High (7.5)

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary File Read in versions up to and including 1.3.9.6. This is due to the plugin using client-supplied mfile[] POST val...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5710/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-33829 - kolejny ciekawy błąd w Windowsie.
Jeżeli masz zainstalowane "Narzędzie Wycinanie" (a najprawdopodobniej masz) - wystarczy, że wejdziesz na spreparowaną stronę internetową, żeby Twoje hasło do Windowsa (hash NTLM) popłynęło na serwer atakującego.

CVE-2026-33829 - kolejny ciekawy błąd w Windowsie.
Jeżeli masz zainstalowane "Narzędzie Wycinanie" (a najprawdopodobniej masz) - wystarczy, że wejdziesz na spreparowaną stronę internetową, żeby Twoje hasło do Windowsa (hash NTLM) popłynęło na serwer atakującego.

CVE-2026-33829: How a Deep Link in Windows Can Expose Net-NTLM Credentials https://core-jmp.org/2026/04/cve-2026-33829-how-a-deep-link-in-windows-can-expose-net-ntlm-credentials/

🟠 CVE-2026-6307 - High (8.8)

Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6307/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-3464 - High (8.8)

The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the 'ajax_attach_file' function in all versions up to, and including, 8.3.4. This makes it possible for authent...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3464/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-6296 - Critical (9.6)

Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6296/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6297 - High (8.3)

Use after free in Proxy in Google Chrome prior to 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6297/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30996 - High (7.5)

An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and read arbitrary files from the system via a crafted GET request.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30996/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6290 - High (8)

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current ACL token. This allows an authenticated GUI user with access in one org, to use the query() plugin, in a no...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34242 - High (7.7)

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded files, potentially following symlinks outside the repository. This issue has been fixed in version 5.17.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34242/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-33435 - High (8)

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial configuration files which could lead to remote code execution under certain circumstances. This issue has been fixed in version...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33435/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-40322 - Critical (9)

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, Mermaid diagrams are rendered with securityLevel set to "loose", and the resulting SVG is injected into the DOM via innerHTML. This allows attacker-control...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40322/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40318 - High (8.5)

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enfo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40318/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40259 - High (8.1)

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, the /api/av/removeUnusedAttributeView endpoint is protected only by generic authentication that accepts publish-service RoleReader tokens. The handler pass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40259/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-22734 - High (8.6)

Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SA...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-22734/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30995 - High (8.6)

Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_ver.php endpoint.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30995/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30994 - High (7.5)

Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive information, including active session credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30994/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30993 - Critical (9.8)

Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() function at config.php. This vulnerability is exploitable via a crafted input.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30993/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6507 - High (7.5)

A flaw was found in dnsmasq. A remote attacker could exploit an out-of-bounds write vulnerability by sending a specially crafted BOOTREPLY (Bootstrap Protocol Reply) packet to a dnsmasq server configured with the `--dhcp-split-relay` option. This ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6507/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-23853 - High (8.4)

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a use of weak c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23853/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30778 - High (7.5)

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0.

Users are recommended to upgrade to version 10.4.0, which fixes...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30778 - High (7.5)

The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

This issue affects Apache SkyWalking: from 9.7.0 through 10.3.0.

Users are recommended to upgrade to version 10.4.0, which fixes...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30778/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4145 - High (7.8)

During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4145/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4145 - High (7.8)

During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4145/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30364 - High (7.5)

CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30364/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-67841 - High (7.5)

Nordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67841/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-30625 - Critical (9.8)

Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The application allows users to define MCP tasks with arbitrary command and args values. Although an allowlist exists, certain allowed com...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30625/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30624 - High (8.6)

Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The application allows users to define MCP servers using a JSON configuration containing arbitrary command and args values. These va...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30617 - High (8.6)

LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30617/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30615 - High (8)

A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. When Windsurf processes attacker-controlled HTML content, malicious instructions can cause unauthorized modification o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30615/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-30461 - High (8.3)

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30461/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-20147 - Critical (9.9)

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid admini...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20147/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-20184 - Critical (9.8)

A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service.

This vulnerability existed because of imprope...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20184/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34632 - High (8.2)

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. A low-privileged local attacker could have exploited this vulnerab...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34632/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-21719: HIGH severity OS command injection in CubeCart <6.6.0. Authenticated admins can run arbitrary OS commands. No patch yet — restrict admin access & monitor logs. https://radar.offseq.com/threat/cve-2026-21719-improper-neutralization-of-special--543f1327 #OffSeq #CubeCart #Vuln #Infosec

CVE-2026-33825 deep-dive: The researcher commented out the full credential dump. Here's what that means. https://nefariousplan.com/posts/bluhammer/

🟠 CVE-2026-23775 - High (7.6)

Dell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Release versions 8.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.10 contain an insertion of sensitive information into log file vulnerabil...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23775/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-36568 - High (7.8)

Dell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an insufficiently protected credential...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-36568/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-33392: HIGH severity RCE in JetBrains YouTrack < 2025.3.131383. High privileged users can bypass sandbox for remote code execution. No patch yet — restrict admin rights & monitor advisories. https://radar.offseq.com/threat/cve-2026-33392-cwe-1336-in-jetbrains-youtrack-3a31f8ef #OffSeq #YouTrack #Infosec #Vuln

⚠️ CRITICAL: CVE-2026-6443 in WordPress Accordion & Accordion Slider v1.4.6 — embedded backdoor enables persistent access & spam injection. Remove/disable the plugin ASAP. No patch yet. https://radar.offseq.com/threat/cve-2026-6443-cwe-506-embedded-malicious-code-in-e-b2b69859 #OffSeq #WordPress #CVE20266443 #Infosec

🚨 CVE-2026-6443 (CRITICAL): WordPress Accordion & Accordion Slider v1.4.6 embeds a backdoor (CWE-506), enabling persistent unauthorized access & spam. No patch — remove or disable plugin now! https://radar.offseq.com/threat/cve-2026-6443-cwe-506-embedded-malicious-code-in-e-b2b69859 #OffSeq #WordPress #Infosec #Vuln

🔴 CVE-2026-6443 - Critical (9.8)

The Accordion and Accordion Slider plugin for WordPress is vulnerable to an injected backdoor in version 1.4.6. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This ma...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6443/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4659 - High (7.5)

The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Arbitrary File Read via the Repeater JSON/CSV URL parameter in versions up to, and including, 2.0.6. This is due to insufficient path traversal sanitization in the URLtoRel...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4659/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ CVE-2026-31843: CRITICAL improper access control in goodoneuz/pay-uz <=2.2.24 allows unauthenticated PHP file overwrite & RCE via /payment/api/editable/update. No patch yet — restrict endpoint access! https://radar.offseq.com/threat/cve-2026-31843-cwe-284-improper-access-control-lea-f84d8bc9 #OffSeq #CVE202631843 #Laravel #RCE

🟠 CVE-2026-31987 - High (7.5)

JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors.
Users are advised to upgrade to Airflow version that contains fix.

Users are recommended to upgrade to version 3.2.0, which fixes this issue.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31987/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-41118 - Critical (9.1)

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS).

If the database is configured to use Tencent COS as the storage backend, an attacker could ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-41118/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35569 - High (8.7)

ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a stored cross-site scripting vulnerability in SEO-related fields (SEO Title and Meta Description), where user-controlled input is rendered withou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35569/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-34393 - High (8.8)

Weblate is a web based localization tool. In versions prior to 5.17, the user patching API endpoint didn't properly limit the scope of edits. This issue has been fixed in version 5.17.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34393/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

2026-W16 — Weekly Threat Roundup

🚨 Critical Apache ActiveMQ flaw (CVE-2026-34197) actively exploited after 13-year dormancy, now on CISA KEV catalog
🏛️ Operation PowerOFF dismantles 53 DDoS-for-hire domains, arrests 4, exposes 3M criminal accounts across 21 countries
🔍 Three Windows zero-days (BlueHammer, RedSun, UnDefend) acti…

https://threatnoir.com/weekly/2026-w16

#infosec #cybersecurity #threatintel

CISA added Apache ActiveMQ CVE-2026-34197 to the Known Exploited Vulnerabilities list on April 17 with a federal deadline of April 30. Horizon3's Naveen Sunkavally found the bug by running Claude over the Jolokia code. The flaw has sat in the codebase for 13 years. 8,000+ brokers on the open internet, admin:admin still the common credential. I have watched every real incident start with an unrotated credential, not a zero-day.

#InfoSec #OpenSource #CyberSecurity

2026-W16 — Weekly Threat Roundup

🚨 Critical Apache ActiveMQ flaw (CVE-2026-34197) actively exploited after 13-year dormancy, now on CISA KEV catalog
🏛️ Operation PowerOFF dismantles 53 DDoS-for-hire domains, arrests 4, exposes 3M criminal accounts across 21 countries
🔍 Three Windows zero-days (BlueHammer, RedSun, UnDefend) acti…

https://threatnoir.com/weekly/2026-w16

#infosec #cybersecurity #threatintel

CISA Warns of Active Exploitation in Apache ActiveMQ Jolokia API Vulnerability

CISA added a high-severity Apache ActiveMQ vulnerability (CVE-2026-34197) to its KEV catalog due to active exploitation that allows attackers to run arbitrary OS commands via the Jolokia API. The flaw is particularly dangerous when chained with CVE-2024-32114, which enables unauthenticated remote code execution in certain versions.

**If you're running Apache ActiveMQ, upgrade to version 5.19.4 or 6.2.3 ASAP. Atackers are actively exploiting this right now. While you're at it, make sure your ActiveMQ console is not exposed to the internet, change any default admin:admin credentials, and disable the Jolokia endpoint entirely if you don't need it.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-warns-of-active-exploitation-in-apache-activemq-jolokia-api-vulnerability-i-v-s-d-e/gD2P6Ple2L

CRITICAL: Apache ActiveMQ RCE vuln (CVE-2026-34197) disclosed. No patch yet — review your security posture & monitor vendor channels for updates. Remote attackers could fully compromise systems. https://radar.offseq.com/threat/recent-apache-activemq-vulnerability-exploited-in--98176e07 #OffSeq #ActiveMQ #Vuln #InfoSec

An Anthropic researcher used Claude to find Apache ActiveMQ flaw CVE-2026-34197. Maintainers shipped the fix in seven days. CISA added the CVE to its federal exploited-vulnerability list. The same week, Cal.com closed source citing AI scanners as the reason. I have run defender-side tooling rollouts for 20 years. Every wave gets framed as attacker-only for six months first. One team shipped the patch. The other shipped the excuse.

#InfoSec #OpenSource #AI #CyberSecurity

New KEV added 🚨
CVE-2026-34197 (Apache ActiveMQ)
• Active exploitation confirmed
• High-risk entry point
KEV = patch now, not later

Source: https://www.cisa.gov/news-events/alerts/2026/04/16/cisa-adds-one-known-exploited-vulnerability-catalog

💬 How fast is your patch cycle?
Follow @technadu

#InfoSec #CyberSecurity #KEV

⚠️ CRITICAL: CVE-2026-34197 is a remote code execution vuln in Apache ActiveMQ. No patch or confirmed exploitation yet. Monitor vendor advisories & apply security best practices. Details: https://radar.offseq.com/threat/recent-apache-activemq-vulnerability-exploited-in--98176e07 #OffSeq #ApacheActiveMQ #Vuln #Infosec

Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation

https://thehackernews.com/2026/04/apache-activemq-cve-2026-34197-added-to.html

Read on HackerWorkspace: https://hackerworkspace.com/article/apache-activemq-cve-2026-34197-added-to-cisa-kev-amid-active-exploitation

#cybersecurity #vulnerability #exploit

🟠 CVE-2026-40744 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Blind SQL Injection.This issue affects Beaver Builder: from n/a through &lt;= 2....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40744 - High (8.5)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Blind SQL Injection.This issue affects Beaver Builder: from n/a through &lt;= 2....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6306 - High (8.8)

Heap buffer overflow in PDFium in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6306/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-04-13 - 2026-04-20)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1192

Severity:
- Critical: 104
- High: 477
- Medium: 485
- Low: 67
- None: 59

Status:
- : 27
- Analyzed: 155
- Awaiting Analysis: 421
- Deferred: 72
- Received: 270
- Rejected: 6
- Undergoing Analysis: 241

Top CNAs:
- GitHub, Inc.: 234
- Microsoft Corporation: 163
- MITRE: 116
- Wordfence: 100
- VulDB: 77
- Adobe Systems Incorporated: 53
- Chrome: 31
- N/A: 27
- Fortinet, Inc.: 27
- VulnCheck: 23

Top Affected Products:
- UNKNOWN: 856
- Microsoft Windows Server 2025: 121
- Microsoft Windows 11 24h2: 118
- Microsoft Windows 11 26h1: 117
- Microsoft Windows 11 25h2: 114
- Microsoft Windows Server 2022: 114
- Microsoft Windows 11 23h2: 113
- Microsoft Windows Server 23h2: 108
- Microsoft Windows 10 21h2: 105
- Microsoft Windows 10 22h2: 105

Top EPSS Score:
- CVE-2026-6158 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6158)
- CVE-2026-27303 - 1.50 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27303)
- CVE-2026-34615 - 1.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34615)
- CVE-2026-6203 - 1.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6203)
- CVE-2026-6349 - 0.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6349)
- CVE-2026-6141 - 0.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6141)
- CVE-2026-6138 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6138)
- CVE-2026-6139 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6139)
- CVE-2026-6140 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6140)
- CVE-2026-6154 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6154)

📈 CVE Published in last 7 days (2026-04-13 - 2026-04-20)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1192

Severity:
- Critical: 104
- High: 477
- Medium: 485
- Low: 67
- None: 59

Status:
- : 27
- Analyzed: 155
- Awaiting Analysis: 421
- Deferred: 72
- Received: 270
- Rejected: 6
- Undergoing Analysis: 241

Top CNAs:
- GitHub, Inc.: 234
- Microsoft Corporation: 163
- MITRE: 116
- Wordfence: 100
- VulDB: 77
- Adobe Systems Incorporated: 53
- Chrome: 31
- N/A: 27
- Fortinet, Inc.: 27
- VulnCheck: 23

Top Affected Products:
- UNKNOWN: 856
- Microsoft Windows Server 2025: 121
- Microsoft Windows 11 24h2: 118
- Microsoft Windows 11 26h1: 117
- Microsoft Windows 11 25h2: 114
- Microsoft Windows Server 2022: 114
- Microsoft Windows 11 23h2: 113
- Microsoft Windows Server 23h2: 108
- Microsoft Windows 10 21h2: 105
- Microsoft Windows 10 22h2: 105

Top EPSS Score:
- CVE-2026-6158 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6158)
- CVE-2026-27303 - 1.50 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27303)
- CVE-2026-34615 - 1.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34615)
- CVE-2026-6203 - 1.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6203)
- CVE-2026-6349 - 0.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6349)
- CVE-2026-6141 - 0.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6141)
- CVE-2026-6138 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6138)
- CVE-2026-6139 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6139)
- CVE-2026-6140 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6140)
- CVE-2026-6154 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6154)

🔴 CVE-2026-33807 - Critical (9.1)

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-33807 - Critical (9.1)

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path,...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4857 - High (8.4)

IdentityIQ 8.5, all
IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ
8.4 patch levels prior to 8.4p4 allow authenticated users assigned the Debug
Pages Read Only capability or any custom capability with the ViewAccess...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4857/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6300 - High (8.8)

Use after free in CSS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6300/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6299 - High (8.8)

Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6299/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-20186 - Critical (9.9)

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20186/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-20180 - Critical (9.9)

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-20180/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40784 - High (8.1)

Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through &lt;= 1.91.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40784/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40784 - High (8.1)

Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through &lt;= 1.91.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40784/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40764 - High (8.1)

Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through &lt;= 1.10.0.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40764/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40764 - High (8.1)

Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through &lt;= 1.10.0.2.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40764/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40745 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Blind SQL Injection.This issue affects Element Pack Elementor Addons: fr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40745/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-40745 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Blind SQL Injection.This issue affects Element Pack Elementor Addons: fr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40745/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6372 - High (7.5)

Missing Authorization vulnerability in Plisio Accept Cryptocurrencies with Plisio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept Cryptocurrencies with Plisio: from n/a through 2.0.5.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-63029 - High (7.6)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace allows SQL Injection.This issue affects WCFM Marketplace: from n/a through 3.7.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-63029/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📈 CVE Published in last 7 days (2026-04-13 - 2026-04-20)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1192

Severity:
- Critical: 104
- High: 477
- Medium: 485
- Low: 67
- None: 59

Status:
- : 27
- Analyzed: 155
- Awaiting Analysis: 421
- Deferred: 72
- Received: 270
- Rejected: 6
- Undergoing Analysis: 241

Top CNAs:
- GitHub, Inc.: 234
- Microsoft Corporation: 163
- MITRE: 116
- Wordfence: 100
- VulDB: 77
- Adobe Systems Incorporated: 53
- Chrome: 31
- N/A: 27
- Fortinet, Inc.: 27
- VulnCheck: 23

Top Affected Products:
- UNKNOWN: 856
- Microsoft Windows Server 2025: 121
- Microsoft Windows 11 24h2: 118
- Microsoft Windows 11 26h1: 117
- Microsoft Windows 11 25h2: 114
- Microsoft Windows Server 2022: 114
- Microsoft Windows 11 23h2: 113
- Microsoft Windows Server 23h2: 108
- Microsoft Windows 10 21h2: 105
- Microsoft Windows 10 22h2: 105

Top EPSS Score:
- CVE-2026-6158 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6158)
- CVE-2026-27303 - 1.50 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27303)
- CVE-2026-34615 - 1.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34615)
- CVE-2026-6203 - 1.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6203)
- CVE-2026-6349 - 0.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6349)
- CVE-2026-6141 - 0.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6141)
- CVE-2026-6138 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6138)
- CVE-2026-6139 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6139)
- CVE-2026-6140 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6140)
- CVE-2026-6154 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6154)

📈 CVE Published in last 7 days (2026-04-13 - 2026-04-20)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1192

Severity:
- Critical: 104
- High: 477
- Medium: 485
- Low: 67
- None: 59

Status:
- : 27
- Analyzed: 155
- Awaiting Analysis: 421
- Deferred: 72
- Received: 270
- Rejected: 6
- Undergoing Analysis: 241

Top CNAs:
- GitHub, Inc.: 234
- Microsoft Corporation: 163
- MITRE: 116
- Wordfence: 100
- VulDB: 77
- Adobe Systems Incorporated: 53
- Chrome: 31
- N/A: 27
- Fortinet, Inc.: 27
- VulnCheck: 23

Top Affected Products:
- UNKNOWN: 856
- Microsoft Windows Server 2025: 121
- Microsoft Windows 11 24h2: 118
- Microsoft Windows 11 26h1: 117
- Microsoft Windows 11 25h2: 114
- Microsoft Windows Server 2022: 114
- Microsoft Windows 11 23h2: 113
- Microsoft Windows Server 23h2: 108
- Microsoft Windows 10 21h2: 105
- Microsoft Windows 10 22h2: 105

Top EPSS Score:
- CVE-2026-6158 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6158)
- CVE-2026-27303 - 1.50 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27303)
- CVE-2026-34615 - 1.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34615)
- CVE-2026-6203 - 1.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6203)
- CVE-2026-6349 - 0.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6349)
- CVE-2026-6141 - 0.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6141)
- CVE-2026-6138 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6138)
- CVE-2026-6139 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6139)
- CVE-2026-6140 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6140)
- CVE-2026-6154 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6154)

🟠 CVE-2026-5617 - High (8.8)

The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the handle_return_to_admin() function trusting a client-controlled cookie (oclaup_original_admin) to determine...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5617/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5617 - High (8.8)

The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the handle_return_to_admin() function trusting a client-controlled cookie (oclaup_original_admin) to determine...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5617/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📢⚠️ Hackers are exploiting a 5-year-old #ShowDoc vulnerability (CVE-2025-0520) to deploy web shells, enabling RCE and full server takeover worldwide.

Read: https://hackread.com/showdoc-vulnerability-patch-2020-server-takeover/

#CyberSecurity #Vulnerability #CyberAttacks

📢⚠️ Hackers are exploiting a 5-year-old #ShowDoc vulnerability (CVE-2025-0520) to deploy web shells, enabling RCE and full server takeover worldwide.

Read: https://hackread.com/showdoc-vulnerability-patch-2020-server-takeover/

#CyberSecurity #Vulnerability #CyberAttacks

we found a memory exhaustion CVE in a library downloaded 29 million times a month. AWS, DataHub, and Lightning AI are in the blast radius. https://www.periphery.security/blog/cve-2026-33155---40-bytes-to-chaos

📈 CVE Published in last 7 days (2026-04-13 - 2026-04-20)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1192

Severity:
- Critical: 104
- High: 477
- Medium: 485
- Low: 67
- None: 59

Status:
- : 27
- Analyzed: 155
- Awaiting Analysis: 421
- Deferred: 72
- Received: 270
- Rejected: 6
- Undergoing Analysis: 241

Top CNAs:
- GitHub, Inc.: 234
- Microsoft Corporation: 163
- MITRE: 116
- Wordfence: 100
- VulDB: 77
- Adobe Systems Incorporated: 53
- Chrome: 31
- N/A: 27
- Fortinet, Inc.: 27
- VulnCheck: 23

Top Affected Products:
- UNKNOWN: 856
- Microsoft Windows Server 2025: 121
- Microsoft Windows 11 24h2: 118
- Microsoft Windows 11 26h1: 117
- Microsoft Windows 11 25h2: 114
- Microsoft Windows Server 2022: 114
- Microsoft Windows 11 23h2: 113
- Microsoft Windows Server 23h2: 108
- Microsoft Windows 10 21h2: 105
- Microsoft Windows 10 22h2: 105

Top EPSS Score:
- CVE-2026-6158 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6158)
- CVE-2026-27303 - 1.50 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27303)
- CVE-2026-34615 - 1.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34615)
- CVE-2026-6203 - 1.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6203)
- CVE-2026-6349 - 0.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6349)
- CVE-2026-6141 - 0.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6141)
- CVE-2026-6138 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6138)
- CVE-2026-6139 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6139)
- CVE-2026-6140 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6140)
- CVE-2026-6154 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6154)

📈 CVE Published in last 7 days (2026-04-13 - 2026-04-20)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1192

Severity:
- Critical: 104
- High: 477
- Medium: 485
- Low: 67
- None: 59

Status:
- : 27
- Analyzed: 155
- Awaiting Analysis: 421
- Deferred: 72
- Received: 270
- Rejected: 6
- Undergoing Analysis: 241

Top CNAs:
- GitHub, Inc.: 234
- Microsoft Corporation: 163
- MITRE: 116
- Wordfence: 100
- VulDB: 77
- Adobe Systems Incorporated: 53
- Chrome: 31
- N/A: 27
- Fortinet, Inc.: 27
- VulnCheck: 23

Top Affected Products:
- UNKNOWN: 856
- Microsoft Windows Server 2025: 121
- Microsoft Windows 11 24h2: 118
- Microsoft Windows 11 26h1: 117
- Microsoft Windows 11 25h2: 114
- Microsoft Windows Server 2022: 114
- Microsoft Windows 11 23h2: 113
- Microsoft Windows Server 23h2: 108
- Microsoft Windows 10 21h2: 105
- Microsoft Windows 10 22h2: 105

Top EPSS Score:
- CVE-2026-6158 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6158)
- CVE-2026-27303 - 1.50 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27303)
- CVE-2026-34615 - 1.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34615)
- CVE-2026-6203 - 1.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6203)
- CVE-2026-6349 - 0.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6349)
- CVE-2026-6141 - 0.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6141)
- CVE-2026-6138 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6138)
- CVE-2026-6139 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6139)
- CVE-2026-6140 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6140)
- CVE-2026-6154 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6154)

📈 CVE Published in last 7 days (2026-04-13 - 2026-04-20)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1192

Severity:
- Critical: 104
- High: 477
- Medium: 485
- Low: 67
- None: 59

Status:
- : 27
- Analyzed: 155
- Awaiting Analysis: 421
- Deferred: 72
- Received: 270
- Rejected: 6
- Undergoing Analysis: 241

Top CNAs:
- GitHub, Inc.: 234
- Microsoft Corporation: 163
- MITRE: 116
- Wordfence: 100
- VulDB: 77
- Adobe Systems Incorporated: 53
- Chrome: 31
- N/A: 27
- Fortinet, Inc.: 27
- VulnCheck: 23

Top Affected Products:
- UNKNOWN: 856
- Microsoft Windows Server 2025: 121
- Microsoft Windows 11 24h2: 118
- Microsoft Windows 11 26h1: 117
- Microsoft Windows 11 25h2: 114
- Microsoft Windows Server 2022: 114
- Microsoft Windows 11 23h2: 113
- Microsoft Windows Server 23h2: 108
- Microsoft Windows 10 21h2: 105
- Microsoft Windows 10 22h2: 105

Top EPSS Score:
- CVE-2026-6158 - 2.96 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6158)
- CVE-2026-27303 - 1.50 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27303)
- CVE-2026-34615 - 1.44 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-34615)
- CVE-2026-6203 - 1.19 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6203)
- CVE-2026-6349 - 0.95 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6349)
- CVE-2026-6141 - 0.92 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6141)
- CVE-2026-6138 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6138)
- CVE-2026-6139 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6139)
- CVE-2026-6140 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6140)
- CVE-2026-6154 - 0.89 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-6154)

📈 CVE Published in last 7 days (2026-04-13 - 2026-04-20)
See more at https://secdb.nttzen.cloud/dashboard

Total CVEs: 1192

Severity:
- Critical: 104
- High: 477
- Medium: 485
- Low: 67
- None: 59

Status:
- : 27
- Analyzed: 155
- Awaiting Analysis: 421
- Deferred: 72
- Received: 270
- Rejected: 6
- Undergoing Analysis: 241

Top CNAs:
- GitHub, Inc.: 234
- Microsoft Corporation: 163
- MITRE: 116
- Wordfence: 100
- VulDB: 77
- Adobe Systems Incorporated: 53
- Chrome: 31
- N/A: 27
- Fortinet, Inc.: 27
- VulnCheck: 23