🚨 [CISA-2026:1004] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1004)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-88779 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88779)
- Name: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174 ; https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88779

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261004 #cisa20261004 #cve_2026_88779 #cve202688779

CVE ID: CVE-2026-88779
Vendor: Citrix
Product: NetScaler
Date Added: 2026-10-04
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-88779

Einordnung: NetScaler-Zero-Day trifft Fernwartung

Citrix NetScaler: Zero-Day CVE-2026-88779 wird ausgenutzt. Wer SAML nutzt, sollte sofort auf 14.1-73.41 bzw. 13.1-64.28 patchen – auch die Fernwartung.

#OTSecurity #ICS #KRITIS #NIS2 #Cybersicherheit
https://ot-cyber.de/blog/einordnung-netscaler-zero-day-trifft-fernwartung.html

@bontchev @jsmall ah. You were replying to posts about CVE-2026-88779.

@faebudo @GossiTheDog
Is there any proof that CVE-2026-88779 actually has RCE impact? As far as I can tell this is all just conjecture based on the attempted command injection payloads from the same actor that introduced the crashes that lead to this fix.

The new Citrix Netscaler vuln from Friday is CVE-2026-88779, patch is out now and they recommend patching as soon as possible: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174

Although the vuln is labeled “Memory overflow vulnerability leading to Denial of Service”, that’s the same as CVE-2025–6543. You may remember that lead to RCE in the wild. Prior blog on that: https://doublepulsar.com/citrix-forgot-to-tell-you-cve-2025-6543-has-been-used-as-a-zero-day-since-may-2025-d76574e2dd2c

Citrix NetScaler CVE-2026-88779 is exploited in the wild against NetScaler SAML authentication setups. Upgrade to 14.1-73.41 now.

#Citrix #NetScaler #CVE202688779 #SAML #ActivelyExploited #DoS #Vulnerability

https://securityonline.info/citrix-netscaler-cve-2026-88779-exploited/?utm_source=mastodon&utm_medium=jetpack_social

This is the patch that never ends
It goes on and on my friends
Some people
Started applying it
Not knowing what it was
And they will keep applying it
Forever just because

(CVE-2026-88779 advisory and patch included now)

https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867

#Citrix #Netscaler #ThreatIntel #ThreatIntelligence

CVE-2026-88779 (HIGH, CVSS 8.7) impacts NetScaler ADC & Gateway <14.1-73.41, <13.1-64.28, <13.1-37.282. Remote, unauthenticated attackers can disrupt availability. Patch required; no active exploits. https://radar.offseq.com/threat/cve-2026-88779-vulnerability-in-netscaler-adc-93f6c6cf8720e4e9 #OffSeq #NetScaler #Vulnerability #InfoSec

🚨 [CISA-2026:1004] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1004)

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-88779 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-88779)
- Name: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Citrix
- Product: NetScaler
- Notes: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174 ; https://community.citrix.com/techzone-blogs/110_security-updates/understanding-and-addressing-cve-2026-88779-in-citrix-netscaler-adc-and-citrix-netscaler-gateway/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-88779

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261004 #cisa20261004 #cve_2026_88779 #cve202688779

CVE ID: CVE-2026-88779
Vendor: Citrix
Product: NetScaler
Date Added: 2026-10-04
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-88779

@bontchev @jsmall ah. You were replying to posts about CVE-2026-88779.

@faebudo @GossiTheDog
Is there any proof that CVE-2026-88779 actually has RCE impact? As far as I can tell this is all just conjecture based on the attempted command injection payloads from the same actor that introduced the crashes that lead to this fix.

The new Citrix Netscaler vuln from Friday is CVE-2026-88779, patch is out now and they recommend patching as soon as possible: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174

Although the vuln is labeled “Memory overflow vulnerability leading to Denial of Service”, that’s the same as CVE-2025–6543. You may remember that lead to RCE in the wild. Prior blog on that: https://doublepulsar.com/citrix-forgot-to-tell-you-cve-2025-6543-has-been-used-as-a-zero-day-since-may-2025-d76574e2dd2c

Citrix NetScaler CVE-2026-88779 is exploited in the wild against NetScaler SAML authentication setups. Upgrade to 14.1-73.41 now.

#Citrix #NetScaler #CVE202688779 #SAML #ActivelyExploited #DoS #Vulnerability

https://securityonline.info/citrix-netscaler-cve-2026-88779-exploited/?utm_source=mastodon&utm_medium=jetpack_social

This is the patch that never ends
It goes on and on my friends
Some people
Started applying it
Not knowing what it was
And they will keep applying it
Forever just because

(CVE-2026-88779 advisory and patch included now)

https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867

#Citrix #Netscaler #ThreatIntel #ThreatIntelligence

CVE-2026-88779 (HIGH, CVSS 8.7) impacts NetScaler ADC & Gateway <14.1-73.41, <13.1-64.28, <13.1-37.282. Remote, unauthenticated attackers can disrupt availability. Patch required; no active exploits. https://radar.offseq.com/threat/cve-2026-88779-vulnerability-in-netscaler-adc-93f6c6cf8720e4e9 #OffSeq #NetScaler #Vulnerability #InfoSec

🟠 CVE-2026-105219 - High (7.5)

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an untermina...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105219/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105219 - High (7.5)

Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service vulnerability in the style map tokeniser in lib/styles/parser/tokeniser.js due to overlapping regex alternatives. Attackers can supply a crafted .docx with an untermina...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105219/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105089 - High (8.7)

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and chann...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105089/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105089 - High (8.7)

WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and chann...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105089/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105086 - High (8.7)

WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entitie...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105086/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105086 - High (8.7)

WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by submitting doubly-encoded entities in video titles. Because safeString() strips tags before decoding entitie...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105086/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105212 - High (7.5)

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105212 - High (7.5)

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105212/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105215 - Critical (9.1)

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105215/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105215 - Critical (9.1)

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105215/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105213 - High (8.2)

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refres...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105213 - High (8.2)

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refres...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105213/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105210 - High (8.2)

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105210/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105210 - High (8.2)

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Att...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105210/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105207 - Critical (9.8)

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User S...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105207 - Critical (9.8)

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User S...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105207/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105208 - High (7.7)

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105208 - High (7.7)

ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with unauthenticated, malleable encryption, allowing authenticated users to tamper with their own token so it is accepted for another user's external login intent. An atta...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105208/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105209 - Critical (9.6)

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organizat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105209/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105209 - Critical (9.6)

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organizat...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105209/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105211 - High (8.1)

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105211 - High (8.1)

ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V2 that allows unauthenticated attackers to take over accounts by obtaining OTP codes via the returnCode delivery type. Attackers knowing a login name of a victim with ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105211/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97307 - High (7.5)

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97307/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

StylemixThemes Cost Calculator Builder (<4.0.18) hit by HIGH severity vuln (CVE-2026-97307): sensitive info may be leaked via sent data. Patch not confirmed — track vendor updates and secure affected sites. 🛡️ https://radar.offseq.com/threat/cve-2026-97307-insertion-of-sensitive-information-into-sent-data-in-stylemixthemes-cost-calculator-f23de2d1b2c3a3d8 #OffSeq #WordPress #Vuln

🟠 CVE-2026-97307 - High (7.5)

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97307/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

StylemixThemes Cost Calculator Builder (<4.0.18) hit by HIGH severity vuln (CVE-2026-97307): sensitive info may be leaked via sent data. Patch not confirmed — track vendor updates and secure affected sites. 🛡️ https://radar.offseq.com/threat/cve-2026-97307-insertion-of-sensitive-information-into-sent-data-in-stylemixthemes-cost-calculator-f23de2d1b2c3a3d8 #OffSeq #WordPress #Vuln

🔴 CVE-2026-105135 - Critical (10)

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105135/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

InternLM MindSearch 0.1.0 hit by CRITICAL code injection (CVE-2026-105135) in ExecutionAction.run — remote attackers can execute arbitrary code via manipulated inputs. No patch; restrict access & monitor for updates. https://radar.offseq.com/threat/cve-2026-105135-code-injection-in-internlm-mindsearch-f0d6fc8a61cd76d9 #OffSeq #CVE2026105135 #infosec #zeroday

🔴 CVE-2026-105135 - Critical (10)

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection....

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105135/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

InternLM MindSearch 0.1.0 hit by CRITICAL code injection (CVE-2026-105135) in ExecutionAction.run — remote attackers can execute arbitrary code via manipulated inputs. No patch; restrict access & monitor for updates. https://radar.offseq.com/threat/cve-2026-105135-code-injection-in-internlm-mindsearch-f0d6fc8a61cd76d9 #OffSeq #CVE2026105135 #infosec #zeroday

🔴 CVE-2026-103355 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103355/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-103355: CRITICAL blind SQL Injection in Unlimited Elements For Elementor (<2.0.21). Risk of data compromise — patch ASAP when available! https://radar.offseq.com/threat/cve-2026-103355-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-in-3504f0f6c5f88104 #OffSeq #WordPress #Infosec #SQLInjection

🔴 CVE-2026-103355 - Critical (9.3)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103355/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-103355: CRITICAL blind SQL Injection in Unlimited Elements For Elementor (<2.0.21). Risk of data compromise — patch ASAP when available! https://radar.offseq.com/threat/cve-2026-103355-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-in-3504f0f6c5f88104 #OffSeq #WordPress #Infosec #SQLInjection

🔴 CVE-2026-105134 - Critical (10)

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os comman...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105134/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-105134 (CRITICAL): Ahsay AhsayCBS ≤10.3.2 suffers OS command injection in Replication Receiver (/rps/api/json/UpdateReceivers.do). Remote RCE possible — public exploit out. Patch to 10.3.4+ now. https://radar.offseq.com/threat/cve-2026-105134-os-command-injection-in-ahsay-ahsaycbs-a9df873cc55c0ce9 #OffSeq #Vuln #CVE #PatchNow

🔴 CVE-2026-105134 - Critical (10)

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os comman...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105134/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-105134 (CRITICAL): Ahsay AhsayCBS ≤10.3.2 suffers OS command injection in Replication Receiver (/rps/api/json/UpdateReceivers.do). Remote RCE possible — public exploit out. Patch to 10.3.4+ now. https://radar.offseq.com/threat/cve-2026-105134-os-command-injection-in-ahsay-ahsaycbs-a9df873cc55c0ce9 #OffSeq #Vuln #CVE #PatchNow

CVE-2026-105129 | LaraDashboard <1.4.8 HIGH severity: settings.view users can access plaintext secrets (API keys, mail creds, tokens) via API. Patch to 1.4.8+ recommended. https://radar.offseq.com/threat/laradashboard-before-148-contains-an-incorrect-authorization-vulnerability-that-allows-authenticated-16249131d2f6c23b #OffSeq #Vulnerability #LaraDashboard #AppSec

CVE-2026-105129 | LaraDashboard <1.4.8 HIGH severity: settings.view users can access plaintext secrets (API keys, mail creds, tokens) via API. Patch to 1.4.8+ recommended. https://radar.offseq.com/threat/laradashboard-before-148-contains-an-incorrect-authorization-vulnerability-that-allows-authenticated-16249131d2f6c23b #OffSeq #Vulnerability #LaraDashboard #AppSec

vincent-peugnet wcms ≤3.18.0 is vulnerable (CVE-2026-105123, HIGH, CVSS 8.7): Authenticated editors can upload malicious files via /api/v0/media/upload/ and delete arbitrary files. Restrict privileges, monitor uploads. https://radar.offseq.com/threat/cve-2026-105123-unrestricted-upload-of-file-with-dangerous-type-in-vincent-peugnet-wcms-9cc4f5671e51d0dd #OffSeq #RCE #WebSecurity #Vuln

🟠 CVE-2026-105123 - High (8.8)

W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php file...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

vincent-peugnet wcms ≤3.18.0 is vulnerable (CVE-2026-105123, HIGH, CVSS 8.7): Authenticated editors can upload malicious files via /api/v0/media/upload/ and delete arbitrary files. Restrict privileges, monitor uploads. https://radar.offseq.com/threat/cve-2026-105123-unrestricted-upload-of-file-with-dangerous-type-in-vincent-peugnet-wcms-9cc4f5671e51d0dd #OffSeq #RCE #WebSecurity #Vuln

🟠 CVE-2026-105123 - High (8.8)

W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php file...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105123/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89236 - High (8.6)

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive info...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89236/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-89236 - High (8.6)

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive info...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-89236/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88783 - High (8.8)

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88783/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-88783 - High (8.8)

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-88783/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-103626 - Critical (9.6)

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103626/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-103626 - Critical (9.6)

Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103626/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103624 - High (8.3)

Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromiu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103624 - High (8.3)

Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromiu...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103624/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101160 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101160 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not validate that a submitted review rating is numeric before storing it and later using it in numeric operations when rendering reviews, allowing unauthenticated users to make the reviewed...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101160/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103514 - High (7.5)

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103514/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103514 - High (7.5)

The WP 2FA WordPress plugin before 4.1.0 does not invalidate a time-based one-time passcode once it has been used, allowing an attacker who knows an account's password and has observed a valid code within its validity window to replay it and bypa...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103514/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101159 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101159/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101159 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not properly sanitise and escape reviews submitted through its public review form, which is available to unauthenticated visitors, allowing them to perform Stored Cross-Site Scripting attac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101159/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96451 - High (8.8)

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96451/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96451 - High (8.8)

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96451/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94593 - High (7.8)

Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94593/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94593 - High (7.8)

Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94593/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91078 - High (8.2)

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91078/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-91078 - High (8.2)

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone wit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-91078/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75028 - High (7.5)

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75028/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-75028 - High (7.5)

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authe...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-75028/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105105 - Critical (9.8)

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105105 - Critical (9.8)

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105105/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

NASA-AMMOS AIT-Core ≤3.1.1 has a CRITICAL vuln (CVE-2026-105105): ZeroMQ bus lacks auth, exposing command & telemetry to remote attackers. Upgrade to 3.1.2 restricts access to loopback. Details: https://radar.offseq.com/threat/cve-2026-105105-cwe-306-missing-authentication-for-critical-function-in-nasa-ammos-ait-core-6642dd3ce660454d #OffSeq #CVE #SpaceSec #Infosec

🔴 CVE-2026-103648 - Critical (9.1)

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103648/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101161 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of ser...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101161/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101161 - High (7.5)

The WP Ultimate Review WordPress plugin before 2.4.4 does not prevent unauthenticated users from storing crafted review content that makes the reviewed page fail with a fatal error on every subsequent visit, resulting in a persistent denial of ser...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101161/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105115 - High (8.6)

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* wi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105115/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-105115 - High (8.6)

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* wi...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105115/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103065 - High (8.2)

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103065/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103065 - High (8.2)

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103065/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-71886: Bouncy Castle for Java <1.86 HIGH severity vuln lets restricted OpenPGP subkeys improperly certify or delegate trust. No patch yet — validate key flags before accepting certifications. https://radar.offseq.com/threat/in-bouncy-castle-for-java-before-186-the-high-level-openpgp-certificate-api-accepted-a-third-party-032fc543ac46afc4 #OffSeq #JavaSecurity #PKI #BouncyCastle

CVE-2026-71886: Bouncy Castle for Java <1.86 HIGH severity vuln lets restricted OpenPGP subkeys improperly certify or delegate trust. No patch yet — validate key flags before accepting certifications. https://radar.offseq.com/threat/in-bouncy-castle-for-java-before-186-the-high-level-openpgp-certificate-api-accepted-a-third-party-032fc543ac46afc4 #OffSeq #JavaSecurity #PKI #BouncyCastle

CVE-2026-71885 (CRITICAL): Bouncy Castle for Java <1.86 suffers from X.509 credential binding flaw in MLS. Attackers can impersonate users & decrypt group messages. Upgrade to v1.86+ now. https://radar.offseq.com/threat/in-bouncy-castle-for-java-before-186-the-messaging-layer-security-mls-rfc-9420-implementation-did-not-53cae24ecd925b00 #OffSeq #BouncyCastle #Java #Infosec

CVE-2026-71885 (CRITICAL): Bouncy Castle for Java <1.86 suffers from X.509 credential binding flaw in MLS. Attackers can impersonate users & decrypt group messages. Upgrade to v1.86+ now. https://radar.offseq.com/threat/in-bouncy-castle-for-java-before-186-the-messaging-layer-security-mls-rfc-9420-implementation-did-not-53cae24ecd925b00 #OffSeq #BouncyCastle #Java #Infosec

CRITICAL CVE-2026-71885 in Bouncy Castle BC-JAVA (<1.86): Improper X.509 cert validation in MLS lets attackers impersonate users & compromise group comms. Upgrade to 1.86+ ASAP. https://radar.offseq.com/threat/cve-2026-71885-cwe-295-improper-certificate-validation-in-legion-of-the-bouncy-castle-inc-bc-java-13dda4ca65417833 #OffSeq #CVE202671885 #JavaSecurity #Infosec

🟠 CVE-2026-94505 - High (8.1)

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94505/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94505 - High (8.1)

The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94505/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-92084 - Critical (9.1)

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an acti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-92084 - Critical (9.1)

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an acti...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92084/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-71887 | Legion of the Bouncy Castle BC-JAVA <1.86 has a HIGH severity flaw: improper signature verification can enable signature misattribution via public signing subkeys. Patch to 1.86+ now. https://radar.offseq.com/threat/cve-2026-71887-cwe-347-improper-verification-of-cryptographic-signature-in-legion-of-the-bouncy-castle-0eee2b4a5be9b093 #OffSeq #Vulnerability #Java #Infosec

🟠 CVE-2026-18443 - High (8.8)

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18443/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-18443 - High (8.8)

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-18443/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-87115 - Critical (9.1)

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87115/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-87115 - Critical (9.1)

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for u...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-87115/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

VikAppointments Booking Calendar plugin (<=1.2.21) for WordPress is vulnerable to CRITICAL path traversal (CVE-2026-87115). Unauth attackers can delete files, risking RCE. Check for File-type fields & secure your site! https://radar.offseq.com/threat/cve-2026-87115-cwe-22-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-in-59a71fc6e6540921 #OffSeq #WordPress #CVE202687115

🟠 CVE-2026-96267 - High (7.5)

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96267/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96267 - High (7.5)

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96267/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103913 - High (7.5)

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103913/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103913 - High (7.5)

The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the stored latitude/longitude coordinates of a listing in versions up to, and including, 2.8.186. This is due to insufficient escaping and the absence of numeric validation o...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103913/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97337 - High (7.5)

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97337/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97337 - High (7.5)

The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97337/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101923 - High (8.1)

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101923/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101923 - High (8.1)

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101923/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97644 - High (8.8)

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97644/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97644 - High (8.8)

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact`...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97644/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-92536 - High (8.8)

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the g...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92536/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-92536 - High (8.8)

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the g...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-92536/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103625 - High (8.8)

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103625/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103625 - High (8.8)

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103625/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93428 - High (7.5)

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-93428 - High (7.5)

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-93428/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105080 - Critical (9.9)

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-105080 - Critical (9.9)

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-105080/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-105080 (CRITICAL, CVSS 9.4) in C4illin ConvertX <0.19.0: Untrusted .recipe files can execute code via Calibre's ebook-convert. Update to 0.19.0+ recommended. https://radar.offseq.com/threat/cve-2026-105080-cwe-829-inclusion-of-functionality-from-untrusted-control-sphere-in-c4illin-convertx-bd5c3a85ca8190d3 #OffSeq #Vuln #CVE2026105080 #ConvertX #Calibre

🔴 CVE-2026-84411 - Critical (9.8)

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary cod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-84411 - Critical (9.8)

The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary cod...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-84411/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Saturday morning RouterOS 9.8 :apartyblobcat:

https://db.gcve.eu/vuln/cve-2026-84411

CVE-2026-84411 (CRITICAL, CVSS 9.8) affects MikroTik RouterOS <7.24. Integer underflow in web mgmt lets unauth'd attackers exec root code or DoS via crafted HTTP. Restrict access & monitor now. https://radar.offseq.com/threat/cve-2026-84411-cwe-191-in-mikrotik-routeros-962ba80173301661 #OffSeq #CVE #MikroTik #InfoSec

🟠 CVE-2026-94592 - High (8.4)

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operatin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94592/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94592 - High (8.4)

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operatin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94592/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97363 - High (7.5)

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97363/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-97363 - High (7.5)

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-97363/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-95102 - Critical (9.4)

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95102/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-95102 - Critical (9.4)

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-95102/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Monta monta.app faces a CRITICAL risk (CVE-2026-95102, CVSS 9.4): missing auth on WebSocket endpoints allows attackers to impersonate charging stations & access sensitive data. Restrict access, monitor traffic. Details: https://radar.offseq.com/threat/cve-2026-95102-cwe-306-in-monta-montaapp-d0effdc35e6b46a2 #OffSeq #CVE202695102 #InfoSec ⚡️

🟠 CVE-2026-94591 - High (8.4)

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94591/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-94591 - High (8.4)

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94591/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Unpatched Apache OpenOffice vulnerability CVE-2026-59265 runs code via crafted files. Apache Directory LDAP API and Traffic Server fixes out.

#Apache #OpenOffice #ApacheDirectory #LDAP #TrafficServer #CVE202659265 #CVE2026103877 #Vulnerability

https://securityonline.info/apache-openoffice-vulnerability-ldap-api-traffic-server/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-104433 - High (7.5)

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104433/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104433 - High (7.5)

Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allows unauthenticated attackers to crash the service by sending a zero-length handshake frame. Attackers can c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104433/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103622 - High (8.8)

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103622/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-103622 - High (8.8)

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103622/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82044 - High (7.7)

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() meth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82044 - High (7.7)

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf() meth...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82044/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82042 - Critical (9.8)

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82042 - Critical (9.8)

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNAL_KEY environment variable value, which t...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82042/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82041 - Critical (9.9)

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before for...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82041/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-82041 - Critical (9.9)

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before for...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82041/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104988 - High (8.1)

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104988 - High (8.1)

A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retai...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104988/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39718 - High (8.8)

Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-39718 - High (8.8)

Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-39718/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96940 - High (8.8)

Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-96940 - High (8.8)

Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-96940/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Microsoft lança atualizações urgentes para corrigir falha crítica no Exchange Server, que permite a elevação de privilégios e acesso não autorizado a caixas de correio de outros utilizadores. A falha, CVE-2026-96940, afeta várias versões do Exchange Server local. 🚨

🔗 https://tugatech.com.pt/t92180-microsoft-lanca-atualizacoes-urgentes-para-corrigir-falha-critica-no-exchange-server

#exchange #falha #lan #microsoft #server 

Microsoft's September 2026 V2 Exchange Server security updates add CVE-2026-96940 for Exchange SE, 2019 and 2016. Install them now.

#Microsoft #ExchangeServer #ExchangeSE #CVE202696940 #SecurityUpdate #PatchManagement #ESU

https://securityonline.info/exchange-server-security-updates-september-2026-v2/?utm_source=mastodon&utm_medium=jetpack_social

PSA: Exchange Server V2 Security Updates for September were published, additionally addressing CVE-2026-96940 https://eightwone.com/2026/10/03/v2-security-updates-exchange-2016-se-sep2026/ #MSExchange

Digi IX Family devices hit by CRITICAL OS command injection (CVE-2026-75937, CVSS 9.4). Unauthenticated remote attackers can execute root commands via HTTP POST. Disable web admin interface to reduce risk. https://radar.offseq.com/threat/cve-2026-75937-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-deedd882034e65bf #OffSeq #Vulnerability #IoT #Infosec

Digi DAL OS vulnerability CVE-2026-75937 (CVSS 9.4) lets attackers run root commands on Digi Accelerated Linux devices. Patch now.

#Digi #DALOS #CVE202675937 #CommandInjection #IoTSecurity #OTSecurity #Vulnerability

https://securityonline.info/digi-dal-os-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-51916 - High (7.5)

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowle...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51916/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-51916 - High (7.5)

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowle...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51916/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-51907 - High (8.1)

In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51907/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-51907 - High (8.1)

In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-51907/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-103628 - Critical (9.6)

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103628/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-103628 - Critical (9.6)

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-103628/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Google Chrome published an empty blog post as a security advisory on Thursday afternoon. They filled it out in the past day, but don't make it easy to grasp the severity of their bugs.

For example, "Critical CVE-2026-103628: Out of bounds write in WebGL." is actually a CVSSv3.1: 9.6 critical because it allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. You'd have to chase down those details yourself on cve.org or elsewhere.

https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop.html

#google #chrome #CVE

Chrome security update: Chrome 154 fixes 11 flaws, including critical WebGL sandbox escape CVE-2026-103628. Update your browser now.

#Chrome #GoogleChrome #Chrome154 #CVE2026103628 #CVE2026103631 #BrowserSecurity #Vulnerability

https://securityonline.info/chrome-security-update-154/?utm_source=mastodon&utm_medium=jetpack_social

🔴 CVE-2026-104019 - Critical (9)

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104019/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-104019 - Critical (9)

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104019/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

CVE-2026-104019: CRITICAL OS command injection in AWS SageMaker Distribution (CVSS 9.0) can let project contributors run arbitrary code & steal credentials. Upgrade to fixed versions or restart supported Spaces for auto-patch. https://radar.offseq.com/threat/cve-2026-104019-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-977760a40717075a #OffSeq #AWS #CVE #CloudSec

AWS fixes Loom for AWS admin takeover CVE-2026-103956 and a SageMaker Unified Studio code execution bug, CVE-2026-104019. Patch now.

#AWS #LoomForAWS #SageMaker #CVE2026103956 #CVE2026104019 #AISecurity #CloudSecurity #Vulnerability

https://securityonline.info/loom-for-aws-sagemaker-flaws/?utm_source=mastodon&utm_medium=jetpack_social

🟠 CVE-2026-82039 - High (8.8)

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-82039 - High (8.8)

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanit...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-82039/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67989 - High (7.5)

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-67989 - High (7.5)

crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in Mistral model capability matching on Ruby 3.1.x

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-67989/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Thales SConnect is affected by CVE-2026-18397 (CVSS 4.0 9.4), which allows a malicious website to reach the native host and achieve remote code execution. This matters because it fronts hardware-token authentication for SWIFT, Qatar Tawtheeq and Sweden Skatteverket. #Thales #SConnect #CriticalVulnerability

https://cyberworldops.eu/en/sconnect-flaw-lets-malicious-websites-reach-a-native-host

🟠 CVE-2026-104861 - High (7.5)

probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /]*>/, which repeatedly scans to the end of input when attacker-cont...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104861/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Moxa MGate vulnerabilities CVE-2026-86325 (CVSS 9.4) and CVE-2026-86326 hit MGate protocol gateway firmware. See affected versions and fixes.

#Moxa #MGate #CVE202686325 #CVE202686326 #ICSSecurity #OTSecurity #Vulnerability

https://securityonline.info/moxa-mgate-vulnerabilities/?utm_source=mastodon&utm_medium=jetpack_social

https://www.moxa.com/en/support/product-support/security-advisory/mpsa-269540-cve-2026-86325,-cve-2026-86326-two-vulnerabilities-in-protocol-gateways

CVE-2026-86325

A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the account_name parameter when processing account management requests. An attacker authenticated as a read-only user to the web management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow. Successful exploitation could allow an attacker to read sensitive information from device memory, including credentials, modify arbitrary memory contents, and disrupt device availability.

CVE-2026-86326

An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the cryptographic authenticity of firmware images before installation. An attacker with high privileges and access to the firmware update interface could provide a specially crafted or modified firmware image, causing it to be installed on the device. Successful exploitation could allow the attacker to execute unauthorized code, compromise the integrity and availability of the device, and persist malicious modifications across subsequent firmware updates.

Given the high severity of these issues, users should apply the solutions immediately to reduce security risks.

🟠 CVE-2026-54049 - High (8.7)

Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them usin...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-54049/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104851 - High (8.8)

fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted j...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104851/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🏆 New Achievement! Duo-pocalypse Now!

Thank you for contacting GitLab Support. I see you're running a self-hosted AI Gateway. Great choice! Have you tried letting authenticated users execute arbitrary commands on it? Because CVE-2026-90970, CVSS 9.9, has gone ahead and enabled that feature for you. You're welcome. We've escalated your ticket to "catastrophic." (1/3)

⚠️ CRITICAL: GitLab warns of critical RCE vulnerability in AI Gateway service

GitLab disclosed CVE-2026-90970, a critical RCE in AI Gateway that lets authenticated users with Duo Agent Platform access break out of prompt sandbox and run arbitrary commands. Self-hosted deployments are vulnerable; cloud instances are already patched. This is the second critical GitLab vuln in…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

POV: you shipped an AI gateway

the prompt template: "hi {{name}}"

a logged in user with a crafted flow config: "what if i was a shell"

gitlab patched a CVSS 9.9 prompt template sandbox escape in its self-hosted AI gateway (CVE-2026-90970). affected: 18.1.6 to 19.2.3, 19.3.0 to 19.3.1, 19.4.0. fixed in 19.2.4, 19.3.2, 19.4.1. gitlab.com and dedicated already patched

#InfoSec #GitLab #AI #DevSecOps

🏆 New Achievement! Duo-pocalypse Now!

Thank you for contacting GitLab Support. I see you're running a self-hosted AI Gateway. Great choice! Have you tried letting authenticated users execute arbitrary commands on it? Because CVE-2026-90970, CVSS 9.9, has gone ahead and enabled that feature for you. You're welcome. We've escalated your ticket to "catastrophic." (1/3)

⚠️ CRITICAL: GitLab warns of critical RCE vulnerability in AI Gateway service

GitLab disclosed CVE-2026-90970, a critical RCE in AI Gateway that lets authenticated users with Duo Agent Platform access break out of prompt sandbox and run arbitrary commands. Self-hosted deployments are vulnerable; cloud instances are already patched. This is the second critical GitLab vuln in…

https://threatnoir.com/focus

#infosec #cybersecurity

🤖 AI generated summary

POV: you shipped an AI gateway

the prompt template: "hi {{name}}"

a logged in user with a crafted flow config: "what if i was a shell"

gitlab patched a CVSS 9.9 prompt template sandbox escape in its self-hosted AI gateway (CVE-2026-90970). affected: 18.1.6 to 19.2.3, 19.3.0 to 19.3.1, 19.4.0. fixed in 19.2.4, 19.3.2, 19.4.1. gitlab.com and dedicated already patched

#InfoSec #GitLab #AI #DevSecOps

Critical GitLab AI Gateway vulnerability (CVE-2026-90970) enables remote code execution on self-hosted servers

https://thecybersecguru.com/exploits/gitlab-ai-gateway-cve-2026-90970/

GitLab Issues Emergency Patches for Actively Exploited Critical AI Gateway and Path Traversal Flaws

GitLab released emergency security updates to fix a critical remote code execution vulnerability in its AI Gateway (CVE-2026-90970) and a maximum-severity path traversal flaw (CVE-2026-85706) that allows unauthenticated attackers to steal sensitive server data.

**If you run self-hosted GitLab (Community or Enterprise Edition) or a self-hosted GitLab AI Gateway for Duo, patch now: upgrade the AI Gateway to 19.2.4, 19.3.2 or 19.4.1 and apply GitLab's latest security release. One of the flaws is already actively exploited. After patching, check your logs for strange flow configurations or file access, and rotate all AI provider API keys and other secrets on those servers.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/gitlab-issues-emergency-patches-for-actively-exploited-critical-ai-gateway-and-path-traversal-flaws-g-e-5-1-b/gD2P6Ple2L

GitLab patched CVE-2026-90970, a sandbox escape in self-hosted AI Gateway allowing authenticated Duo Agent users to execute arbitrary commands via crafted flow configs. Self-hosted deployments should patch and audit for abuse, as gateway compromise can expose AI workflows and downstream systems. #GitLab #AiSecurity #SandboxEscape

https://cyberworldops.eu/en/gitlab-fixes-ai-gateway-sandbox-escape-enabling-command-execution

GitLab AI Gateway vulnerability CVE-2026-90970 (CVSS 9.9) lets Duo Agent Platform users run commands. Upgrade self-hosted gateways now.

#GitLab #AIGateway #GitLabDuo #CVE202690970 #RCE #DevSecOps #Vulnerability

https://securityonline.info/gitlab-ai-gateway-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

GitLab AI Gateway flaw CVE-2026-90970 enables RCE

https://fawkes.rocks/2026/10/02/gitlab-ai-gateway-flaw-cve-2026-90970-enables-rce/

Go hack more AI shit.

https://nvd.nist.gov/vuln/detail/cve-2026-90970

sev:CRIT 9.9 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.

Go hack more AI shit.
Go hack more Gitlab.

But most importantly, hack more Gitlab AI shit: https://db.gcve.eu/vuln/cve-2026-90970

🔴 CVE-2026-90970 - Critical (9.9)

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authentic...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-90970/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Critical Capacitor Flaw Allows Malicious Links to Hijack Mobile App Data and Native Features

Capacitor patched a critical vulnerability (CVE-2026-103922) that allows malicious links to load attacker-controlled content within a mobile app's trusted origin. This flaw enables unauthorized access to sensitive user data, authentication tokens, and native device features through Capacitor plugins.

**If you build mobile apps with Capacitor, update to a patched version (6.2.2, 7.6.9, 8.3.5, 8.4.3 or 8.5.1), then rebuild your Android and iOS apps and push the new versions to users. Updating the package alone doesn't protect anyone. If you can't update, block navigation to the internal interceptor path with a custom plugin, and rebuild the apps. Prioritize apps that show chat messages, feeds or other user content first.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-capacitor-flaw-allows-malicious-links-to-hijack-mobile-app-data-and-native-features-g-8-t-k-g/gD2P6Ple2L

Critical Capacitor Flaw Allows Malicious Links to Hijack Mobile App Data and Native Features

Capacitor patched a critical vulnerability (CVE-2026-103922) that allows malicious links to load attacker-controlled content within a mobile app's trusted origin. This flaw enables unauthorized access to sensitive user data, authentication tokens, and native device features through Capacitor plugins.

**If you build mobile apps with Capacitor, update to a patched version (6.2.2, 7.6.9, 8.3.5, 8.4.3 or 8.5.1), then rebuild your Android and iOS apps and push the new versions to users. Updating the package alone doesn't protect anyone. If you can't update, block navigation to the internal interceptor path with a custom plugin, and rebuild the apps. Prioritize apps that show chat messages, feeds or other user content first.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-capacitor-flaw-allows-malicious-links-to-hijack-mobile-app-data-and-native-features-g-8-t-k-g/gD2P6Ple2L

🟠 CVE-2026-94422 - High (8.8)

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or co...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-94422/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-102489 – Zammad GmbH Zammad Session Fixation Vulnerability

Immediate CISA KEV threat advisory for CVE-2026-102489 affecting Zammad. Includes session fixation RCE analysis, CISO compliance steps, and comprehensive asset hardening runbooks....

https://thecybermind.co/qfru

(CISA TwS) The Cyber Mind TSUITE Brief: CVE-2026-102489 – Zammad GmbH Zammad Session Fixation Vulnerability

Immediate CISA KEV threat advisory for CVE-2026-102489 affecting Zammad. Includes session fixation RCE analysis, BOD 26-04 compliance guidance, and multi-vendor SOC detection queries....

https://thecybermind.co/l7ux

Zammad security alert: session hijacking and remote code execution

CVE-2026-102489 concerns session hijacking that can lead to code execution as the Zammad service account on affected older installations. DIVD reports exploitation in a real incident.

Zammad states that version 7.0 and later are not exploitable through this issue and recommends upgrading to 7.2.0.

#Zammad #CyberSecurity #VulnerabilityManagement #SecPoint #Penetrator

(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-102489 – Zammad GmbH Zammad Session Fixation Vulnerability

Immediate CISA KEV threat advisory for CVE-2026-102489 affecting Zammad. Includes session fixation RCE analysis, CISO compliance steps, and comprehensive asset hardening runbooks....

https://thecybermind.co/qfru

(CISA TwS) The Cyber Mind TSUITE Brief: CVE-2026-102489 – Zammad GmbH Zammad Session Fixation Vulnerability

Immediate CISA KEV threat advisory for CVE-2026-102489 affecting Zammad. Includes session fixation RCE analysis, BOD 26-04 compliance guidance, and multi-vendor SOC detection queries....

https://thecybermind.co/l7ux

Zammad security alert: session hijacking and remote code execution

CVE-2026-102489 concerns session hijacking that can lead to code execution as the Zammad service account on affected older installations. DIVD reports exploitation in a real incident.

Zammad states that version 7.0 and later are not exploitable through this issue and recommends upgrading to 7.2.0.

#Zammad #CyberSecurity #VulnerabilityManagement #SecPoint #Penetrator

The Dutch Institute for Vulnerability Disclosure, whose entire ledger is OTHER people's vulnerabilities, has recorded a significant loss in column B.

Agentic AI in the threat actor slot: filed under Equipment Used Against Us. Session tokens: stolen. Root access: granted to strangers. Irony reserves: critically depleted.

Patch Zammad immediately to address CVE-2026-102489 and the second zero-day, and review DIVD's published findings for full remediation guidance. (2/3)

🏆 New Achievement! Auditing the Auditors, Zero Days Found, Zero Days Remaining!

Conducting inventory review of DIVD assets. Status: two zero-day vulnerabilities in Zammad (CVE-2026-102489, CVSS 9.4, and a companion flaw) — unpatched, unaccounted for, now exploited. An AI-powered automated attack chained both flaws to hijack sessions, execute remote code, and escalate privileges to root. In seconds. (1/3)

CISA has updated the catalogue. GMBH is looking like Swiss cheese these days.

- CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-102489

- CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-102490

Yesterday's funny headline:

CISA Launches Cybersecurity Awareness Month: Securing the Next 250 https://www.cisa.gov/news-events/news/cisa-launches-cybersecurity-awareness-month-securing-next-250 #CISA #infosec #vulnerability

CVE ID: CVE-2026-102489
Vendor: Zammad GmbH
Product: Zammad
Date Added: 2026-10-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-102489

🚨 [CISA-2026:1002] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1002)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-102489 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102489)
- Name: Zammad GmbH Zammad Session Fixation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Zammad GmbH
- Product: Zammad
- Notes: https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102489

⚠️ CVE-2026-102490 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102490)
- Name: Zammad GmbH Zammad Improper Privilege Management Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Zammad GmbH
- Product: Zammad
- Notes: https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102490

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261002 #cisa20261002 #cve_2026_102489 #cve_2026_102490 #cve2026102489 #cve2026102490

The Cyber Mind Cybersecurity Weekly Brief October 4, 2026

Immediate CISA KEV threat advisory for CVE-2026-102490 affecting Zammad. Includes privilege escalation workflow analysis, BOD 26-04 compliance steps, and production-ready SOC detection queries....

https://thecybermind.co/9km9

The Cyber Mind Cybersecurity Weekly Brief October 4, 2026

Immediate CISA KEV threat advisory for CVE-2026-102490 affecting Zammad. Includes privilege escalation workflow analysis, BOD 26-04 compliance steps, and production-ready SOC detection queries....

https://thecybermind.co/9km9

CISA has updated the catalogue. GMBH is looking like Swiss cheese these days.

- CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-102489

- CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-102490

Yesterday's funny headline:

CISA Launches Cybersecurity Awareness Month: Securing the Next 250 https://www.cisa.gov/news-events/news/cisa-launches-cybersecurity-awareness-month-securing-next-250 #CISA #infosec #vulnerability

CVE ID: CVE-2026-102490
Vendor: Zammad GmbH
Product: Zammad
Date Added: 2026-10-02
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2026-102490

🚨 [CISA-2026:1002] CISA Adds 2 Known Exploited Vulnerabilities to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:1002)

CISA has added 2 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

⚠️ CVE-2026-102489 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102489)
- Name: Zammad GmbH Zammad Session Fixation Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Zammad GmbH
- Product: Zammad
- Notes: https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102489

⚠️ CVE-2026-102490 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-102490)
- Name: Zammad GmbH Zammad Improper Privilege Management Vulnerability
- Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset&#39;s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Known To Be Used in Ransomware Campaigns? Unknown
- Vendor: Zammad GmbH
- Product: Zammad
- Notes: https://zammad.com/en/product/releases/ ; https://community.zammad.org/t/take-care-local-privilege-escalation-cve-2026-102490-is-reported-as-being-actively-exploited/21297/2 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102490

#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20261002 #cisa20261002 #cve_2026_102489 #cve_2026_102490 #cve2026102489 #cve2026102490

🔴 CVE-2026-102795 - Critical (9.3)

Improper Access Control vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.

Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the is...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102795/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-101104 - High (7.7)

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-101104/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104431 - High (7.5)

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sig...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104431/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-102667 - High (8.3)

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, ...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-102667/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🟠 CVE-2026-104026 - High (7.8)

In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in Git subtree URLs. A maliciously constructed repository, if cloned by a target, could trigger code execution on otherwise read-only actions such as sl l...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104026/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-19652 - Critical (9.8)

The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and c...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-19652/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2026-104610 - Critical (10)

A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_en_xpon. This impacts the function boaGetVar of the file /boaform/formLoopBack of the component Boa Web Server. Such manipulation of the argument Ethtype leads to stac...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-104610/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack