TR7 ASP (TR7 Cyber Defense Inc.) is vulnerable to unauthenticated OS command injection (CVE-2026-16740, CVSS 9.8, CRITICAL). Remote attackers can fully compromise affected versions. Restrict access & monitor for abuse. https://radar.offseq.com/threat/cve-2026-16740-cwe-306-missing-authentication-for-critical-function-in-tr7-cyber-defense-inc-tr7-asp-604c8853c8296eb5 #OffSeq #Vuln #TR7 #CVE202616740
OffSequence
OffSeq is a cybersecurity company enhancing organizational digital resilience through comprehensive protection against evolving cyber threats. We offer specialized services for businesses of all sizes, with particular expertise in Baltic, Scandinavian, Belgian markets and EU regulatory compliance.
- Posts
- 3,862
- Followers
- 152
- Following
- 0
-
Citrix, Fortinet, & Ivanti patched 29 vulnerabilities (many CRITICAL). Ivanti Connect Secure VPN zero-day (actively exploited) fixed; Fortinet FortiSIEM/FortiSandbox GUI critical bugs resolved. Apply updates ASAP. https://radar.offseq.com/threat/citrix-fortinet-ivanti-patch-29-vulnerabilities-across-their-products-cf133853998d0c8b #OffSeq #Vulnerability #Infosec #ZeroDay
-
CVE-2026-89310: CRITICAL SQL injection in JTL-WMS (<2.0.7, <2.1.3, <2.2.1) 🛑 Remote code execution possible via unsanitized request body. No patch yet. Implement input validation & monitor vendor info: https://radar.offseq.com/threat/cve-2026-89310-cwe-89-improper-neutralization-of-special-elements-used-in-an-sql-command-sql-injection-4dc7d194ff0633df #OffSeq #SQLInjection #Vuln #Infosec
-
CVE-2026-104800: CRITICAL RCE flaw in streetforce1 AGE-GATE WordPress plugin (≤1.0). Unauthenticated attackers can run arbitrary code via unsafe admin.php endpoint. Remove or restrict plugin use ASAP. https://radar.offseq.com/threat/cve-2026-104800-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-streetforce1-age-gate-02cdeee893e722b9 #OffSeq #WordPress #Vuln #RCE
-
CVE-2026-110447 (CRITICAL, CVSS 9.2) allows RCE via OS command injection in Collabora Online Built-in CODE Server <26.4.303 (richdocumentscode, Nextcloud). Exploited in the wild since Sept 2026. Patch required. https://radar.offseq.com/threat/cve-2026-110447-cwe-78-improper-neutralization-of-special-elements-used-in-an-os-command-os-command-f68ba52513af6028 #OffSeq #Infosec #Nextcloud #CVE2026110447
-
Ghostscript <10.08.0 is affected by CRITICAL CVE-2026-39919: heap-based buffer overflow in the JPEG 2000 output adapter allows code execution via crafted PDFs. Patch to 10.08.0+. https://radar.offseq.com/threat/cve-2026-39919-heap-based-buffer-overflow-in-artifex-software-ghostscript-343c7db1b580e876 #OffSeq #Vuln #Ghostscript #Security
-
CVE-2026-109110: CRITICAL OS command injection in Wavlink WL-WN592AX6 (v250422). Remote attackers can execute OS commands — exploit published. No patch. Restrict access & monitor activity. https://radar.offseq.com/threat/cve-2026-109110-os-command-injection-in-wavlink-wl-wn592ax6-254609e635513843 #OffSeq #CVE2026109110 #IoTSecurity #Vuln
-
CVE-2026-108971 (CRITICAL, CVSS 9.4) in D-Link DCS-930L: improper cryptographic signature verification in Emergency HTTP Recovery Server allows remote, unauthenticated firmware install. Exploit is public. Restrict access & monitor activity. https://radar.offseq.com/threat/cve-2026-108971-improper-verification-of-cryptographic-signature-in-d-link-dcs-930l-53e980de3cb5343b #OffSeq #DLink #IoT #Vuln
-
CRITICAL CVE-2026-89110 in SAP NetWeaver Visual Composer: Low-priv users can exploit insufficient auth checks to fully compromise remote systems. No patch yet — restrict access & monitor activity. Details: https://radar.offseq.com/threat/cve-2026-89110-cwe-749-exposed-dangerous-method-or-function-in-sapse-sap-netweaver-visual-composer-f4b6d144b645c4b3 #OffSeq #SAP #Vuln #CVEs
-
CVE-2026-109758: CRITICAL prototype pollution in Perforce Helix Authentication Service (2022.1-2025.2). Default SCIM token enables attacker access, user/group manipulation, and RCE risk. Upgrade to 2026.1. https://radar.offseq.com/threat/cve-2026-109758-cwe-1321-improperly-controlled-modification-of-object-prototype-attributes-prototype-78bc5506a3b6cf63 #OffSeq #CVE2026109758 #infosec #vuln
-
CRITICAL SSRF (CVE-2026-89111) in SAP Cloud SDK for Python: attackers can redirect OAuth2 token requests via tenant_subdomain, exposing client credentials. No patch yet. Restrict input, monitor traffic. https://radar.offseq.com/threat/cve-2026-89111-cwe-918-server-side-request-forgery-in-sapse-sap-cloud-b5baed1f14ad0244 #OffSeq #SAP #SSRF #Vulnerability
-
IBM i 7.3 – 7.6 HTTP Server Admin is vulnerable (CVE-2026-96119, CRITICAL, CVSS 9.9). Remote authenticated code execution possible via code injection. Patch urgently. https://radar.offseq.com/threat/cve-2026-96119-cwe-94-improper-control-of-generation-of-code-code-injection-f55b8a017b9f656e #OffSeq #IBM #CVE202696119 #infosec