🚨 CVE-2026-10165: HIGH severity stack buffer overflow in Edimax BR-6478AC (fw 1.23). Remote, unauthenticated exploit — public PoC out. No patch yet. Restrict access, monitor POSTs to formWanTcpipSetup. https://radar.offseq.com/threat/cve-2026-10165-stack-based-buffer-overflow-in-edim-0d2b8b03 #OffSeq #Vulnerability #RouterSecurity

🚨 CVE-2026-10165: HIGH severity stack buffer overflow in Edimax BR-6478AC (fw 1.23). Remote, unauthenticated exploit — public PoC out. No patch yet. Restrict access, monitor POSTs to formWanTcpipSetup. https://radar.offseq.com/threat/cve-2026-10165-stack-based-buffer-overflow-in-edim-0d2b8b03 #OffSeq #Vulnerability #RouterSecurity

🟠 CVE-2026-10162 - High (8.8)

A flaw has been found in TRENDnet TEW-432BRP 3.10B20. This vulnerability affects the function formSetPassword of the file /goform/formSetPassword. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10162/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-10162: HIGH-severity stack-based buffer overflow in TRENDnet TEW-432BRP (3.10B20). Remotely exploitable, low privileges needed. No patch — device is EOL. Replace or restrict remote access! Exploit available. More: https://radar.offseq.com/threat/cve-2026-10162-stack-based-buffer-overflow-in-tren-f3a99a60 #OffSeq #Vulnerability #RouterSecurity

🟠 CVE-2026-10162 - High (8.8)

A flaw has been found in TRENDnet TEW-432BRP 3.10B20. This vulnerability affects the function formSetPassword of the file /goform/formSetPassword. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10162/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-10162: HIGH-severity stack-based buffer overflow in TRENDnet TEW-432BRP (3.10B20). Remotely exploitable, low privileges needed. No patch — device is EOL. Replace or restrict remote access! Exploit available. More: https://radar.offseq.com/threat/cve-2026-10162-stack-based-buffer-overflow-in-tren-f3a99a60 #OffSeq #Vulnerability #RouterSecurity

🟠 CVE-2026-10161 - High (8.8)

A vulnerability was detected in TRENDnet TEW-432BRP 3.10B20. This affects the function formResetStatistic of the file /goform/formResetStatistic. Performing a manipulation of the argument status_statistic results in stack-based buffer overflow. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10161/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10161 - High (8.8)

A vulnerability was detected in TRENDnet TEW-432BRP 3.10B20. This affects the function formResetStatistic of the file /goform/formResetStatistic. Performing a manipulation of the argument status_statistic results in stack-based buffer overflow. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10161/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10160 - High (8.8)

A security vulnerability has been detected in TRENDnet TEW-432BRP 3.10B20. Affected by this issue is the function formSetEnableWizard of the file /goform/formSetEnableWizard. Such manipulation of the argument start_wizard leads to stack-based buff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10160 - High (8.8)

A security vulnerability has been detected in TRENDnet TEW-432BRP 3.10B20. Affected by this issue is the function formSetEnableWizard of the file /goform/formSetEnableWizard. Such manipulation of the argument start_wizard leads to stack-based buff...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10159 - High (8.8)

A weakness has been identified in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSysLog of the file /goform/formSysLog. This manipulation of the argument current_page causes stack-based buffer overflow. The attack ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10159/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10159 - High (8.8)

A weakness has been identified in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSysLog of the file /goform/formSysLog. This manipulation of the argument current_page causes stack-based buffer overflow. The attack ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10159/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10158 - High (8.8)

A security flaw has been discovered in TRENDnet TEW-432BRP 3.10B20. Affected is the function formPortFw of the file /goform/formPortFw. The manipulation of the argument server_name results in stack-based buffer overflow. It is possible to launch t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10158/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10158 - High (8.8)

A security flaw has been discovered in TRENDnet TEW-432BRP 3.10B20. Affected is the function formPortFw of the file /goform/formPortFw. The manipulation of the argument server_name results in stack-based buffer overflow. It is possible to launch t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10158/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10124 - High (8.8)

A vulnerability was determined in Shibby Tomato up to 1.28. Affected is the function rip_zebra_read_ipv4 of the file /usr/sbin/ripd of the component Zserv Handler. Executing a manipulation can lead to stack-based buffer overflow. It is possible to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10124 - High (8.8)

A vulnerability was determined in Shibby Tomato up to 1.28. Affected is the function rip_zebra_read_ipv4 of the file /usr/sbin/ripd of the component Zserv Handler. Executing a manipulation can lead to stack-based buffer overflow. It is possible to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10121 - High (8.8)

A flaw has been found in TRENDnet TEW-432BRP 3.10B20. The impacted element is the function formSetUrlFilter of the file /goform/formSetUrlFilter. This manipulation of the argument keyword_list/keyword causes stack-based buffer overflow. The attack...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10121/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10121 - High (8.8)

A flaw has been found in TRENDnet TEW-432BRP 3.10B20. The impacted element is the function formSetUrlFilter of the file /goform/formSetUrlFilter. This manipulation of the argument keyword_list/keyword causes stack-based buffer overflow. The attack...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10121/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 CVE-2026-10126: HIGH severity buffer overflow in Edimax BR-6478AC v1.23. Remote code execution or DoS possible; public exploit released. Restrict remote mgmt access & watch for vendor patches. https://radar.offseq.com/threat/cve-2026-10126-buffer-overflow-in-edimax-br-6478ac-b8a1eb66 #OffSeq #Vuln #IoTSecurity #Infosec

🟠 CVE-2026-10126 - High (8.8)

A security flaw has been discovered in Edimax BR-6478AC 1.23. Affected by this issue is the function formQoS of the file /goform/formQoS of the component POST Request Handler. The manipulation of the argument selSSID results in buffer overflow. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10126/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 CVE-2026-10126: HIGH severity buffer overflow in Edimax BR-6478AC v1.23. Remote code execution or DoS possible; public exploit released. Restrict remote mgmt access & watch for vendor patches. https://radar.offseq.com/threat/cve-2026-10126-buffer-overflow-in-edimax-br-6478ac-b8a1eb66 #OffSeq #Vuln #IoTSecurity #Infosec

🟠 CVE-2026-10126 - High (8.8)

A security flaw has been discovered in Edimax BR-6478AC 1.23. Affected by this issue is the function formQoS of the file /goform/formQoS of the component POST Request Handler. The manipulation of the argument selSSID results in buffer overflow. Th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10126/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10125 - High (8.8)

A vulnerability was identified in Edimax BR-6478AC 1.23. Affected by this vulnerability is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request Handler. The manipulation of the argument pppUserName leads to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10125/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10125 - High (8.8)

A vulnerability was identified in Edimax BR-6478AC 1.23. Affected by this vulnerability is the function formPPPoESetup of the file /goform/formPPPoESetup of the component POST Request Handler. The manipulation of the argument pppUserName leads to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10125/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10123 - High (8.8)

A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetDomainFilter of the file /goform/formSetDomainFilter. Performing a manipulation of the argument blocked_domain/permitted_domain/blocked_domain_list/permitte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10123 - High (8.8)

A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. This impacts the function formSetDomainFilter of the file /goform/formSetDomainFilter. Performing a manipulation of the argument blocked_domain/permitted_domain/blocked_domain_list/permitte...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10122 - High (8.8)

A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. This affects the function formSetProtocolFilter of the file /goform/formSetProtocolFilter. Such manipulation of the argument protocol_name leads to stack-based buffer overflow. The att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10122/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10122 - High (8.8)

A vulnerability has been found in TRENDnet TEW-432BRP 3.10B20. This affects the function formSetProtocolFilter of the file /goform/formSetProtocolFilter. Such manipulation of the argument protocol_name leads to stack-based buffer overflow. The att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10122/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10120 - High (8.8)

A vulnerability was detected in TRENDnet TEW-432BRP 3.10B20. The affected element is the function formSetFirewallRule of the file /goform/formSetFirewallRule. The manipulation of the argument firewall_name results in stack-based buffer overflow. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10120/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10120 - High (8.8)

A vulnerability was detected in TRENDnet TEW-432BRP 3.10B20. The affected element is the function formSetFirewallRule of the file /goform/formSetFirewallRule. The manipulation of the argument firewall_name results in stack-based buffer overflow. T...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10120/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10119 - High (8.8)

A security vulnerability has been detected in TRENDnet TEW-432BRP 3.10B20. Impacted is the function formSetMACFilter of the file /goform/formSetMACFilter. The manipulation of the argument filter_name leads to stack-based buffer overflow. Remote ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10119 - High (8.8)

A security vulnerability has been detected in TRENDnet TEW-432BRP 3.10B20. Impacted is the function formSetMACFilter of the file /goform/formSetMACFilter. The manipulation of the argument filter_name leads to stack-based buffer overflow. Remote ex...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10119/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-7459 - High (7.5)

The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated (Subscriber+) account takeover in all versions up to, and including, 5.26.0 via the event reaction endpoints (react_to_event() / unr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7459/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 HIGH severity: CVE-2026-7459 in Simple History WP plugin allows Subscriber users to seize admin accounts if experimental features are enabled. Disable this option and monitor for vendor fixes. Affects ≤5.26.0. Read: https://radar.offseq.com/threat/cve-2026-7459-cwe-640-weak-password-recovery-mecha-7aa34cab #OffSeq #WordPress #CVE20267459

🟠 CVE-2026-7459 - High (7.5)

The Simple History – Track, Log, and Audit WordPress Changes plugin for WordPress is vulnerable to authenticated (Subscriber+) account takeover in all versions up to, and including, 5.26.0 via the event reaction endpoints (react_to_event() / unr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7459/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔎 HIGH severity: CVE-2026-7459 in Simple History WP plugin allows Subscriber users to seize admin accounts if experimental features are enabled. Disable this option and monitor for vendor fixes. Affects ≤5.26.0. Read: https://radar.offseq.com/threat/cve-2026-7459-cwe-640-weak-password-recovery-mecha-7aa34cab #OffSeq #WordPress #CVE20267459

🟠 CVE-2026-7465 - High (8.8)

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7465/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-7465 (HIGH): Spectra Gutenberg Blocks plugin for WordPress lets Contributor+ users execute arbitrary server code via crafted block payloads. No patch yet — restrict access & monitor advisories. https://radar.offseq.com/threat/cve-2026-7465-cwe-269-improper-privilege-managemen-61ef37c5 #OffSeq #WordPress #Infosec #Vuln

🟠 CVE-2026-7465 - High (8.8)

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7465/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚨 CVE-2026-7465 (HIGH): Spectra Gutenberg Blocks plugin for WordPress lets Contributor+ users execute arbitrary server code via crafted block payloads. No patch yet — restrict access & monitor advisories. https://radar.offseq.com/threat/cve-2026-7465-cwe-269-improper-privilege-managemen-61ef37c5 #OffSeq #WordPress #Infosec #Vuln

🟠 CVE-2026-9757 - High (7.5)

The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the 'swlatlng' and 'nelatlng' parameters in all versions up to, and including, 4.5.5 The parameters are read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing WordPress's...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9757/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9757 - High (7.5)

The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the 'swlatlng' and 'nelatlng' parameters in all versions up to, and including, 4.5.5 The parameters are read from $_SERVER['QUERY_STRING'] via parse_str() (bypassing WordPress's...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9757/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ XSS vuln (MEDIUM, CVSS 4.8) in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 — CVE-2026-10112. 'Name' param on Dashboard Page unsanitized, allowing script injection. No patch yet — use input validation/output encoding. https://radar.offseq.com/threat/cve-2026-10112-cross-site-scripting-in-sambitraj-s-ee88cf56 #OffSeq #XSS #AppSec #Vulnerability

⚠️ XSS vuln (MEDIUM, CVSS 4.8) in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0 — CVE-2026-10112. 'Name' param on Dashboard Page unsanitized, allowing script injection. No patch yet — use input validation/output encoding. https://radar.offseq.com/threat/cve-2026-10112-cross-site-scripting-in-sambitraj-s-ee88cf56 #OffSeq #XSS #AppSec #Vulnerability

⚠️ CVE-2026-10110: MEDIUM severity SQL injection in code-projects Student Details Management System 1.0 (/index.php, roll parameter). Public exploit available — remote attack possible. Monitor and restrict access. https://radar.offseq.com/threat/cve-2026-10110-sql-injection-in-code-projects-stud-7112fd7e #OffSeq #SQLInjection #Vuln

⚠️ CVE-2026-10110: MEDIUM severity SQL injection in code-projects Student Details Management System 1.0 (/index.php, roll parameter). Public exploit available — remote attack possible. Monitor and restrict access. https://radar.offseq.com/threat/cve-2026-10110-sql-injection-in-code-projects-stud-7112fd7e #OffSeq #SQLInjection #Vuln

🟠 CVE-2026-10044 - High (7.5)

Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts/{filename} endpoint on Windows deployments that allows unauthenticated remote attackers to read arbitrary files by supplying absolut...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35671 - High (8.8)

phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with lo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35671/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🚩 CVE-2026-9831: Medium severity race condition in Extreme Networks Extreme Platform ONE IAM Gateway. High-concurrency API key use may cause data leak across tenants. No patch yet — monitor advisories. Details: https://radar.offseq.com/threat/cve-2026-9831-cwe-362-concurrent-execution-using-s-84a029a5 #OffSeq #ExtremeNetworks #CloudSec #CVE2026_9831

🚩 CVE-2026-9831: Medium severity race condition in Extreme Networks Extreme Platform ONE IAM Gateway. High-concurrency API key use may cause data leak across tenants. No patch yet — monitor advisories. Details: https://radar.offseq.com/threat/cve-2026-9831-cwe-362-concurrent-execution-using-s-84a029a5 #OffSeq #ExtremeNetworks #CloudSec #CVE2026_9831

🟠 CVE-2026-44697 - High (8.6)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by Multi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44697 - High (8.6)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, a remote, unauthenticated denial-of-service vulnerability in Batch.Decompress (data/batch/batch.go) allows any peer that participates in a topic served by Multi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44697/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42941 - High (8.3)

The Danelec MacGregor Voyage Data Recorder

device includes a default username and password, with no enforced password change.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42941 - High (8.3)

The Danelec MacGregor Voyage Data Recorder

device includes a default username and password, with no enforced password change.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42941/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49366 - High (7.8)

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49366/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49372 - High (7.5)

In JetBrains TeamCity before 2026.1,
2025.11.5 unauthenticated SSRF via build status was possible

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49372/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-48557 - High (8.8)

Spatie Laravel Media Library before version 11.23.0 contains a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypas...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48557/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49368 - High (8.7)

In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49368/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49368 - High (8.7)

In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49368/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49374 - High (7.6)

In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49374/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49367 - High (8)

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49367/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42929 - High (8.3)

Danelec MacGregor Voyage Data Recorder
includes default accounts with hard-coded credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42929/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42929 - High (8.3)

Danelec MacGregor Voyage Data Recorder
includes default accounts with hard-coded credentials.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42929/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

⚠️ HIGH severity: CVE-2026-5343 in Drupal SAML SSO - Service Provider (pre-3.1.4) allows privilege escalation via improper exception checks. No patch or exploits yet. Monitor advisories for updates. https://radar.offseq.com/threat/cve-2026-5343-cwe-754-improper-check-for-unusual-o-7182465d #OffSeq #Drupal #Vuln #SAML

🟠 CVE-2026-46821 - High (7.7)

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46821/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10105 - High (8.3)

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the delete_by_metadata() method. Attackers can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10105 - High (8.3)

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the delete_by_metadata() method. Attackers can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45628 - Critical (9.6)

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied br...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45628/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45628 - Critical (9.6)

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via child_process.exec() (which runs through /bin/sh -c). User-supplied br...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45628/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45625 - Critical (9.9)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing GitOps sou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45625/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45625 - Critical (9.9)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing GitOps sou...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45625/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45661 - Critical (9.9)

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45661/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45661 - Critical (9.9)

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application d...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45661/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45631 - Critical (10)

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789") lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45631/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45631 - Critical (10)

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback ("better-auth-secret-123456789") lets an unauthenticated attacker forge email verification JWTs, trigger auto-sign...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45631/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44285 - High (7.7)

FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, a Server-Side Request Forgery (SSRF) vulnerability allows an authenticated attacker to bypass the global isInternalAddress network protection and make arbitrary HTTP GET requests to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44285 - High (7.7)

FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, a Server-Side Request Forgery (SSRF) vulnerability allows an authenticated attacker to bypass the global isInternalAddress network protection and make arbitrary HTTP GET requests to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44422 - High (7.5)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44422 - High (7.5)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47123 - High (7.5)

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.220, the email processing pipeline in FreeScout's FetchEmails command has two code paths for identifying agent (user) replies based on In-Reply-To / Re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9998 - High (8.3)

Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9998/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9998 - High (8.3)

Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9998/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🛡️ HIGH severity: Chrome <148.0.7778.216 has an integer overflow (CVE-2026-9998) in Skia. Potential sandbox escape if renderer is compromised. Patch ASAP! More info: https://radar.offseq.com/threat/cve-2026-9998-integer-overflow-in-google-chrome-20eb53d9 #OffSeq #Chrome #Vuln #Infosec

🟠 CVE-2026-44648 - High (7.5)

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44648 - High (7.5)

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authen...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47740 - High (8.1)

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47740/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47740 - High (8.1)

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47740/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-47744 - Critical (9.9)

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47744/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

A new authentication bypass vulnerability (CVE-2026-0257) in PAN-OS is being actively exploited in the wild. The flaw lets attackers establish VPN connections without valid credentials. This is not a theoretical risk or a proof of concept — real attacks are happening right now, and the window to respond is already closing.

More at https://securitycyber.uk
Mastodon: https://infosec.exchange/@securitycyber
LinkedIn: https://www.linkedin.com/in/charlie-collins-sec
Bluesky: https://bsky.app/profile/securitycyberuk.bsky.social
Substack: https://securitycyber.substack.com
Discord: https://discord.gg/securitycyber

Recommended: https://www.hackthebox.com for practice, https://portswigger.net/web-security for free labs

PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Is Being Actively Exploited

Palo Alto Networks has confirmed that CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect, is under active exploitation in the wild. The flaw carries a CVSS score of 7.

More at https://securitycyber.uk
Mastodon: https://infosec.exchange/@securitycyber
LinkedIn: https://www.linkedin.com/in/charlie-collins-sec
Bluesky: https://bsky.app/profile/securitycyberuk.bsky.social
Substack: https://securitycyber.substack.com
Discord: https://discord.gg/securitycyber

Recommended: https://www.hackthebox.com for practice, https://portswigger.net/web-security for free labs

A new authentication bypass vulnerability (CVE-2026-0257, CVE-2026-0257) is being actively exploited in the wild. The target: PAN-OS, Prisma Access, VPN. This is not a theoretical risk — attackers are already leveraging it.

This is not the first time a critical authentication bypass has been found in PAN-OS, Prisma Access, VPN.

More at https://securitycyber.uk
Mastodon: https://infosec.exchange/@securitycyber
LinkedIn: https://www.linkedin.com/in/charlie-collins-sec
Bluesky: https://bsky.app/profile/securitycyberuk.bsky.social
Substack: https://securitycyber.substack.com
Discord: https://discord.gg/securitycyber

Recommended: https://www.hackthebox.com for practice, https://portswigger.net/web-security for free labs

Global VPN Security Shockwave: Active Exploitation of Palo Alto Networks CVE-2026-0257 Raises Critical Enterprise Alarm + Video

Introduction: Silent Breach Vector Emerging in Global VPN Infrastructure A newly disclosed and actively exploited vulnerability affecting enterprise VPN infrastructure has triggered urgent concern across cybersecurity circles. Security researchers and incident responders are now tracking real-world attacks targeting a flaw in Palo Alto…

https://undercodenews.com/global-vpn-security-shockwave-active-exploitation-of-palo-alto-networks-cve-2026-0257-raises-critical-enterprise-alarm-video/?utm_source=mastodon&utm_medium=jetpack_social

#infosec #vulnerability #vpn

Rapid7 observó la explotación de la vulnerabilidad de omisión de autenticación de PAN-OS GlobalProtect (CVE-2026-0257).

https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/

📰 Actively Exploited PAN-OS Flaw (CVE-2026-0257) Allows VPN Hijack, CISA Adds to KEV

🚨 ACTIVE EXPLOITATION: A PAN-OS flaw (CVE-2026-0257) in GlobalProtect is being exploited to bypass auth & hijack VPNs. CISA has added it to the KEV catalog. Patch now! #CVE #Vulnerability #PaloAltoNetworks

🌐 cyber[.]netsecops[.]io

🔗 https://cyber.netsecops.io/articles/palo-alto-networks-pan-os-vulnerability-under-active-exploitation/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks

Palo Alto Networks is warning that hackers are now exploiting a PAN-OS GlobalProtect authentication bypass flaw, tracked as CVE-2026-0257, in...

🔗️ [Bleepingcomputer] https://link.is.it/TMUu85

Hackers Exploit Palo Alto GlobalProtect VPN Auth Bypass Flaw in Attacks

Hackers are actively exploiting a critical flaw in Palo Alto's GlobalProtect VPN, known as CVE-2026-0257, to gain unauthorized access to corporate networks. This alarming vulnerability allows attackers to bypass security restrictions and establish fake VPN connections.

https://osintsights.com/hackers-exploit-palo-alto-globalprotect-vpn-auth-bypass-flaw-in-attacks?utm_source=mastodon&utm_medium=social

#PaloAlto #Globalprotect #VpnAuthBypass #Cve20260257 #Panos

🚨 THREAT INTELLIGENCE

PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation

Vulnerability | CRITICAL
CVEs: CVE-2026-0257

Palo Alto Networks has warned that a recently disclosed medium-severity security flaw impacting PAN-OS and Prisma Access has come under active...

Full analysis:
https://www.yazoul.net/news/article/pan-os-globalprotect-authentication-bypass-cve-2026-0257-under-active-exploitati

#ThreatIntel #Malware #SecurityOps

Critical Security Flashpoint: Palo Alto Networks Zero-Day CVE-2026-0257 Actively Exploited as Ransomware Waves Hit US Wholesale Sector + Video

Urgent Cybersecurity Introduction: A Dual-Front Digital Crisis Emerging The cybersecurity landscape is once again under intense pressure as two separate but equally disruptive incidents collide in the threat ecosystem. On one side, Palo Alto Networks has confirmed active exploitation of a critical vulnerability tracked as…

https://undercodenews.com/critical-security-flashpoint-palo-alto-networks-zero-day-cve-2026-0257-actively-exploited-as-ransomware-waves-hit-us-wholesale-sector-video/?utm_source=mastodon&utm_medium=jetpack_social

🚨 [CISA-2026:0529] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0529)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-0257 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-0257)
- Name: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Palo Alto Networks
- Product: PAN-OS
- Notes: https://security.paloaltonetworks.com/CVE-2026-0257 ; https://nvd.nist.gov/vuln/detail/CVE-2026-0257

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260529 #cisa20260529 #cve_2026_0257 #cve20260257

Palo Alto Networks Warns of Active Exploitation of GlobalProtect Flaw

Palo Alto Networks has issued a warning about a critical GlobalProtect flaw, CVE-2026-0257, that is being actively exploited, allowing attackers to bypass security restrictions and establish unauthorized VPN connections. This vulnerability affects specific PAN-OS and Prisma Access deployments with certain…

https://osintsights.com/palo-alto-networks-warns-of-active-exploitation-of-globalprotect-flaw?utm_source=mastodon&utm_medium=social

#PaloAltoNetworks #Globalprotect #Cve20260257 #VpnExploitation #AuthenticationBypass

🏛️ Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

📝 CISA added CVE-2026-0257 to its KEV Catalog due to active exploitation, posing risks to...

https://www.cisa.gov/news-events/alerts/2026/05/29/cisa-adds-one-known-exploited-vulnerability-catalog

📰 Alerts

#GovSec #CVE #ZeroDay

A new authentication bypass vulnerability (CVE-2026-0257) in PAN-OS is being actively exploited in the wild. The flaw lets attackers establish VPN connections without valid credentials. This is not a theoretical risk or a proof of concept — real attacks are happening right now, and the window to respond is already closing.

More at https://securitycyber.uk
Mastodon: https://infosec.exchange/@securitycyber
LinkedIn: https://www.linkedin.com/in/charlie-collins-sec
Bluesky: https://bsky.app/profile/securitycyberuk.bsky.social
Substack: https://securitycyber.substack.com
Discord: https://discord.gg/securitycyber

Recommended: https://www.hackthebox.com for practice, https://portswigger.net/web-security for free labs

PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Is Being Actively Exploited

Palo Alto Networks has confirmed that CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect, is under active exploitation in the wild. The flaw carries a CVSS score of 7.

More at https://securitycyber.uk
Mastodon: https://infosec.exchange/@securitycyber
LinkedIn: https://www.linkedin.com/in/charlie-collins-sec
Bluesky: https://bsky.app/profile/securitycyberuk.bsky.social
Substack: https://securitycyber.substack.com
Discord: https://discord.gg/securitycyber

Recommended: https://www.hackthebox.com for practice, https://portswigger.net/web-security for free labs

A new authentication bypass vulnerability (CVE-2026-0257, CVE-2026-0257) is being actively exploited in the wild. The target: PAN-OS, Prisma Access, VPN. This is not a theoretical risk — attackers are already leveraging it.

This is not the first time a critical authentication bypass has been found in PAN-OS, Prisma Access, VPN.

More at https://securitycyber.uk
Mastodon: https://infosec.exchange/@securitycyber
LinkedIn: https://www.linkedin.com/in/charlie-collins-sec
Bluesky: https://bsky.app/profile/securitycyberuk.bsky.social
Substack: https://securitycyber.substack.com
Discord: https://discord.gg/securitycyber

Recommended: https://www.hackthebox.com for practice, https://portswigger.net/web-security for free labs

Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks

Palo Alto Networks is warning that hackers are now exploiting a PAN-OS GlobalProtect authentication bypass flaw, tracked as CVE-2026-0257, in...

🔗️ [Bleepingcomputer] https://link.is.it/TMUu85

🚨 [CISA-2026:0529] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0529)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-0257 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-0257)
- Name: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Palo Alto Networks
- Product: PAN-OS
- Notes: https://security.paloaltonetworks.com/CVE-2026-0257 ; https://nvd.nist.gov/vuln/detail/CVE-2026-0257

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260529 #cisa20260529 #cve_2026_0257 #cve20260257

🏛️ Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

📝 CISA added CVE-2026-0257 to its KEV Catalog due to active exploitation, posing risks to...

https://www.cisa.gov/news-events/alerts/2026/05/29/cisa-adds-one-known-exploited-vulnerability-catalog

📰 Alerts

#GovSec #CVE #ZeroDay

CVE ID: CVE-2026-0257
Vendor: Palo Alto Networks
Product: PAN-OS
Date Added: 2026-05-29
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-0257

🔴 CVE-2026-9051 - Critical (9.1)

There is an authentication bypass vulnerability in the NI SystemLink Enterprise Dashboard application that may allow an unauthenticated remote attacker to bypass authentication controls leading to privilege escalation or information disclosure.  ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9051/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-46835 - High (7.5)

Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46835/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-46834 - High (7.5)

Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46834/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10108 - High (7.5)

xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path} endpoint that allows unauthenticated attackers to read arbitrary files outside the intended music directory by exploiting an incomplete pa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10108/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10108 - High (7.5)

xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path} endpoint that allows unauthenticated attackers to read arbitrary files outside the intended music directory by exploiting an incomplete pa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10108/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10107 - High (7.7)

MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authenticated attackers to request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the assembled allowlis...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10107/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10107 - High (7.7)

MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authenticated attackers to request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the assembled allowlis...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10107/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-5768 - High (8.8)

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without enforcing pairing authentication or authorization. This allows attackers within BLE range to perform unauthorized control of device functi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5768/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-7786 - Critical (9.8)

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter
device firmware contains plaintext administrative credentials embedded in the firmware image. These credentials can be extracted through firmware analysis and u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-7786/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32905 - High (8.3)

OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issue device-pairing bootstrap codes without proper scope validation. Attackers with chat co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32905/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35630 - High (8)

OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35630/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10065 - High (8.8)

A weakness has been identified in Shibby Tomato 1.28. This vulnerability affects the function get_ups_field of the file tomatodata.cgi. Executing a manipulation of the argument Date can lead to stack-based buffer overflow. It is possible to launch...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10065/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-46840 - Critical (10)

Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Ora...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46840/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-46839 - Critical (9.9)

Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle REST Data Ser...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46839/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9999 - High (8.8)

Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9999 - High (8.8)

Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9999/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-9999: HIGH severity flaw in Chrome (Mac, <148.0.7778.216) allows remote code execution in the sandbox via crafted HTML. No exploits in the wild. Patch to 148.0.7778.216+ now! https://radar.offseq.com/threat/cve-2026-9999-inappropriate-implementation-in-goog-790503e9 #OffSeq #Chrome #Mac #Vuln #Security

🟠 CVE-2026-6824 - High (8.4)

A stored cross-site scripting (XSS) vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6824/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-5386 - Critical (9.1)

The affected KMW CCTV Security Cameras are vulnerable to a critical unauthenticated password reset. This flaw allows an attacker to remotely reset the administrator password to a known value without authentication, granting full access to the ca...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-5386/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45615 - High (8.2)

mouse07410/asn1c is an ASN.1 compiler. In 1.4 and earlier, a memory safety vulnerability was identified in the OER decoding skeleton files generated by asn1c (specifically INTEGER_oer.c). When parsing a maliciously crafted, zero-length OER payload...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45615/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-44962 - Critical (9.9)

Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to exe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44962/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-35674 - High (8.8)

OpenClaw before 2026.5.18 contains a scope bypass vulnerability in the Gateway chat.send route that allows scoped clients to execute privileged commands. Attackers with operator.write scope can deliver commands through inherited external routes to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-35674/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10069 - High (7.5)

A vulnerability has been found in Shibby Tomato 1.28. The impacted element is an unknown function of the file usr/sbin/miniupnpd. Such manipulation leads to resource consumption. The attack may be launched remotely. This project is superseded by F...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10069/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10069 - High (7.5)

A vulnerability has been found in Shibby Tomato 1.28. The impacted element is an unknown function of the file usr/sbin/miniupnpd. Such manipulation leads to resource consumption. The attack may be launched remotely. This project is superseded by F...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10069/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10067 - High (8.8)

A vulnerability was detected in Shibby Tomato 1.28. Impacted is the function sub_90F0 of the file multimon.cgi. The manipulation results in stack-based buffer overflow. The attack can be launched remotely. This project is superseded by FreshTomato...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10067/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10066 - High (8.8)

A security vulnerability has been detected in Shibby Tomato up to 1.28. This issue affects the function sub_9068 of the file tomatoups.cgi of the component UPS Service. The manipulation leads to stack-based buffer overflow. The attack can be initi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10066/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44698 - High (8.3)

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app Web...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44698/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45323 - Critical (9.6)

MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary java...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45323/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-32847 - High (7.5)

DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read arbitrary files by supplying percent-encoded path segments to the GET /{full...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32847/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-46837 - High (8.8)

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Security). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46837/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10062 - High (8.8)

A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSetRoute of the file /goform/formSetRoute. This manipulation of the argument ip/mask/gateway causes stack-based buffer overflow. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10062/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10062 - High (8.8)

A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSetRoute of the file /goform/formSetRoute. This manipulation of the argument ip/mask/gateway causes stack-based buffer overflow. The ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10062/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9809 - High (7.6)

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendere...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9809/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-9809 - High (7.6)

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendere...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9809/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-4944 - High (8.8)

vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm/model_executor/models/nemotron_vl.py` and `vllm/model_executor/models/kimi_k25.py`). This ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4944/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45348 - High (8.7)

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45348/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-10042 - Critical (9.8)

manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module, where the /execute/{method_name} and /simple_execute/{method_name} e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-10042 - Critical (9.8)

manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share.py module, where the /execute/{method_name} and /simple_execute/{method_name} e...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10063 - High (8.8)

A vulnerability was identified in TRENDnet TEW-432BRP 3.10B20. Affected by this issue is the function formWPS of the file /goform/formWPS. Such manipulation of the argument peerPin leads to stack-based buffer overflow. The attack may be performed ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10063/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10063 - High (8.8)

A vulnerability was identified in TRENDnet TEW-432BRP 3.10B20. Affected by this issue is the function formWPS of the file /goform/formWPS. Such manipulation of the argument peerPin leads to stack-based buffer overflow. The attack may be performed ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10063/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4290 - Critical (9.1)

The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-4290 - Critical (9.1)

The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4290/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-10071 - Critical (9.8)

DreamMaker developed by Interinfo has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-10071 - Critical (9.8)

DreamMaker developed by Interinfo has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10071/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-44887 - Critical (9.8)

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based configuration editor allows arbitrary Python code to be injected into pialert.conf. Since the background scan daemon loads this file ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44887/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10073 - High (7.5)

DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing unauthenticated local attackers to exploit Relative Path Traversal to download arbitrary system files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10073/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10073 - High (7.5)

DreamMaker developed by Interinfo has an Arbitrary File Read vulnerability, allowing unauthenticated local attackers to exploit Relative Path Traversal to download arbitrary system files.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10073/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-45039 - Critical (9.8)

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using a shared secret. The function that produces this secret, get_shared_secret(...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45578 - High (8.8)

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45578/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-45707 - High (8.1)

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.2, when ENABLE_MULTI_TENANT=true, the HTTP transport documents that the target n8n instance is selected per-request fr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45707/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-44882 - High (8.1)

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33., Portainer proxies requests to Kubernetes ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-44882/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-48527 - High (8.7)

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permiss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48527/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-48527 - High (8.7)

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions up to and including 26.0.0 are affected by a stored cross-site scripting (XSS) vulnerability in the `/system/api/saveNode` endpoint. An authenticated user with a permiss...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-48527/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-11993 - High (8.8)

The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via the 'settings' parameter in the 'import_settings' function. This is due to deserialization...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11993/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2025-11993 - High (8.8)

The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via the 'settings' parameter in the 'import_settings' function. This is due to deserialization...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-11993/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-8732 - Critical (9.8)

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8732/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical WP Maps Pro Vulnerability Allows Unauthenticated Administrator Takeover

WP Maps Pro versions 6.1.0 and earlier contain a critical vulnerability (CVE-2026-8732) that allows unauthenticated attackers to create administrator accounts and take full control of WordPress sites.

**If you use the WP Maps Pro WordPress plugin, this is urgent. Update to version 6.1.1 immediately to patch this critical flaw that lets attackers create admin accounts on your site. Also, audit your WordPress user list for any suspicious admin accounts (especially ones tied to support@flippercode.com) and remove them.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-wp-maps-pro-vulnerability-allows-unauthenticated-administrator-takeover-e-g-t-g-s/gD2P6Ple2L

🔴 CVE-2026-8732 - Critical (9.8)

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all versions up to, and including, 6.1.0. This is due to the wpgmp_temp_access_ajax AJAX action being registered with wp_ajax_nopriv_ ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8732/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical WP Maps Pro Vulnerability Allows Unauthenticated Administrator Takeover

WP Maps Pro versions 6.1.0 and earlier contain a critical vulnerability (CVE-2026-8732) that allows unauthenticated attackers to create administrator accounts and take full control of WordPress sites.

**If you use the WP Maps Pro WordPress plugin, this is urgent. Update to version 6.1.1 immediately to patch this critical flaw that lets attackers create admin accounts on your site. Also, audit your WordPress user list for any suspicious admin accounts (especially ones tied to support@flippercode.com) and remove them.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-wp-maps-pro-vulnerability-allows-unauthenticated-administrator-takeover-e-g-t-g-s/gD2P6Ple2L

🚨 CVE-2026-8732: WP Maps Pro ≤6.1.0 has a CRITICAL flaw (CVSS 9.8). Unauthenticated attackers can create admin accounts via an AJAX action protected only by a public nonce. Full site takeover risk. Disable or remove plugin until patched. https://radar.offseq.com/threat/cve-2026-8732-cwe-306-missing-authentication-for-c-c3324188 #OffSeq #WordPress #Vuln

🔴 CVE-2026-3655 - Critical (9.8)

The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3655/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3655 - Critical (9.8)

The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3655/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-3655 (CRITICAL, CVSS 9.8): glboy OTP Login plugin (v1.8.50 – 1.8.60) suffers from improper authentication via Firebase OTP. Attackers can log in as any user/admin. Patch now! https://radar.offseq.com/threat/cve-2026-3655-cwe-287-improper-authentication-in-g-98c0dba0 #OffSeq #WordPress #Infosec #Vulnerability

🟠 CVE-2026-6075 - High (8.1)

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6075/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-6075 - High (8.1)

The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verification on the bulk action handlers in the settings tab handlers. This makes it p...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-6075/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42965 - High (7.7)

A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42965/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-42965 - High (7.7)

A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed by an FQDN (Fully Qualified Domain Name) EndpointSlice that resolves to a cloud metadata endpoint. This al...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-42965/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10056 - High (7.5)

CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default Standard security mode, on Linux and Windows allows an unauthenticated remote attacker to steal the session token of an authent...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-10056 - High (7.5)

CORS misconfiguration in the REST API of Network Optix Nx Witness VMS before version 6.1.2, when running in the default Standard security mode, on Linux and Windows allows an unauthenticated remote attacker to steal the session token of an authent...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-10056/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔒 CVE-2026-8070 (HIGH): ASUS Armoury Crate lets local attackers bypass driver validation for physical memory access. Patch pending — restrict local access and monitor for abuse. Details: https://radar.offseq.com/threat/cve-2026-8070-cwe-732-incorrect-permission-assignm-933cba46 #OffSeq #Vulnerability #ASUS #InfoSec

ASUS System Control Interface (≤3.1.59.0) hit by HIGH-severity vuln (CVE-2026-7480): local attackers can escalate to SYSTEM via crafted RPC calls. No patch yet — restrict local access & monitor advisories. https://radar.offseq.com/threat/cve-2026-7480-cwe-732-incorrect-permission-assignm-d09dc8d7 #OffSeq #Vuln #ASUS #Infosec

🟠 CVE-2026-45344 - High (8.1)

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, the setup database configuration flow on uninitialized LinkAce instances accepts attacker-controlled database credential fields and writes them back into .env without escap...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-45344/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49128 - High (7.5)

Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin, where the on-disk path is constructed by joining the storage root wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49128/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-8809 - Critical (9.8)

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5. The vulnerability exists due to the after_validate_save_post() function unconditiona...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-8809/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-49127 - High (8.6)

Music Player Daemon (MPD) before version 0.24.11 contains a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx that allows unauthenticated attackers to corrupt stack memory by triggering an off-by-one write in ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-49127/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47179 - High (7.7)

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.4, ProjectService.GetProjectFileContent returns the contents of any Docker Compose include directive declared in a project's compose file before an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47179/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39929 - High (7.5)

Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, 11.5.0.15 contain an out-of-bounds read vulnerability in the Command ID 30 UDP packet handler that allows remote attackers to crash the application by sending a specially c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39929/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-46833 - Critical (9)

Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Servic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-46833/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47331 - High (7.8)

Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the race condition that can lead to a use-after-free (UAF) and, theoretically, arbitrary code exec...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47331/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-47333 - High (7.8)

Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap memory out-of-bounds read in notification handling code. The bug can be triggered by an unpri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-47333/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-9645 - Critical (9.9)

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-9645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack