🟠 CVE-2026-82549 - High (8.3)

A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulation leads to improper validation of integrity check value. The attack may be launched rem...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82549/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82549 - High (8.3)

A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulation leads to improper validation of integrity check value. The attack may be launched rem...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82549/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82645 - High (8.6)

AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82645 - High (8.6)

AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82645/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82644 - High (7.5)

WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlob...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82644/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82644 - High (7.5)

WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer (ObjectYPT::setCacheGlob...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82644/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82638 - High (7.5)

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82638/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82638 - High (7.5)

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82638/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82642 - High (8.8)

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transfo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82642/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82642 - High (8.8)

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized with DOMPurify using a configuration that forbade only the tag (FORBID_TAGS: ['script']) in apps/readest-app/src/services/transfo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82642/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82542 - Critical (10)

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer over...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82542/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

https://www.cve.org/CVERecord?id=CVE-2026-82542

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

🔴 CVE-2026-82542 - Critical (10)

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer over...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82542/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

https://www.cve.org/CVERecord?id=CVE-2026-82542

sev:CRIT 10.0 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

🟠 CVE-2026-82655 - High (7.5)

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dum...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82655/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82655 - High (7.5)

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can bypass authentication by providing a dum...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82655/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82654 - High (8.9)

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents ref...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82654/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82654 - High (8.9)

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents ref...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82654/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82636 - OS Command Injection in Qubes OS via qvm-copy-to-vm error handling. CVSS 7.9. Update qubes-core-dom0-linux immediately. #CVE #QubesOS #infosec

https://www.valtersit.com/cve/CVE-2026-82636/

🟠 CVE-2026-82636 - High (7.9)

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metachara...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82636/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82636 - High (7.9)

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metachara...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82636/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82635 - Path Traversal in Pake allows arbitrary file write via unsanitized download paths. CVSS 8.8. Update to 3.13.1 now. #CVE #infosec #cybersecurity

https://www.valtersit.com/cve/CVE-2026-82635/

🟠 CVE-2026-82635 - High (8.8)

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82635/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82635 - High (8.8)

Pake before 3.13.1 joins the JavaScript-supplied filename for the download_file Tauri command onto the user's Downloads directory with no sanitization. A filename containing path traversal sequences (for example ../Library/LaunchAgents/com.evil.pl...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82635/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82641 - High (8.6)

keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82641/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82641 - High (8.6)

keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retri...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82641/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82657 - High (7.5)

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82657 - High (7.5)

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82657/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82653 - High (8.9)

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82653/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82653 - High (8.9)

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package names and notebook names are interpolated directly into innerHTML assignments. Attackers can submit malicious bazaar packages with...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82653/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82639 - High (7.5)

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82639/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82639 - High (7.5)

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82639/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82539 - Critical (9.1)

A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MAC Filtering. Executing a manipulation of the argument desc can lead to memory corruption...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82539 - Critical (9.1)

A vulnerability was determined in TOTOLINK A720R 4.1.5cu.630_B20250509. This impacts the function setMacFilterRules of the file cstecgi.cgi of the component MAC Filtering. Executing a manipulation of the argument desc can lead to memory corruption...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82539/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-15980 - Critical Auth Bypass in WordPress MyHome Core plugin (<= 4.4.5) allows unauthenticated admin account takeover. CVSS 9.8. Mitigate now. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-15980/

🔴 CVE-2026-15980 - Critical (9.8)

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-15980 - Critical Auth Bypass in WordPress MyHome Core plugin (<= 4.4.5) allows unauthenticated admin account takeover. CVSS 9.8. Mitigate now. #CVE #WordPress #infosec

https://www.valtersit.com/cve/CVE-2026-15980/

🔴 CVE-2026-15980 - Critical (9.8)

The MyHome Core plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.4.5. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15980/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16061 - High (8.6)

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16061/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16061 - High (8.6)

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16061/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-16947 - Critical (9.1)

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unau...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16947/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-16947 - Critical (9.1)

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unau...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16947/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16600 - High (7.7)

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16600/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-16600 - High (7.7)

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16600/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77007 - High (7.5)

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77007/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77007 - High (7.5)

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secr...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77007/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76586 - High (7.5)

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated us...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76586/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76586 - High (7.5)

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated us...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76586/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-77012 - Critical (9.3)

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77012/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-77012 - Critical (9.3)

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77012/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76548 - High (8.2)

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76548/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-76548 - High (8.2)

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-76548/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-16259 - Critical (9.8)

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16259/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-16259 - Critical (9.8)

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-16259/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-15369 - Critical (9.8)

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15369/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-15369 - Critical (9.8)

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from th...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-15369/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82463 - High (8.1)

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger pro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82463/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82463 - High (8.1)

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger pro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82463/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82474 - High (7.8)

Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82474/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82474 - High (7.8)

Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82474/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82473 - High (8.2)

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82473/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82473 - High (8.2)

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82473/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82472 - High (7.5)

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82472/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82472 - High (7.5)

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage r...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82472/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75807 - High (7.5)

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75807 - High (7.5)

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75807/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82475 - High (8.1)

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82475/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82475 - High (8.1)

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82475/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82466 - High (8.7)

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82466/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82466 - High (8.7)

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82466/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82461 - Auth bypass in pac4j-oidc. Unverified access tokens allow forging admin roles. CVSS 8.1. Update to v6.5.6 now. #CVE #infosec #cybersecurity

https://www.valtersit.com/cve/CVE-2026-82461/

🟠 CVE-2026-82461 - High (8.1)

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass autho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82461/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82461 - Auth bypass in pac4j-oidc. Unverified access tokens allow forging admin roles. CVSS 8.1. Update to v6.5.6 now. #CVE #infosec #cybersecurity

https://www.valtersit.com/cve/CVE-2026-82461/

🟠 CVE-2026-82461 - High (8.1)

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass autho...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82461/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82460 - Critical (9.8)

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82460/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82460 - Critical (9.8)

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82460/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82450 - High (8.8)

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82450/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82450 - High (8.8)

BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82450/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82457 - High (7.8)

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to ro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82457 - High (7.8)

su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to ro...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82457/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82454 - Critical (9.1)

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82454/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82454 - Critical (9.1)

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82454/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82453 - High (7.5)

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82453 - High (7.5)

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82453/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82447 - RCE in Skyvern TextPromptBlock via Jinja sandbox escape. Attackers can execute code with server privileges. CVSS 8.8. Update immediately. #CVE #Skyvern #infosec

https://www.valtersit.com/cve/CVE-2026-82447/

🟠 CVE-2026-82447 - High (8.8)

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syn...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82447 - High (8.8)

Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syn...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82447/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82448 - Critical (9.8)

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during W...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82448/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82448 - Critical (9.8)

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during W...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82448/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82456 - Critical (10)

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82456/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82456 - Critical (10)

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82456/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-82455 - Arbitrary file write flaw in RubyGems via symlink path traversal during extraction. CVSS 7.1. Update RubyGems immediately. #CVE #Ruby #infosec

https://www.valtersit.com/cve/CVE-2026-82455/

CVE-2026-82452 - Critical Auth Bypass in rust-iot-platform. Unauthenticated REST APIs allow full user account manipulation. CVSS 9.8. Restrict access now. #CVE #IoT #infosec

https://www.valtersit.com/cve/CVE-2026-82452/

🔴 CVE-2026-82452 - Critical (9.8)

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82452/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82452 - Critical (9.8)

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82452/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-14494 - Critical (9.8)

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-14494 - Critical (9.8)

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-14494/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56100 - High (8.1)

SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feig...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-56100 - High (8.1)

SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected internal Feig...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-56100/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📰 PaperCut Zero-Day RCE Actively Exploited; Emergency Patches Released

🚨 URGENT: PaperCut warns of an actively exploited zero-day RCE vulnerability chain affecting all NG/MF versions. The pre-auth flaws (CVE-2026-81578, CVE-2026-82078) allow full server takeover. Patch immediately! #Cybersecurity #ZeroDay #PaperCut

🔗 https://cyber.netsecops.io/articles/papercut-warns-of-actively-exploited-zero-day-rce-vulnerability/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

PaperCut Under Active Attack: Full Technical Analysis of the Pre-Auth RCE Chain (CVE-2026-81578 + CVE-2026-82078)

https://thecybersecguru.com/news/papercut-cve-2026-81578-cve-2026-82078-pre-auth-rce-analysis/

PaperCut Under Active Attack: Full Technical Analysis of the Pre-Auth RCE Chain (CVE-2026-81578 + CVE-2026-82078)

https://thecybersecguru.com/news/papercut-cve-2026-81578-cve-2026-82078-pre-auth-rce-analysis/

🟠 CVE-2026-81522 - High (8.1)

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may ther...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81522/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41012 - High (7.7)

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualiza...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41012/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-41012 - High (7.7)

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualiza...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-41012/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-81533 - Memory safety flaw in MongoDB BI Connector ODBC Driver. Buffer overflow via long LIMIT clauses. CVSS 7.1. Disable prefetch now. #CVE #MongoDB #infosec

https://www.valtersit.com/cve/CVE-2026-81533/

CVE-2026-81533 - Memory safety flaw in MongoDB BI Connector ODBC Driver. Buffer overflow via long LIMIT clauses. CVSS 7.1. Disable prefetch now. #CVE #MongoDB #infosec

https://www.valtersit.com/cve/CVE-2026-81533/

CVE-2026-81490 - DoS flaw in MongoDB Connector for BI. Malicious views block schema refresh routines. CVSS 7.7. Restrict view creation privileges. #CVE #MongoDB #infosec

https://www.valtersit.com/cve/CVE-2026-81490/

🟠 CVE-2026-81490 - High (7.7)

A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81490/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81490 - High (7.7)

A database user able to create a view in a namespace that MongoDB Connector for BI samples can cause the schema-sampling routine to stop functioning by defining a view whose evaluation reliably fails. The sampling logic classifies the resulting se...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81490/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81518 - High (7.5)

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81518/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81518 - High (7.5)

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that re...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81518/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82017 - High (7.6)

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82017/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82017 - High (7.6)

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82017/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-3627 - Critical SQLi in IBM Concert (1.0.0-2.3.1). Remote attackers can read, modify, or delete database contents. CVSS 9.1. Update now. #CVE #IBM #infosec

https://www.valtersit.com/cve/CVE-2026-3627/

🔴 CVE-2026-3627 - Critical (9.1)

IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3627/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-3627 - Critical (9.1)

IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3627/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18729 - High (8.8)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18729/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18729 - High (8.8)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18729/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-18527 - Critical (9.9)

IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18527/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-18527 - Critical (9.9)

IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18527/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55848 - High (8.6)

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55848/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55848 - High (8.6)

mapfish-print is a component of MapFish for printing templated cartographic maps. Prior to 3.28.30, 3.30.32, 3.31.24, 3.33.16, and 4.0.5, MapFish Print accepts an attacker-controlled GML layer url in requests to the /api/print3/print endpoint and ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55848/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-55784 - Auth state overwrite flaw in free5GC 5G core network AUSF component. CVSS 7.5. Unpatched, monitor for fixes and mitigate immediately. #CVE #5G #infosec

https://www.valtersit.com/cve/CVE-2026-55784/

🟠 CVE-2026-55784 - High (7.5)

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55784/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55784 - High (7.5)

free5GC is an open-source implementation of the 5G core network. In version 1.4.4 and earlier, the AUSF component stores per-subscriber authentication state in a global sync.Map named AUSFContext.UePool in internal/context/context.go, keyed only b...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55784/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82283 - High (8.1)

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82283 - High (8.1)

VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. Attackers can read, modify, and delete arbitrary conversations and messages by supplying c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82283/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82278 - High (8.8)

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82278 - High (8.8)

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82278/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82269 - High (8.1)

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82269/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82269 - High (8.1)

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82269/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81532 - High (8.8)

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81532/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81532 - High (8.8)

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81532/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-81520 - DoS vulnerability in MongoDB Connector for BI allows unauthenticated resource exhaustion. CVSS 7.5. Restrict access immediately. #CVE #MongoDB #infosec

https://www.valtersit.com/cve/CVE-2026-81520/

🟠 CVE-2026-81520 - High (7.5)

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81520/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81520 - High (7.5)

A network-reachable client that has not yet authenticated can hold a MongoDB Connector for BI authentication session open indefinitely by beginning a SASL-based login exchange and then declining to complete it. Because the negotiation loop had no ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81520/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81517 - High (7.5)

An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81517/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-81517 - High (7.5)

An unauthenticated party able to reach the port of a MongoDB Connector for BI (mongosqld) instance may generate enough routine connection log activity to exhaust the storage backing the configured log path. When a log write or log rotation operati...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-81517/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77078 - High (7.5)

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77078/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77078 - High (7.5)

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77078/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77037 - High (7.5)

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77037/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-77037 - High (7.5)

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-77037/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-55634 - Critical (9.9)

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field na...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55634/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-55634 - Critical Code Injection vulnerability in Pimcore import API. CVSS 9.9. Update immediately. #CVE #Pimcore #infosec

https://www.valtersit.com/cve/CVE-2026-55634/

🔴 CVE-2026-55634 - Critical (9.9)

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/api/class/definition/configuration-view/detail/{id}/import accepts a DataObject field na...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55634/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19295 - Critical (9.9)

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19295/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19295 - Critical (9.9)

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references i...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19295/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19286 - Critical (9.8)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19286 - Critical (9.8)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18904 - High (8.2)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18904/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18904 - High (8.2)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18904/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18899 - High (7.5)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18899/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18899 - High (7.5)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18899/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18891 - High (8.2)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18891 - High (8.2)

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18891/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-17203 - High (7.5)

IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17203/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-17203 - High (7.5)

IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-17203/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-55841 - High severity FortiGate syslog parser flaw in Graylog. CVSS 7.5. Update immediately. #CVE #Graylog #infosec

https://www.valtersit.com/cve/CVE-2026-55841/

🟠 CVE-2026-55841 - High (7.5)

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55841/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-55841 - High (7.5)

Graylog is a free and open log management platform. Prior to Graylog Server versions 6.3.12, 7.0.7, and 7.1.2 and Graylog Forwarder version 7.3, the FortiGate key-value syslog parser in graylog2-server/src/main/java/org/graylog2/inputs/codecs/GLFo...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-55841/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

📰 ServiceNow Patches Three Critical CVSS 10.0 Flaws in AI Platform

ServiceNow patches three critical unauthenticated flaws (CVSS 10.0) in its AI Platform. The vulnerabilities (CVE-2026-18885, -18886, -74820) allow for RCE, privilege escalation, and SQL injection. Self-hosted customers must patch immediately. #Servic...

🔗 https://cyber.netsecops.io/articles/servicenow-patches-three-critical-cvss-10-flaws-in-ai-platform/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

ServiceNow Patches Three CVSS 10.0 Vulnerabilities Allowing Unauthenticated Code Execution and SQL Injection

https://thecybersecguru.com/news/servicenow-cve-2026-18885-18886-74820-cvss-10/

ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug.

#ServiceNow #CodeInjection #SQLInjection #CVE #InfoSec

https://securityonline.info/servicenow-code-injection-sql-injection/?utm_source=mastodon&utm_medium=jetpack_social

🏆 New Achievement! Maximum Severity, Minimum Fuss!

Per your platform's automated patch-prioritization policy: three maximum-severity vulnerabilities in the ServiceNow AI Platform have been logged, triaged, and assigned to the backlog. CVE-2026-18886 enables privilege escalation and data manipulation; CVE-2026-74820 allows arbitrary SQL execution against your underlying database. No user interaction required for exploitation. (1/3)

🏆 New Achievement! Maximum Severity, Minimum Fuss!

Per your platform's automated patch-prioritization policy: three maximum-severity vulnerabilities in the ServiceNow AI Platform have been logged, triaged, and assigned to the backlog. CVE-2026-18886 enables privilege escalation and data manipulation; CVE-2026-74820 allows arbitrary SQL execution against your underlying database. No user interaction required for exploitation. (1/3)

ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug.

#ServiceNow #CodeInjection #SQLInjection #CVE #InfoSec

https://securityonline.info/servicenow-code-injection-sql-injection/?utm_source=mastodon&utm_medium=jetpack_social

Critical CVE: JFrog Artifactory Authentication Bypass

JFrog Artifactory의 기본 구성에서 네트워크 접근 가능한 비인증 공격자가 관리자 권한을 획득할 수 있는 인증 우회 취약점(CWE-287)이 공개되었습니다. CVSS v3.1 점수는 9.8(Critical)이며, 공격 복잡도와 필요 권한이 모두 낮고 사용자 상호작용 없이 원격 악용될 수 있습니다. 영향 범위에는 7.111.21 이전, 7.117.28 이전, 7.125.20 이전, 7.133.29 이전, 7.146.38 이전, 7.161.20 이전 버전이 포함됩니다. Artifactory를 모델·패키지·컨테이너 아티팩트 저장소로 사용하는 조직은 즉시 해당 유지보수 릴리스 이상으로 업그레이드...

https://www.cve.org/CVERecord?id=CVE-2026-82329

🔴 CVE-2026-82329 - Critical (9.8)

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82329/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82329 - Critical (9.8)

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82329/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82285 - High (8.2)

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82285 - High (8.2)

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82285/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82284 - High (8.1)

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories inc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82284 - High (8.1)

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer endpoints. Authenticated attackers can read other users' conversation histories inc...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82284/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82282 - High (8)

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82282 - High (8)

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key an...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82282/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82291 - High (8.1)

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logg...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82291/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82291 - High (8.1)

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logg...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82291/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82279 - High (8.1)

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82279 - High (8.1)

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by s...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82279/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82288 - High (7.5)

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82288 - High (7.5)

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82288/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82287 - High (8.1)

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue cre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82287 - High (8.1)

Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue cre...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82287/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82286 - High (8.6)

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segme...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82286 - High (8.6)

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segme...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82286/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82277 - Critical (9.8)

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82277 - Critical (9.8)

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82277/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82270 - High (7.5)

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82270/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82270 - High (7.5)

Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests w...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82270/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82268 - High (7.5)

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio int...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82268 - High (7.5)

Qwen-Agent through 0.0.34 contains a server-side request forgery vulnerability in the document parsing path that treats caller-supplied paths as URLs without scheme restriction or host validation. Attackers can reach the unauthenticated Gradio int...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82268/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-72984 - High (8.8)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72984/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-72984 - High (8.8)

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-72984/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75124 - High (7.5)

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75124 - High (7.5)

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75124/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82266 - Critical (9.8)

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82266/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82266 - Critical (9.8)

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, m...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82266/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack